Add security definitions to the OpenAPI output

test/spec/Feature/OpenApi/OpenApiSpec.hs

@@ -636,3 +636,15 @@ spec actualPgVersion = describe "OpenAPI" $ do
 
       liftIO $ params `shouldBe` Just [aesonQQ|["num", "str"]|]
 
+  describe "Security" $
+    it "does not include security or security definitions by default" $ do
+      r <- simpleBody <$> get "/"
+
+      let sec = r ^? key "security"
+          secDef = r ^? key "securityDefinitions"
+
+      liftIO $ do
+
+        sec `shouldBe` Nothing
+
+        secDef `shouldBe` Nothing

test/spec/Feature/OpenApi/SecurityOpenApiSpec.hs

@@ -0,0 +1,44 @@
+module Feature.OpenApi.SecurityOpenApiSpec where
+
+import Control.Lens ((^?))
+
+import Data.Aeson.Lens
+import Data.Aeson.QQ
+
+import Network.Wai      (Application)
+import Network.Wai.Test (SResponse (..))
+
+import Test.Hspec     hiding (pendingWith)
+import Test.Hspec.Wai
+
+import Protolude hiding (get)
+
+spec :: SpecWith ((), Application)
+spec =
+  describe "Security active" $
+    it "includes security and security definitions" $ do
+      r <- simpleBody <$> get "/"
+
+      let sec = r ^? key "security"
+          secDef = r ^? key "securityDefinitions"
+
+      liftIO $ do
+
+        sec `shouldBe` Just
+          [aesonQQ|
+            [
+              { "JWT": [] }
+            ]
+          |]
+
+        secDef `shouldBe` Just
+          [aesonQQ|
+            {
+              "JWT": {
+                "description": "Add the token prepending \"Bearer \" (without quotes) to it",
+                "in": "header",
+                "name": "Authorization",
+                "type": "apiKey"
+              }
+            }
+          |]

test/spec/Main.hs

@@ -34,6 +34,7 @@ import qualified Feature.OpenApi.IgnorePrivOpenApiSpec
 import qualified Feature.OpenApi.OpenApiSpec
 import qualified Feature.OpenApi.ProxySpec
 import qualified Feature.OpenApi.RootSpec
+import qualified Feature.OpenApi.SecurityOpenApiSpec
 import qualified Feature.OptionsSpec
 import qualified Feature.Query.AndOrParamsSpec
 import qualified Feature.Query.DeleteSpec
@@ -95,6 +96,7 @@ main = do
   let withApp              = app testCfg
       maxRowsApp           = app testMaxRowsCfg
       disabledOpenApi      = app testDisabledOpenApiCfg
+      securityOpenApi      = app testSecurityOpenApiCfg
       proxyApp             = app testProxyCfg
       noAnonApp            = app testCfgNoAnon
       noJwtApp             = app testCfgNoJWT
@@ -171,6 +173,10 @@ main = do
     parallel $ before proxyApp $
       describe "Feature.OpenApi.ProxySpec" Feature.OpenApi.ProxySpec.spec
 
+    -- this test runs with openapi-security-active set to true
+    parallel $ before securityOpenApi $
+      describe "Feature.OpenApi.SecurityOpenApiSpec" Feature.OpenApi.SecurityOpenApiSpec.spec
+
     -- this test runs without an anonymous role
     parallel $ before noAnonApp $
       describe "Feature.Auth.NoAnonSpec" Feature.Auth.NoAnonSpec.spec

test/spec/SpecHelper.hs

@@ -93,6 +93,7 @@ baseCfg = let secret = Just $ encodeUtf8 "reallyreallyreallyreallyverysafe" in
   , configJwtSecretIsBase64     = False
   , configLogLevel              = LogCrit
   , configOpenApiMode           = OAFollowPriv
+  , configOpenApiSecurityActive = False
   , configOpenApiServerProxyUri = Nothing
   , configRawMediaTypes         = []
   , configServerHost            = "localhost"
@@ -134,6 +135,9 @@ testIgnorePrivOpenApiCfg = baseCfg { configOpenApiMode = OAIgnorePriv, configDbS
 testProxyCfg :: AppConfig
 testProxyCfg = baseCfg { configOpenApiServerProxyUri = Just "https://postgrest.com/openapi.json" }
 
+testSecurityOpenApiCfg :: AppConfig
+testSecurityOpenApiCfg = baseCfg { configOpenApiSecurityActive = True }
+
 testCfgBinaryJWT :: AppConfig
 testCfgBinaryJWT =
   let secret = Just . B64.decodeLenient $ "cmVhbGx5cmVhbGx5cmVhbGx5cmVhbGx5dmVyeXNhZmU=" in