feat(core): add support for combo security #1416

[erossignon]

No description provided.

[relu91]

Small changes (and also watch out that this PR has conflicts as it contains changes from #1418 )

[erossignon]

I am just adding this lingk https://w3c.github.io/wot-thing-description/ontology/wotsec#ComboSecurityScheme https://www.w3.org/TR/2023/REC-wot-thing-description11-20231205/#combosecurityscheme so we can easily retrieve the section that talks about ComboSecurityScheme in our discussion

[relu91]

https://w3c.github.io/wot-thing-description/ontology/wotsec#ComboSecurityScheme

Sorry, but I don't get your point. Are you referring to this statement?

The oneOf combination is equivalent to using different security schemes on forms that are otherwise identical. In this sense a oneOf scheme is not an essential feature but it does avoid redundancy in such cases.

If that's so, I'm ok to return all the schemes referred in the oneOf field.

[erossignon]

I believe we could also handle the case of oneOf , by passing a structure of resolved scheme downward. At the end of the day, the binding need to be made aware of the oneOf security scheme and choose one of them.
Let me propose something

[relu91]

@danielpeintner, what do you think here? This is sort of a bad erroneous condition. It means that initial validation of the consumed thing didn't spot an unsupported security scheme, and we are returning an undefined that will result in a final sparse scs array (with undefined elements).

I believe it should be better to throw ...

[danielpeintner]

Agree with @relu91 that throwing in such a case is the better solution

[erossignon]

Instead of returning undefined, we could returning null. This would cause the scheme to be simply ignored.
In both cases this might cause unpredicable results, expecitally in the credentials settings ( could be ignored or by-passed) so I am i favor of throwing an exception too. ( defensive rather than accommodating )

[egekorkan]

I am just adding this lingk https://w3c.github.io/wot-thing-description/ontology/wotsec#ComboSecurityScheme so we can easily retrieve the section that talks about ComboSecurityScheme in our discussion

I would always point to published standards as that URL is more volatile: https://www.w3.org/TR/2023/REC-wot-thing-description11-20231205/#combosecurityscheme

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 77.54%. Comparing base (3325e12) to head (9ffcaa2).
⚠️ Report is 13 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #1417      +/-   ##
==========================================
- Coverage   77.58%   77.54%   -0.04%     
==========================================
  Files          79       79              
  Lines       15331    15381      +50     
  Branches     1445     1452       +7     
==========================================
+ Hits        11894    11927      +33     
- Misses       3414     3432      +18     
+ Partials       23       22       -1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[danielpeintner]

Thank you, @erossignon 👍