Changes reported in operations but only securityScheme changed

Open
#893 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
3/5
Estimated time
1-2 days
Newbie friendliness
55/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Quiet
Tech stack
java
Domain
api

Research direction

Start by reproducing the report with the two OpenAPI 3.1 documents shown and the openapi-diff-core 2.1.6 dependency. Trace how changes to the OAuth2 securityScheme's authorizationUrl and tokenUrl are assigned to POST /users, then update the reported change location and verify the resulting message identifies the security-scheme change.

Written by the indexing model from the issue text.

Description

Render capabilities

I am using

    testImplementation("org.openapitools.openapidiff:openapi-diff-core:2.1.6") {
        exclude(group = "io.swagger.core.v3", module = "swagger-core")
        exclude(group = "io.swagger.core.v3", module = "swagger-models")
        exclude(group = "io.swagger.core.v3", module = "swagger-annotations")
    }

Given the two API docs to compare where the only change is in authorizationUrl ('' vs. 'some_value') and tokenUrl ('' vs. 'some_value').

First file 
components:
  securitySchemes:
    OAuth2:
      bearerFormat: JWT
      flows:
        authorizationCode:
          authorizationUrl: ''
          tokenUrl: ''
      in: header
      scheme: bearer
      type: oauth2
info:
  title: Company API
  version: V0
openapi: 3.1.0
paths:
  /users:
    post:
      operationId: createUser
      responses:
        "201":
          description: Created
      security:
      - OAuth2: []
servers:
- description: Default Server URL
  url: /api/
Second file 
components:
  securitySchemes:
    OAuth2:
      bearerFormat: JWT
      flows:
        authorizationCode:
          authorizationUrl: 'some_value'
          tokenUrl: 'some_value'
      in: header
      scheme: bearer
      type: oauth2
info:
  title: Company API
  version: V0
openapi: 3.1.0
paths:
  /users:
    post:
      operationId: createUser
      responses:
        "201":
          description: Created
      security:
      - OAuth2: []
servers:
- description: Default Server URL
  url: /api/

The resulting error message is misleading as the issue is not directly related to any concrete endpoint. This took me quite a while to narrow this down to this difference.

So it would be nice to have a more suitable error message.

org.opentest4j.AssertionFailedError: [### Company API (v V0)
---

#### What's Changed
---

##### `POST` /users


#### Result
---

API changes broke backward compatibility

]
Dominant language
Java
Stars
1.1k
Forks
190
No merged PRs in 30d

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from OpenAPITools/openapi-diff

All issues in OpenAPITools/openapi-diff

Similar issues

More Java issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.