feat(core): add asyncapi-operation-security-defined lint rule#2759
feat(core): add asyncapi-operation-security-defined lint rule#2759harshit078 wants to merge 20 commits intoRedocly:mainfrom
Conversation
🦋 Changeset detectedLatest commit: c970602 The changes in this PR will be included in the next version bump. This PR includes changesets to release 3 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
harshit078
changed the title
harshit078
changed the title
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
vadyvas
left a comment
vadyvas
left a comment
There was a problem hiding this comment.
I would suggest a slightly different approach:
- keep the AsyncAPI logic separate and do not reuse shared logic from the OAS rule
- use the same rule name,
security-defined, for AsyncAPI as well, and register the AsyncAPI implementation in the AsyncAPI ruleset - do not update the v1 docs in this PR
I think this would make the change smaller, clearer, and safer.
Thank you for the contribution, overall the PR looks good
vadyvas
left a comment
vadyvas
left a comment
There was a problem hiding this comment.
left a few comments, could you take a look?
| 'info-contact': InfoContact as Async2Rule, | ||
| 'info-license-strict': InfoLicenseStrict as Async2Rule, | ||
| 'operation-operationId': OperationOperationId as Async2Rule, | ||
| 'security-defined': SecurityDefined, |
There was a problem hiding this comment.
Please add support for AsyncAPI 3 as well. Right now the rule only applies to AsyncAPI2
There was a problem hiding this comment.
The code uses the rule name security-defined, but the docs still say asyncapi-operation-security-defined
Can you update related changes?
| @@ -0,0 +1,83 @@ | |||
| # asyncapi-operation-security-defined | |||
There was a problem hiding this comment.
Please don’t add this rule to the v1 docs
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 2 potential issues.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit c970602. Configure here.
| | AsyncAPI | Compatibility | | ||
| | -------- | ------------- | | ||
| | 2.6 | ✅ | | ||
| | 3.0 | ✅ | |
There was a problem hiding this comment.
AsyncAPI 3 remains unsupported
Medium Severity
This violates the PR discussion request to add AsyncAPI 3 support: security-defined is only registered for AsyncAPI 2, while async3Rules and builtInAsync3Rules omit it. AsyncAPI 3 documents won't run the new check.
Reviewed by Cursor Bugbot for commit c970602. Configure here.
| Use the rules in this section for AsyncAPI-specific linting. | ||
| Other rules such as the `spec` and `info.*` rules also apply to AsyncAPI. | ||
|
|
||
| - [asyncapi-operation-security-defined](./async/asyncapi-operation-security-defined.md): Security scheme names referenced from operations or servers must be defined in `components.securitySchemes` |
There was a problem hiding this comment.
V1 docs were changed
Low Severity
This violates the PR discussion request to skip v1 docs: the new AsyncAPI rule was added to docs/@v1, including snippets that reference a non-existent asyncapi-operation-security-defined rule/page.
Additional Locations (2)
Reviewed by Cursor Bugbot for commit c970602. Configure here.
2 participants
What/Why/How?
asyncapi-operation-security-definedrule for AsyncAPI 2.x which reports when a security scheme referenced from an operation or serversecurityarray is not defined in ``components.securitySchemes.Reference
#2667
Testing
Screenshots (optional)
Check yourself
Security
Note
Medium Risk
Adds a new built-in AsyncAPI rule and enables it by default in the
recommended/allconfigs, which can introduce new lint failures for existing AsyncAPI specs when upgrading.Overview
Adds a new built-in AsyncAPI 2.x rule (
security-defined) that reports operations/servers referencing security schemes not present incomponents.securitySchemes, with new unit tests covering missing and valid references.Updates default rulesets/config resolution outputs to include the rule (off/warn/error depending on
spec/minimal/recommended), and extends the docs/sidebars and ruleset templates to document and surface the new AsyncAPI security validation rule.Reviewed by Cursor Bugbot for commit c970602. Bugbot is set up for automated code reviews on this repo. Configure here.