swagger-api / swagger-api/swagger-core
Allow scopes to be non-empty for all security scheme types
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 7.5k
- Forks
- 2.3k
- Avg merge
- 18h 1m
- Merged PRs (30d)
- 10
Description
In OpenAPI Specification 3.0.x, the list of scope names of Security Requirement Object MUST be empty if the security scheme type is other than oauth2 or openIdConnect. But in 3.1.0, now it MAY contain role names which are required for the execution.
- In 3.0.3
For other security scheme types, the array MUST be empty.
- In 3.1.0:
For other security scheme types, the array MAY contain a list of role names which are required for the execution, but are not otherwise defined or exchanged in-band.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating the Java model and validation entry points for OpenAPI Security Requirement Objects, then compare their handling of 3.0.x and 3.1.0 documents. Add coverage for non-empty role names with non-OAuth2 and non-OpenID Connect schemes, and verify that existing 3.0.x behavior remains supported.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, openapi
- Domain
- api
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100