search

RepreZen / KaiZen-OpenApi-Parser

High-performance Parser, Validator, and Java Object Model for OpenAPI 3.x
130 stars 31 forks source link

Security scheme parsing appears to be incorrect. #260

Open trinary opened 2 years ago

trinary commented 2 years ago

Hello, I've been having trouble using this library to parse oauth2 security schemes in OpenAPI 3.0 documents. I believe that the parser as implemented does not match the OpenAPI spec. There may be other issues, but on security schemes specifically the parser looks for schemes of the structure (from kaizen-openapi-parser/src/test/resources/models/parseTest.yaml):

    scheme2:
      type: oauth2
      description: This is a description
      name: name
      in: query
      scheme: http
      bearerFormat: bearerFormat
      flow:
        authorizationCode:
          authorizationUrl: authorizationUrl
          tokenUrl: tokenUrl
          refreshUrl: refreshUrl
          scopes:
            xxx: xxx
            yyy: yyy
            x-foo: []
          x-foo: foo

The "flow" property here is incorrect and should be "flows", see https://spec.openapis.org/oas/latest.html#security-scheme-object

The linksTest.yaml and parseTest.yaml files used for testing do not validate with several openapi validation tools.