swagger-api / swagger-api/swagger-codegen

The scopes from security declaration of an operation are ignored

Open
#12,429 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Mustache
Stars
17.8k
Forks
6k
PR merge metrics
No merged PRs in 30d

Description

Discussed in https://github.com/swagger-api/swagger-codegen/discussions/12428

In the following settings of an operation:

      security:
        - petstore_auth:
            - write:pets
            - read:pets

it seems that only scheme name is retrieved, and the actual list of scopes is ignored, i.e. all scopes are used for operation. The following code is then generated

    @GET
    @Path("/findByStatus")
    @Produces({ "application/json", "application/xml" })
    @Operation(summary = "Finds Pets by status", description = "Multiple status values can be provided with comma separated strings", security = {
        @SecurityRequirement(name = "petstore_auth", scopes = {
            "write:pets",
"read:pets"        })    }, tags={ "pet" }) 

even if the list of scopes is reduced e.g. to

      security:
        - petstore_auth:
            - read:pets

Tested with swagger editor example and downloading code as jaxrs-jersey server code.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce the issue from the Swagger Editor example by generating the JAX-RS Jersey server code from an operation whose security declaration contains one or more scopes. Compare the generated Java @SecurityRequirement with the YAML input; done means reducing the YAML scope list produces the same reduced list in the generated annotation.

Written by the indexing model from the issue text.

Assessment

Tech stack
java, openapi
Domain
api, tooling
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.