Security key doesn't respect endpoint explicitly setting anonymous access (via `{}`)
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 55/100
Research direction
Start in parser/openapi.py at the referenced line around 423, where the endpoint security value is converted into the requires-security-check result. Compare the four security configurations in the issue, especially lists containing {}. Done means generated client argument expectations distinguish truly anonymous, explicitly anonymous, optional-authentication, and required-authentication endpoints correctly; no test file is named in the issue.
Written by the indexing model from the issue text.
Description
Thanks for this wonderful library! It's been SO helpful :)
Describe the bug
The client args in generated methods (Client vs AuthenticatedClient) don't match those described by security in the spec, when explicitly anonymous access is permitted in an endpoint's security list, as allowed in spec:
An empty Security Requirement Object ({}) indicates anonymous access is supported. [ref, with examples]
Example:
/auth-optional-explicit:
get:
summary: Requires auth but has empty object
security: # <--- client: AuthenticatedClient (EXPECTED: Client | AuthenticatedClient)
- {}
- ApiKeyAuth: []
responses:
'200':
description: OK
This is due to this line
>>> bool([])
False
>>> bool([{"ApiKeyAuth": []}])
True
>>> bool([{"ApiKeyAuth": []}, {}])
True
>>> bool([{}])
True
We would want the last two to return False. We should check if {} is anywhere in a list (when it's a list).
This would do the trick:
requires_security_check = lambda sec: bool(sec or []) and {} not in (sec or [])
OpenAPI Spec File
openapi: 3.1.0
info:
title: Security Test API
version: 1.0.0
servers:
- url: https://example.com
paths:
/no-auth-specified:
get:
summary: Truly anonymous
security: [] # client: Client | AuthenticatedClient (EXPECTED: same)
responses:
'200':
description: OK
/explicit-anon:
get:
summary: Requires auth but has empty object
security: # <--- client: AuthenticatedClient (EXPECTED: not sure, but def not this)
- {}
responses:
'200':
description: OK
/auth-optional-explicit:
get:
summary: Requires auth but has empty object
security: # <--- client: AuthenticatedClient (EXPECTED: Client | AuthenticatedClient)
- {}
- ApiKeyAuth: []
responses:
'200':
description: OK
/auth-required:
get:
summary: Requires API key
security: # <--- client: AuthenticatedClient
- ApiKeyAuth: []
responses:
'200':
description: OK
components:
securitySchemes:
ApiKeyAuth:
type: apiKey
in: header
name: X-API-Key
Desktop (please complete the following information):
- OS: [e.g. macOS 10.15.1]
- Python Version: [e.g. 3.8.0]
- openapi-python-client version [e.g. 0.1.0]
Additional context
...
- Dominant language
- Python
- Stars
- 2k
- Forks
- 293
- Avg merge
- 34m
- Merged PRs (30d)
- 1
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from openapi-generators/openapi-python-client
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
-
Difficulty 3/5 1-2 days Newbie friendliness 72/100
openapi-generators/openapi-python-client#1451 · 1 comment ·
-
Difficulty 3/5 1-2 days Newbie friendliness 52/100
-
Difficulty 3/5 1-2 days Newbie friendliness 64/100
openapi-generators/openapi-python-client#1435 · 1 comment ·
All issues in openapi-generators/openapi-python-client
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
anthropics/skills#1811 · 1 comment ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
speaches-ai/speaches#678 ·
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
datalayer/mcp-compose#42 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
conda-forge/spacy-feedstock#177 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
UKGovernmentBEIS/inspect_evals#2523 ·