Access operation level or top-level `security` object

[ahx]

OpenapiFirst::Definition::Operation#security should return information about the security scheme of the current operation and it's scopes/values. If no security scheme is defined for the operation, it should return the top-level security scheme if that is defined.

See specification: Operation, Security Scheme

[ahx]

I can only think of hypothetical use cases for now so I am closing this for now, but I am happy to implement this if anyone wants to use it.

[securepii-dev]

@ahx
I have a Roda app, using OpenAPIFirst middleware and then doing authentication in a Roda plugin. It means there is a slight quirk that the body is being checked for completeness before the auth is so if you pass bad body and no authentication, the result is 400 not the 401 I would expect.

My use case for this would be that the security is checked and rejected (with a 401) if the security data isnt validated.
i.e. if a security schema of BasicAuth is defined (see below) then the Authorization header is checked to see if it has been passed and that the value starts with "Basic" followed by a space and then data that only has base64 characters in it.

Much like checking the type parameters of a schema, it is checking the schema of the security scheme.

I could of course move the authentication to a rack middleware and put it in front of OpenAPIFirst but I think it would be a useful addition to this great piece of software.

components:
  securitySchemes:
    BasicAuth:
      type: http
      scheme: basic