ynput / ayon-backend

Server codebase with API access to AYON
Apache License 2.0
18 stars 14 forks source link

Exclude addon endpoints and auth headers from openapi #243

Closed martastain closed 3 weeks ago

martastain commented 3 weeks ago

This PR introduces changes to the way we use OpenAPI schema for generating TypeScript definitions.

Key Changes

Addon Endpoints Filtering

Addon endpoints, which are primarily relevant for addon developers, will now be excluded from the schema by default. These endpoints can be included by setting the ayon_openapi_include_addon_endpoints environment variable. This change reduces unnecessary noise in the schema and improves clarity for the majority of users.

Authorization Options Streamlining

Shared authorization options, which are repeated across all endpoints, are now excluded from the schema. Instead, authorization methods are comprehensively described in the Authorization section of the REST documentation. This avoids redundancy and centralizes authorization information for easier maintenance and reference.

Security Considerations

Excluding addon endpoints by default enhances operational security as these endpoints could potentially expose sensitive information or vulnerabilities. Opting in to include these endpoints ensures they are only exposed when necessary.