Yaml oauth2 example readme#2561
Conversation
… and JWT configurations - Migrated security examples from Groovy to YAML for readability and consistency. - Refined API flows and comments for `apikey-to-jwt-conversion` and OAuth2 examples. - Enhanced documentation in `README.md` with clear descriptions of API key, JWT, and OAuth2 usage.
📝 WalkthroughWalkthroughDocumentation and example YAML updated: XML examples replaced with YAML; API key sourcing and OAuth2/JWT wording modernized (Azure Entra ID); OAuth2 example flows simplified by removing Groovy scripting in favor of header forwarding and request/template responses. Changes
Sequence Diagram(s)(omitted) Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
Suggested labels
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. 📜 Recent review detailsConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro 📒 Files selected for processing (2)
🚧 Files skipped from review as they are similar to previous changes (1)
🧰 Additional context used🧠 Learnings (1)📚 Learning: 2025-11-23T15:59:51.742ZApplied to files:
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)
🔇 Additional comments (1)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Fix all issues with AI agents
In @distribution/examples/security/oauth2/membrane/client/apis.yaml:
- Around line 26-30: Fix the inconsistent indentation under the request block by
aligning the list items to match the rest of the file: change the two list
entries "- template:" and "- return:" (and their nested lines like "src: You
accessed the protected resource! Hello ${header[\"X-EMAIL\"]}" and "status:
200") to use the same 8-space indentation as the other request list items so the
"request:" block's list formatting is consistent.
In @README.md:
- Line 902: Replace the unhyphenated phrase "OpenAPI defined permissions" with
the hyphenated compound adjective "OpenAPI-defined permissions" wherever it
appears (e.g., the README occurrence "OpenAPI defined permissions") so the
compound modifier correctly precedes the noun.
📜 Review details
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (3)
README.mddistribution/examples/security/jwt/apikey-to-jwt-conversion/apis.yamldistribution/examples/security/oauth2/membrane/client/apis.yaml
💤 Files with no reviewable changes (1)
- distribution/examples/security/jwt/apikey-to-jwt-conversion/apis.yaml
🧰 Additional context used
🧠 Learnings (1)
📚 Learning: 2025-11-23T15:59:51.742Z
Learnt from: rrayst
Repo: membrane/api-gateway PR: 2339
File: distribution/examples/web-services-soap/rest2soap-template/apis.yaml:17-32
Timestamp: 2025-11-23T15:59:51.742Z
Learning: In Membrane API Gateway YAML configuration files, response flows execute in reverse order. Steps that appear later in the response flow list actually execute first. For example, if a template references properties and setProperty steps appear after the template in the YAML, those setProperty steps will execute before the template renders.
Applied to files:
distribution/examples/security/oauth2/membrane/client/apis.yaml
🪛 LanguageTool
README.md
[grammar] ~902-~902: Use a hyphen to join words.
Context: ...with fine-grained permissions. - OpenAPI defined permissions. See the [API Key P...
(QB_NEW_EN_HYPHEN)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)
- GitHub Check: Automated tests
- GitHub Check: Analyze (java)
🔇 Additional comments (5)
distribution/examples/security/oauth2/membrane/client/apis.yaml (1)
14-20: LGTM! OAuth2 user info forwarding is correctly implemented.The request flow properly extracts the authenticated user's email from the OAuth2 userinfo and forwards it to the backend via the
X-EMAILheader. The property access syntax and target configuration are correct.README.md (4)
876-904: Excellent improvement to the API Keys documentation.The updated section provides much clearer explanation of API key sources (configuration, file, database) and includes a practical YAML example. The addition of advanced use cases with references to detailed configurations is helpful for users.
906-920: LGTM! JWT section correctly updated.The branding update from "Azure AD" to "Azure Entra ID" reflects Microsoft's current naming, and the conversion from XML to YAML example aligns with the PR's modernization goals.
928-947: LGTM! OAuth2 YAML example is clear and consistent.The OAuth2 configuration example correctly demonstrates:
- OAuth2 resource protection with Membrane as the authentication server
- Header forwarding pattern to pass authenticated user information to backends
- Proper use of property access syntax for OAuth2 userinfo
The YAML structure matches the working example in
apis.yaml(with appropriate placeholder backend URL for documentation).
1162-1180: Good enhancement to OpenTelemetry documentation.Adding the diagram reference and providing a concrete YAML configuration example makes this section more actionable for users implementing observability.
2 participants
Summary by CodeRabbit
Documentation
Refactor
✏️ Tip: You can customize this high-level summary in your review settings.