Skip to content

Conversation

adamdicarlo0
Copy link
Contributor

@adamdicarlo0 adamdicarlo0 commented Feb 19, 2025

When an operation does not include the security key, it means "use the value of the top-level security key." When an operation does specify security, its value overrides the top-level security value. We need to be able to tell these cases apart in order to support operations overriding the global security setting.

Here's how the spec documents this, in its description of the security field, at https://swagger.io/specification/v3/#operation-object:

A declaration of which security mechanisms can be used for this operation. [...] This definition overrides any declared top-level security. To remove a top-level security declaration, an empty array can be used.

@adamdicarlo0 adamdicarlo0 force-pushed the adam/paths-security-should-override-global-security branch from fe37dde to c48edc8 Compare February 19, 2025 00:40
@adamdicarlo0
Copy link
Contributor Author

@wolfadex if you want to avoid a major version bump, I guess I could mark Operation.security as deprecated and have it return Maybe.withDefault [] operation.security, and add a new Operation.maybeSecurity function.

@adamdicarlo0
Copy link
Contributor Author

There are probably other similar cases where being able to tell whether a list was specified is important - I haven't attempted to figure that out.

When an operation does not include the `security` key, it means "use the
value of the top-level `security` key." When an operation *does* specify
`security`, its value overrides the top-level `security` value. We need
to be able to tell these cases apart in order to support operations
overriding the global security setting.

Here's how the spec documents this, in its description of the `security`
field, at https://swagger.io/specification/v3/#operation-object:

> A declaration of which security mechanisms can be used for this
operation. [...] This definition overrides any declared top-level
security. To remove a top-level security declaration, an empty array can
be used.
@adamdicarlo0 adamdicarlo0 force-pushed the adam/paths-security-should-override-global-security branch from eb7e5fc to f749ac0 Compare March 4, 2025 02:07
@wolfadex wolfadex merged commit 13c4b27 into wolfadex:main Mar 4, 2025
1 check failed
@adamdicarlo0 adamdicarlo0 deleted the adam/paths-security-should-override-global-security branch March 4, 2025 18:49
adamdicarlo0 added a commit to adamdicarlo0/elm-open-api-cli that referenced this pull request Mar 4, 2025
pete-murphy pushed a commit to pete-murphy/elm-open-api-cli that referenced this pull request Mar 27, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants