feat: add security-scopes-defined rule#2951
Conversation
🦋 Changeset detectedLatest commit: bbf70aa The changes in this PR will be included in the next version bump. This PR includes changesets to release 3 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
Coverage Report
File Coverage
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Performance Benchmark (Lower is Faster)
|
Co-authored-by: Jacek Łękawa <164185257+JLekawa@users.noreply.github.com>
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Want higher recall? High effort reviews run extra passes and find more bugs. A team admin can switch effort levels in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit bbf70aa. Configure here.
| reference: 'https://redocly.com/docs/cli/rules/common/security-scopes-defined', | ||
| }); | ||
| return; | ||
| } |
There was a problem hiding this comment.
requireScopes flags unused AsyncAPI schemes
Medium Severity
With requireScopes enabled, the AsyncAPI 3 rule reports every oauth2 SecurityScheme that lacks scopes, including unused entries under components. The OAS implementation and the option docs only require scopes on actual security usages, so unused component schemes become false positives.
Reviewed by Cursor Bugbot for commit bbf70aa. Configure here.
2 participants
What/Why/How?
Added security-scopes-defined rule.
It supports OpenAPI 2.0/3.x and AsyncAPI 2.6/3.0, suggests the closest defined scope for typos, and has an opt-in
requireScopesoption that requires OAuth2 security requirements to list at least one scope.Reference
Testing
Screenshots (optional)
Check yourself
Security
Note
Low Risk
Additive lint rule and preset defaults (warn in recommended); no runtime auth or API behavior changes, though users may see new warnings on existing specs.
Overview
Adds a new built-in lint rule
security-scopes-definedthat flags OAuth2 scopes used in security requirements when they are not declared on the corresponding security scheme, with typo suggestions viagetSuggest.OpenAPI 2.x/3.x and AsyncAPI 2.6 use a shared implementation that walks
SecurityRequiremententries and compares against flowscopes(OAS3) or top-levelscopes(OAS2). AsyncAPI 3.0 gets a dedicated rule that validates schemescopesagainst flowavailableScopes. Non-oauth2schemes and missing schemes are skipped (the latter remainsecurity-defined’s job).Optional
requireScopesenforces at least one scope on OAuth2 requirements (or on AsyncAPI 3 schemes). The rule is wired into OAS2/OAS3/Async2/Async3 rule indexes, typed rule IDs, and preset configs:warninrecommended,errorinrecommended-strictandall,offinminimalandspec. Docs, sidebar, changeset, and config test snapshots are updated accordingly.Reviewed by Cursor Bugbot for commit bbf70aa. Bugbot is set up for automated code reviews on this repo. Configure here.