Individual path security scopes ignored

Description

Appears that the codegen is ignoring the scopes specified inside in the paths security section and is always using the scopes specified in the securitySchemes section.

Swagger-codegen version

3.0.26

Swagger declaration file content or url

{
  "openapi": "3.0.0",
  "info": {
    "title": "Test Api",
    "version": "1.0"
  },
  "paths": {
    "/locations": {
      "get": {
        "parameters": [],
        "responses": {},
        "security": [
          {
            "oauth": [
              "location-api:read"
            ]
          }
        ]
      }
    }
  },
  "components": {
    "schemas": {},
    "securitySchemes": {
      "oauth": {
        "flows": {
          "implicit": {
            "authorizationUrl": "https://authUrl",
            "scopes": {
              "scope1": "Scope 1",
              "scope2": "Scope 2",
              "scope3": "Scope 3"
            }
          }
        },
        "type": "oauth2"
      }
    }
  }
}

Generated Result

When using that schema to generate a spring-boot controller the following is being generated:

@Operation(
    summary = "",
    description = "",
    security = {
      @SecurityRequirement(
        name = "oauth",
        scopes = {"scope1", "scope2", "scope3"}
      )
    }
  )

however the @SecurityRequirement annotation should have only contained scope1.

Thoughts

It appears that this could be because the CodegenOperation.authMethods field is being populated with SecurityScheme objects instead of Security objects.

That code is calling the CodegenConfig.fromSecurity(Map<String,SecurityScheme>) method but unfortunately doesn't pass in the security object from the operation.

Has anyone else had this problem? Anyone have a workaround?

Start in modules/swagger-codegen/src/main/java/io/swagger/codegen/v3/DefaultGenerator.java around lines 915-922, then inspect CodegenConfig.fromSecurity(Map<String,SecurityScheme>). Reproduce the spring-boot controller generation with the declaration in this issue and verify that the generated @SecurityRequirement uses the operation's path-level scopes rather than all scopes from the security scheme.