Move the existing Security Scheme and OAuth Flow(s) Objects and their schema $defs from the OpenAPI Specification #51
+370
−0
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,20 @@ | ||
| # OpenAPI Security Specification JSON Schema | ||
|
|
||
| This directory contains the YAML sources for generating the JSON Schemas for validating OpenAPI Security Specification (OSS) Standardized API Features (SAFs), which are published on [https://spec.openapis.org](https://spec.openapis.org). | ||
|
|
||
| ***NOTE:*** The exact structure and versioning policy of SAF schemas is still being discussed. The current schemas are ported over from the OpenAPI Specification but the approach is subject to change. | ||
|
|
||
| Due to limitations of GitHub pages, the schemas on the spec site are served with `Content-Type: application/octet-stream`, but should be interpreted as `application/schema+json`. | ||
|
|
||
| The sources in this directory, which have `WORK-IN-PROGRESS` in their `$id`s, are _not intended for direct use_. | ||
|
|
||
| ## Schema `$id` dates | ||
|
|
||
| The published schemas on the spec site have an _iteration date_ in their `id`s. | ||
| This allows the schemas for a release line to be updated independent of the spec patch release cycle. | ||
|
|
||
| The iteration version of the JSON Schema can be found in the `$id` field. | ||
| For example, the value of `$id: https://spec.openapis.org/oas/3.1/schema/2021-03-02` means this iteration was created on March 2nd, 2021. | ||
|
|
||
| We are [working on](https://github.com/OAI/OpenAPI-Specification/issues/4152) how to best provide programmatic access for determining the latest date for each schema. | ||
|
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,230 @@ | ||
| $id: 'https://spec.openapis.org/security/legacy/3.3/schema/WORK-IN-PROGRESS' | ||
| $schema: 'https://json-schema.org/draft/2020-12/schema' | ||
|
|
||
| description: The description of OpenAPI legacy security Objects | ||
|
|
||
| $defs: | ||
| security-scheme: | ||
| $comment: https://spec.openapis.org/oas/v3.3#security-scheme-object | ||
| type: object | ||
| properties: | ||
| type: | ||
| enum: | ||
| - apiKey | ||
| - http | ||
| - mutualTLS | ||
| - oauth2 | ||
| - openIdConnect | ||
| description: | ||
| type: string | ||
| deprecated: | ||
| default: false | ||
| type: boolean | ||
| required: | ||
| - type | ||
| allOf: | ||
| - $ref: '#/$defs/specification-extensions' | ||
| - $ref: '#/$defs/security-scheme/$defs/type-apikey' | ||
| - $ref: '#/$defs/security-scheme/$defs/type-http' | ||
| - $ref: '#/$defs/security-scheme/$defs/type-http-bearer' | ||
| - $ref: '#/$defs/security-scheme/$defs/type-oauth2' | ||
| - $ref: '#/$defs/security-scheme/$defs/type-oidc' | ||
| unevaluatedProperties: false | ||
|
|
||
| $defs: | ||
| type-apikey: | ||
| if: | ||
| properties: | ||
| type: | ||
| const: apiKey | ||
| then: | ||
| properties: | ||
| name: | ||
| type: string | ||
| in: | ||
| enum: | ||
| - query | ||
| - header | ||
| - cookie | ||
| required: | ||
| - name | ||
| - in | ||
|
|
||
| type-http: | ||
| if: | ||
| properties: | ||
| type: | ||
| const: http | ||
| then: | ||
| properties: | ||
| scheme: | ||
| type: string | ||
| required: | ||
| - scheme | ||
|
|
||
| type-http-bearer: | ||
| if: | ||
| properties: | ||
| type: | ||
| const: http | ||
| scheme: | ||
| type: string | ||
| pattern: ^[Bb][Ee][Aa][Rr][Ee][Rr]$ | ||
| required: | ||
| - type | ||
| - scheme | ||
| then: | ||
| properties: | ||
| bearerFormat: | ||
| type: string | ||
|
|
||
| type-oauth2: | ||
| if: | ||
| properties: | ||
| type: | ||
| const: oauth2 | ||
| then: | ||
| properties: | ||
| flows: | ||
| $ref: '#/$defs/oauth-flows' | ||
| oauth2MetadataUrl: | ||
| type: string | ||
| format: uri-reference | ||
| required: | ||
| - flows | ||
|
|
||
| type-oidc: | ||
| if: | ||
| properties: | ||
| type: | ||
| const: openIdConnect | ||
| then: | ||
| properties: | ||
