swagger-api / swagger-api/swagger-ui
Show required OAuth scopes on each endpoint
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 29k
- Forks
- 9.3k
- Avg merge
- 2d 23h
- Merged PRs (30d)
- 25
Description
The API I am documenting has a lot of scopes available. However, a single endpoint usually only requires one scope. Currently a padlock is displayed on each endpoint and clicking it opens the Available authorizations modal where all scopes the API has are displayed.
It would be great to know which individual scopes are required per endpoint.
I have checked my source swagger json and this information is there on a per endpoint basis. Here is a subset of my swagger json to show the relevant sections:
{
"swagger": "2.0",
"info": {
"description": "Api Documentation",
"version": "1.0",
"title": "Api Documentation",
"termsOfService": "urn:tos",
"contact": {},
"license": {
"name": "Apache 2.0",
"url": "http://www.apache.org/licenses/LICENSE-2.0"
}
},
"paths": {
"/v1/organisations/{id}": {
"get": {
"summary": "Get a single Organisation",
"operationId": "getByIdUsingGET",
"security": [
{
"Auth0": [
"get:organisation"
]
}
],
"deprecated": false
}
}
},
"securityDefinitions": {
"Auth0": {
"type": "oauth2",
"tokenUrl": "https://xxxxxxxxx/oauth/token",
"flow": "application",
"scopes": {
"create:organisation": "Create an Organisation",
"get:organisation": "Get a single Organisation",
"list:organisation": "List Organisations",
"update:organisation": "Update an Organisations",
"delete:organisation": "Delete an Organisations",
}
}
}
}
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing how endpoint-level security data from the Swagger JSON reaches the padlock and Available authorizations modal. Verify that each endpoint displays its required OAuth scopes rather than only the API-wide scope list, using the provided security and securityDefinitions structure as the expected behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, openapi
- Domain
- documentation, frontend
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100