feat: update security requirements (PROVCON-5343)

Author: ben-smartbear

packages/apidom-ls/src/config/a2a/config.ts

@@ -17,6 +17,7 @@ import httpAuthSecuritySchemeMeta from './http-auth-security-scheme/meta.ts';
 import oauth2SecuritySchemeMeta from './oauth2-security-scheme/meta.ts';
 import openIdConnectSecuritySchemeMeta from './open-id-connect-security-scheme/meta.ts';
 import mutualTlsSecuritySchemeMeta from './mutual-tls-security-scheme/meta.ts';
+import securityRequirementMeta from './security-requirement/meta.ts';
 import ApilintCodes from '../codes.ts';
 
 export default {
@@ -49,4 +50,5 @@ export default {
   oauth2SecurityScheme: oauth2SecuritySchemeMeta,
   openIdConnectSecurityScheme: openIdConnectSecuritySchemeMeta,
   mutualTlsSecurityScheme: mutualTlsSecuritySchemeMeta,
+  securityRequirement: securityRequirementMeta,
 };

packages/apidom-ls/src/config/a2a/security-requirement/completion.ts

@@ -0,0 +1,25 @@
+import {
+  ApidomCompletionItem,
+  CompletionFormat,
+  CompletionType,
+} from '../../../apidom-language-types.ts';
+import { A2A1 } from '../target-specs.ts';
+
+const completion: ApidomCompletionItem[] = [
+  {
+    label: 'schemes',
+    insertText: 'schemes',
+    kind: 14,
+    format: CompletionFormat.OBJECT,
+    type: CompletionType.PROPERTY,
+    insertTextFormat: 2,
+    documentation: {
+      kind: 'markdown',
+      value:
+        "Map of security scheme names to arrays of required scopes. Each key is a security scheme name from the Agent Card's `securitySchemes`, and each value is a list of required OAuth2 scopes (or an empty list if not applicable).",
+    },
+    targetSpecs: A2A1,
+  },
+];
+
+export default completion;

packages/apidom-ls/src/config/a2a/security-requirement/documentation.ts

@@ -0,0 +1,15 @@
+import { A2A1 } from '../target-specs.ts';
+
+/**
+ * Hover documentation for A2A v1 SecurityRequirement fields.
+ * See [SecurityRequirement](https://a2a-protocol.org/latest/definitions/#security-requirement).
+ */
+const documentation = [
+  {
+    target: 'schemes',
+    docs: "Map of security scheme names to arrays of required scopes. Each key is a security scheme name from the Agent Card's `securitySchemes`, and each value is a list of required OAuth2 scopes (or an empty list if not applicable).",
+    targetSpecs: A2A1,
+  },
+];
+
+export default documentation;

packages/apidom-ls/src/config/a2a/security-requirement/lint/allowed-fields.ts

@@ -0,0 +1,18 @@
+import { DiagnosticSeverity } from 'vscode-languageserver-types';
+
+import ApilintCodes from '../../../codes.ts';
+import { LinterMeta } from '../../../../apidom-language-types.ts';
+import { A2A1 } from '../../target-specs.ts';
+
+const allowedFieldsLint: LinterMeta = {
+  code: ApilintCodes.NOT_ALLOWED_FIELDS,
+  source: 'apilint',
+  message: 'Object includes not allowed fields',
+  severity: DiagnosticSeverity.Error,
+  linterFunction: 'allowedFields',
+  linterParams: [['schemes']],
+  marker: 'key',
+  targetSpecs: A2A1,
+};
+
+export default allowedFieldsLint;

packages/apidom-ls/src/config/a2a/security-requirement/lint/index.ts

@@ -0,0 +1,5 @@
+import allowedFieldsLint from './allowed-fields.ts';
+
+const lints = [allowedFieldsLint];
+
+export default lints;

packages/apidom-ls/src/config/a2a/security-requirement/meta.ts

@@ -0,0 +1,12 @@
+import { FormatMeta } from '../../../apidom-language-types.ts';
+import lint from './lint/index.ts';
+import completion from './completion.ts';
+import documentation from './documentation.ts';
+
+const meta: FormatMeta = {
+  lint,
+  completion,
+  documentation,
+};
+
+export default meta;

packages/apidom-ls/test/a2a.ts

@@ -44,6 +44,17 @@ const agentCardDeviceCodeMissingScopes = fs
   )
   .toString();
 
+const agentCardSecurityRequirementNotAllowedFields = fs
+  .readFileSync(
+    path.join(
+      __dirname,
+      'fixtures',
+      'a2a',
+      'agent-card-security-requirement-not-allowed-fields.json',
+    ),
+  )
+  .toString();
+
 describe('apidom-ls-a2a', function () {
   const context: LanguageServiceContext = {
     metadata: metadata(),
@@ -359,6 +370,35 @@ describe('apidom-ls-a2a', function () {
     assert.deepEqual(result, expected);
   });
 
+  it('reports not-allowed fields on SecurityRequirement', async function () {
+    this.timeout(10000);
+
+    const validationContext: ValidationContext = {
+      comments: DiagnosticSeverity.Error,
+      maxNumberOfProblems: 100,
+      relatedInformation: false,
+    };
+
+    const doc = TextDocument.create(
+      'foo://bar/security-requirement-not-allowed-fields.json',
+      'json',
+      0,
+      agentCardSecurityRequirementNotAllowedFields,
+    );
+
+    const result = await languageService.doValidation(doc, validationContext);
+    const expected: Diagnostic[] = [
+      {
+        range: { start: { line: 43, character: 4 }, end: { line: 48, character: 5 } },
+        message: 'Object includes not allowed fields',
+        severity: 1,
+        code: 15000,
+        source: 'apilint',
+      },
+    ];
+    assert.deepEqual(result, expected);
+  });
+
   it('reports missing scopes on DeviceCodeOAuthFlow', async function () {
     this.timeout(10000);
 

packages/apidom-ls/test/fixtures/a2a/agent-card-security-requirement-not-allowed-fields.json

@@ -0,0 +1,51 @@
+{
+  "name": "Planner Agent",
+  "description": "Breaks down a request into actionable tasks.",
+  "version": "1.0.0",
+  "iconUrl": "https://agent.example.com/icon.png",
+  "documentationUrl": "https://agent.example.com/docs",
+  "provider": {
+    "organization": "Example Co.",
+    "url": "https://example.com/"
+  },
+  "capabilities": {
+    "streaming": true,
+    "pushNotifications": true,
+    "extendedAgentCard": false
+  },
+  "supportedInterfaces": [
+    {
+      "url": "https://agent.example.com/a2a/v1",
+      "protocolBinding": "JSONRPC",
+      "protocolVersion": "1.0"
+    }
+  ],
+  "defaultInputModes": ["text", "text/plain"],
+  "defaultOutputModes": ["text", "text/plain"],
+  "skills": [
+    {
+      "id": "planner",
+      "name": "Task Planner",
+      "description": "Plans tasks based on user goals.",
+      "tags": ["planner"],
+      "examples": ["Plan a business trip"]
+    }
+  ],
+  "securitySchemes": {
+    "bearer": {
+      "httpAuthSecurityScheme": {
+        "description": "Bearer token authentication.",
+        "scheme": "bearer",
+        "bearerFormat": "JWT"
+      }
+    }
+  },
+  "securityRequirements": [
+    {
+      "schemes": {
+        "bearer": []
+      },
+      "invalidField": "not-allowed"
+    }
+  ]
+}