| openIdConnectUrl: | ||
| type: string | ||
| format: uri-reference | ||
| required: | ||
| - openIdConnectUrl | ||
|
|
||
| oauth-flows: | ||
| type: object | ||
| properties: | ||
| implicit: | ||
| $ref: '#/$defs/oauth-flows/$defs/implicit' | ||
| password: | ||
| $ref: '#/$defs/oauth-flows/$defs/password' | ||
| clientCredentials: | ||
| $ref: '#/$defs/oauth-flows/$defs/client-credentials' | ||
| authorizationCode: | ||
| $ref: '#/$defs/oauth-flows/$defs/authorization-code' | ||
| deviceAuthorization: | ||
| $ref: '#/$defs/oauth-flows/$defs/device-authorization' | ||
| $ref: '#/$defs/specification-extensions' | ||
| unevaluatedProperties: false | ||
|
|
||
| $defs: | ||
| implicit: | ||
| type: object | ||
| properties: | ||
| authorizationUrl: | ||
| type: string | ||
| format: uri-reference | ||
| refreshUrl: | ||
| type: string | ||
| format: uri-reference | ||
| scopes: | ||
| $ref: '#/$defs/map-of-strings' | ||
| required: | ||
| - authorizationUrl | ||
| - scopes | ||
| $ref: '#/$defs/specification-extensions' | ||
| unevaluatedProperties: false | ||
|
|
||
| password: | ||
| type: object | ||
| properties: | ||
| tokenUrl: | ||
| type: string | ||
| format: uri-reference | ||
| refreshUrl: | ||
| type: string | ||
| format: uri-reference | ||
| scopes: | ||
| $ref: '#/$defs/map-of-strings' | ||
| required: | ||
| - tokenUrl | ||
| - scopes | ||
| $ref: '#/$defs/specification-extensions' | ||
| unevaluatedProperties: false | ||
|
|
||
| client-credentials: | ||
| type: object | ||
| properties: | ||
| tokenUrl: | ||
| type: string | ||
| format: uri-reference | ||
| refreshUrl: | ||
| type: string | ||
| format: uri-reference | ||
| scopes: | ||
| $ref: '#/$defs/map-of-strings' | ||
| required: | ||
| - tokenUrl | ||
| - scopes | ||
| $ref: '#/$defs/specification-extensions' | ||
| unevaluatedProperties: false | ||
|
|
||
| authorization-code: | ||
| type: object | ||
| properties: | ||
| authorizationUrl: | ||
| type: string | ||
| format: uri-reference | ||
| tokenUrl: | ||
| type: string | ||
| format: uri-reference | ||
| refreshUrl: | ||
| type: string | ||
| format: uri-reference | ||
| scopes: | ||
| $ref: '#/$defs/map-of-strings' | ||
| required: | ||
| - authorizationUrl | ||
| - tokenUrl | ||
| - scopes | ||
| $ref: '#/$defs/specification-extensions' | ||
| unevaluatedProperties: false | ||
|
|
||
| device-authorization: | ||
| type: object | ||
| properties: | ||
| deviceAuthorizationUrl: | ||
| type: string | ||
| format: uri-reference | ||
| tokenUrl: | ||
| type: string | ||
| format: uri-reference | ||
| refreshUrl: | ||
| type: string | ||
| format: uri-reference | ||
| scopes: | ||
| $ref: '#/$defs/map-of-strings' | ||
| required: | ||
| - deviceAuthorizationUrl | ||
| - tokenUrl | ||
| - scopes | ||
| $ref: '#/$defs/specification-extensions' | ||
| unevaluatedProperties: false | ||
|
|
||
| specification-extensions: | ||
| $comment: https://spec.openapis.org/oas/v3.3#specification-extensions | ||
| patternProperties: | ||
| '^x-': true | ||
|
|
||
| additionalProperties: | ||
| $ref: '#/$defs/example-or-reference' | ||
|
Comment on lines
+219
to
+225
There was a problem hiding this comment. Something looks not quite right here. Looking a the 3.2 schema, I think the "additionalProperties" came from the "examples" def, so it probably shouldn't be here. |
||
|
|
||
| map-of-strings: | ||
| type: object | ||
| additionalProperties: | ||
| type: string | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I think of the security scheme object as a "discriminated union", with the
typefield being the "discriminator". I think the natural way to think of discriminated unions is as a "oneOf". Is there some advantage or benefit to expressing it as an "allOf" here? Not that I think the current description is "wrong" -- it just doesn't match my intuition. And I think an "allOf" description might be less verbose -- avoiding the "if / then / else" construction in the subschemas.