openapi-generators / openapi-generators/openapi-python-client
Security key doesn't respect endpoint explicitly setting anonymous access (via `{}`)
Nadie ha tomado este issue todavía.
- Lenguaje dominante
- Python
- Estrellas
- 2k
- Forks
- 293
- Merge medio
- 34 min
- PR fusionados (30 d)
- 1
Descripción
Thanks for this wonderful library! It's been SO helpful :)
Describe the bug
The client args in generated methods (Client vs AuthenticatedClient) don't match those described by security in the spec, when explicitly anonymous access is permitted in an endpoint's security list, as allowed in spec:
An empty Security Requirement Object ({}) indicates anonymous access is supported. [ref, with examples]
Example:
/auth-optional-explicit:
get:
summary: Requires auth but has empty object
security: # <--- client: AuthenticatedClient (EXPECTED: Client | AuthenticatedClient)
- {}
- ApiKeyAuth: []
responses:
'200':
description: OK
This is due to this line
>>> bool([])
False
>>> bool([{"ApiKeyAuth": []}])
True
>>> bool([{"ApiKeyAuth": []}, {}])
True
>>> bool([{}])
True
We would want the last two to return False. We should check if {} is anywhere in a list (when it's a list).
This would do the trick:
requires_security_check = lambda sec: bool(sec or []) and {} not in (sec or [])
OpenAPI Spec File
openapi: 3.1.0
info:
title: Security Test API
version: 1.0.0
servers:
- url: https://example.com
paths:
/no-auth-specified:
get:
summary: Truly anonymous
security: [] # client: Client | AuthenticatedClient (EXPECTED: same)
responses:
'200':
description: OK
/explicit-anon:
get:
summary: Requires auth but has empty object
security: # <--- client: AuthenticatedClient (EXPECTED: not sure, but def not this)
- {}
responses:
'200':
description: OK
/auth-optional-explicit:
get:
summary: Requires auth but has empty object
security: # <--- client: AuthenticatedClient (EXPECTED: Client | AuthenticatedClient)
- {}
- ApiKeyAuth: []
responses:
'200':
description: OK
/auth-required:
get:
summary: Requires API key
security: # <--- client: AuthenticatedClient
- ApiKeyAuth: []
responses:
'200':
description: OK
components:
securitySchemes:
ApiKeyAuth:
type: apiKey
in: header
name: X-API-Key
Desktop (please complete the following information):
- OS: [e.g. macOS 10.15.1]
- Python Version: [e.g. 3.8.0]
- openapi-python-client version [e.g. 0.1.0]
Additional context
...
Guía de contribución
Primeros pasos
- Lee el issue completo y luego la guía de contribución del proyecto.
- Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
- Haz un fork del repositorio y trabaja en una rama.
- Abre un pull request que haga referencia al número del issue.
Línea de trabajo
Empieza en parser/openapi.py, en la línea referenciada alrededor de la 423, donde el valor de seguridad del endpoint se convierte en el resultado requires-security-check. Compara las cuatro configuraciones de seguridad del issue, especialmente las listas que contienen {}. El trabajo estará terminado cuando las expectativas de argumentos del cliente generado distingan correctamente entre endpoints verdaderamente anónimos, explícitamente anónimos, con autenticación opcional y con autenticación obligatoria; en el issue no se menciona ningún archivo de pruebas.
Escrito por el modelo de indexación a partir del texto del issue.
Evaluación
- Stack tecnológico
- openapi, python
- Área
- api, security, tooling
- Tipo de issue
- Error
- Dificultad
- 2/5
- Tiempo estimado
- 1-3 horas
- Estado de actividad
- Estancado
- Claridad
- Bien especificado
- Aptitud para principiantes
- 55/100