[Bug] Authorization header specification using @openapi.parameter is not included Swagger UI request about sanic-ext

[ahopkins]

Yup, that makes sense. That is a feature we need to add still: https://github.com/sanic-org/sanic-ext/blob/main/sanic_ext/extensions/openapi/openapi.py#L230

Hopefully we can squeeze this one into the upcoming release.

[ahopkins]

Documentation

[ahopkins]

Odd. I am curious to know if it is that we are generating invalid OAS, or is an issue with the client. Do you know that this works in other Swagger installations?

[ahopkins]

I don't think this is related, but there is an open PR re: that decorator: #21

[dacasals]

I found the problem and it is specifically related with the Authorization header.
The thing is in this case, as mentioned here
"Note: Header parameters named Accept, Content-Type and Authorization are not allowed. To describe these headers, use the corresponding OpenAPI keywords"

So for the Authorization header i think the sanic-ext needs to implement the specification described here.

So the ir no problem with the openapi.parameter for others headers except headers mentioned above.

In the case of Authorization, we need to generate something like this:

{"openapi": "3.0.0",
  "info": {
    "title": "API",
    "version": "1.0.0",
    "contact": {
      
    }
  },
  "components":
  { "securitySchemes":{
    "BearerAuth":{
      "type": "http",
      "scheme": "bearer"
    }
  }
    
  },

  "paths": {
    "/": {
      "get": {
        "operationId": "get_route_name",
        "summary": "Hello World",
        "security": [{"BearerAuth":[]}],
        "responses": {
          "default": {
            "description": "OK"
          }
        }
      }
    }
  },
  "tags": [
    
  ],
  "servers": [
    
  ]
}

[dacasals]

Thanks, in the mean time if someone get stuck with this and found this thread, you could do a ugly hack like this:

# You must  add  security schemas to the singleton Builder of the specification..

app = Sanic("app", log_config=define_logging_config(LOGGING_CONFIG))
....
# Modify Singleton builder to add security schemes, ex: add a bearerAuth schema for bearer tokens :
SpecificationBuilder().add_component(
    "securitySchemes", "BearerAuth", {"type": "http", "scheme": "bearer"}
...
Extend(app)

from sanic_ext import openapi

# This hack is to override default behavior of sanic_ext openapi allow **secured** decorator. 
def secured(*args, **kwargs):
   #  raise NotImplementedError(
   #    "SecuritySchemas are not yet implemented in sanic-openapi 0.6.3, "
   #     "hopefully they should be ready for the next release."
   # )
    def inner(func):
        OperationStore()[func].secured(*args, **kwargs)
        return func

    return inner


openapi.secured = secured

# Finally annotate your secure route with:

@blueprint.route("/some_route", methods=["POST"])
@openapi.secured("BearerAuth")

Tested on sanic and sanic_ext 21.9.3

[ahopkins]

Working on this

#32

[ahopkins]

This is now released in v21.12.2 without @dacasals nice hack.