OpenAPI 3 root level security not supported

[airedwin]

Describe the bug Open API supports the keyword 'security' at the root level. Currently there is no commonProperties for 'security' so it gets added to the default 'paths'. See: https://swagger.io/docs/specification/authentication/ Step 2: Applying security

To Reproduce Steps to reproduce the behavior: Create an OpenAPI 3.0 yaml spec with security defined and applied at the root level. Generate a swagger json file. The 'security' object gets put into the 'paths' object in the resulting json.

Expected behavior The 'security' object if at the root level in the yaml should also be at the root level in the resulting json.

Screenshots N/A

[stale[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[ZebboKlaufix]

It seems that this error still occures. Is there any chance to bypass the issue?

[duluca]

Bump.

edit: I discovered a workaround. It works if you use it in the Options object. Given this is an app level config, this is an acceptable place to place this configuration.

Example below:

const options: Options = {
  swaggerDefinition: {
    openapi: '3.0.2',
    components: {
      securitySchemes: {
        bearerAuth: {
          type: 'http',
          scheme: 'bearer',
          bearerFormat: 'JWT',
        },
      },
      security: {
        bearerAuth: [],
      },
   },
}

In contrast, this doesn't work:

/**
 * @openapi
 * components:
 *   securitySchemes:
 *     bearerAuth:
 *       type: http
 *       scheme: bearer
 *       bearerFormat: JWT
 *   responses:
 *     UnauthorizedError:
 *       description: Unauthorized
 *       content:
 *         application/json:
 *           schema:
 *             $ref: "#/components/schemas/ServerMessage"
 *   schemas:
 *     ServerMessage:
 *       type: object
 *       properties:
 *         message:
 *           type: string
 *   security:
 *     - bearerAuth: []
 */