What's the point of `SecurityDefinitions`? about openapi3 HOT 5 CLOSED

Oh, I see, thanks.

Would you make a PR to fix this?

Yep, everything is clear now, so I'll probably do it, hopefully within a couple of weeks.

from openapi3.

So I tried putting something into _openApiSecurity and got the following error in Swagger Editor:

Semantic error at security.0
Security requirements must match a security definition

I didn't read OpenAPI specification carefully, but it looks like I must provide security definitions in order to specify security requirements, but apparently I can't do that in openapi3. Am I missing something?

from openapi3.

Update after reading OAS: apparently I should use _componentsSecuritySchemes :: Definitions SecurityScheme field (in the Components type) to provide all security definitions. SecurityDefinitions is just a newtype for Definitions SecurityScheme. So apparently _swaggerSecurityDefinitions :: SecurityDefinitions was changed to _componentsSecuritySchemes :: Definitions SecurityScheme in 821654c which made SecurityDefinitions type useless (? still not sure), but it was forgotten to remove this type.

from openapi3.

Hi!

apparently I should use _componentsSecuritySchemes :: Definitions SecurityScheme field (in the Components type) to provide all security definitions

Yes. See an example here: https://github.com/biocad/web-template/blob/master/src/Web/Template/Servant/Auth.hs#L295

So apparently _swaggerSecurityDefinitions :: SecurityDefinitions was changed to _componentsSecuritySchemes :: Definitions SecurityScheme in 821654c which made SecurityDefinitions type useless (? still not sure)

Looks like so. However, there is one difference, namely in Semigroup instance for SecurityDefinitions: it uses unionWith (<>), while Definitions SecuritySchem would use the plain union which discards the second version of the conflicting key.

It would only matter for SecuritySchemeOAuth2 type:

Semigroup for this type merges two objects, in case they have different filled flow types. I think this is actually a correct behavior and dropping the newtype was a mistake.

Would you make a PR to fix this?

BTW, the newtype is still used in tests.

from openapi3.

Thanks!

from openapi3.