Discussion on Handling Endpoint Security in OpenAPI with `OpenApi.fromApi`
OpenApi.fromApi[]This definition overrides any declared top-level security. To remove a top-level security declaration, an empty array can be used.
As a result, if you use e.g. swagger, setting any of the authorization methods will have no effect on endpoints unless they explicitly use the same security middleware.
Repro (not swagger, but a repro of the produced OpenAPI spec): https://effect.website/play#4fd70bf979b9
Would it make sense to default to not setting security for an endpoint that has no explicit security middlewares?
Or, due to how middleware is typically assigned to endpoints, would it make sense to combine top-level plus endpoint security middleware when creating the OpenAPI security field for an endpoint?
Thoughts on direction? I'd be happy to contribute a fix.
Similar Threads
Was this page helpful?
