Skip to content

OAuth2 Scopes do not render #235

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
kamaydeo opened this issue Jun 16, 2020 · 6 comments
Closed

OAuth2 Scopes do not render #235

kamaydeo opened this issue Jun 16, 2020 · 6 comments

Comments

@kamaydeo
Copy link

I don't know if it's a missing features or a bug but OAuth2 scopes don't show up. See Security section in the yaml.

get:
      tags:
        - APIs
      summary: List all Services
      operationId: listApis
      parameters:
        - in: query
          name: page
          schema:
            type: integer
            default: 1
            minimum: 1
          description: The location of page to be searched.
          example: 5
          required: false
        - in: query
          name: size
          schema:
            type: integer
            default: 20
            minimum: 1
            maximum: 2000
          example: 100
          description: Number of records per page.
          required: false
        - in: query
          name: sort
          schema:
            type: string
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Page.GetApisResponse'
      security:
        - Bearer:
            - admin
        - OAuth2:
            - admin
@mrin9
Copy link
Collaborator

mrin9 commented Jun 16, 2020

Not sure of what you are expecting in the UI.
I could see the scopes in the UI under the AUTHENTICATION section
https://mrin9.github.io/RapiDoc/examples/oauth.html#authentication

@kamaydeo
Copy link
Author

kamaydeo commented Jun 16, 2020

Have a look at AUTHORIZATIONS section
image

@mrin9
Copy link
Collaborator

mrin9 commented Jun 17, 2020

thats not scopes those are the security needed by the operation and these seucrity must be defined under security-schemes

for more info refer to #200 on how RapiDoc shows them

@kamaydeo
Copy link
Author

I already have defined security and securitySchemes.

security:
  - Bearer:
      - write:domain
      - admin
  - OAuth2:
      - write:domain
      - admin

and

components:
  securitySchemes:
    Bearer:
      type: apiKey
      description: |
        Bearer scheme uses static perpetual token and is less secure.
        Token has a `write:domain` or `admin` permission associated with it.
        It determines whether you are authorized to invoke a particular operation or not.
      in: header
      name: Authorization
    OAuth2:
      type: oauth2
      description: |
        OAuth2 scheme is  a safer and more secure way to give you access with a short-lived token.
      flows:
        clientCredentials:
          tokenUrl: https://...../oauth2/token
          scopes:
            'write:domain': Manage Services and Subscribers in your Domain
            admin: Manage Services and Subscribers in all Domains

I would be nice to see what authorizations are available at the individual operation level (which either inherits from global security or operation level security

@mrin9
Copy link
Collaborator

mrin9 commented Jun 17, 2020

they should be shown at operation level on top-right corner of each operation (if you have defined them properly)

image

@mrin9 mrin9 closed this as completed Jun 17, 2020
@kamaydeo
Copy link
Author

It does show up in the top right corner of the each operation but it doesn't contain scope information which could be overridden at the operation level by defining security attribute under responses. OAuth2 scopes add more details such as what permissions you need to have in order to invoke this operation. The top right corner just shows what security schemes are available.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants