feat: add apply-root-security decorator by Daryna-del · Pull Request #54 · Redocly/redocly-cli-cookbook

Daryna-del · 2026-06-02T20:53:44Z

Adds a custom decorator that apply root-level security from one spec defined in another after using redocly bundle.

Reference: #1409

tatomyr · 2026-06-03T07:05:18Z

@@ -0,0 +1,12 @@
+import spreadSecurityToOperations from "./decorator";


Suggested change

import spreadSecurityToOperations from "./decorator";

import spreadSecurityToOperations from "./decorator.js";

After all, it's better to define the decorator in place. No need to import it.

tatomyr · 2026-06-03T07:28:05Z

+
+```bash
+# Step 1: join the specs
+redocly join foo.yaml bar.yaml -o joined.yaml


There's no point in joining them as it won't change anything. Unless there are other multiple docs with paths and operations that get joined.

tatomyr · 2026-06-03T07:31:43Z

@@ -0,0 +1,15 @@
+export default function spreadSecurityToOperations({ pathSecurityFile } = {}) {
+  return {
+    Operation: {


This is too complicated. I'd simply apply the referenced file's root security to the bundled description's root. That should be enough.

tatomyr · 2026-06-04T14:50:08Z

+    id: "security-plugin",
+    decorators: {
+      oas3: {
+        "spread-root-security": ({ pathSecurityFile }) => {


Suggested change

"spread-root-security": ({ pathSecurityFile }) => {

"apply-root-security": ({ pathSecurityFile }) => {

It's not spread.

Will this decorator apply securitySchemes to the bundled document too? Otherwise we'll get a wrong security defined.

Good catch, It didn't. Fixed that

tatomyr · 2026-06-09T14:02:37Z

+                const doc = resolvePath(pathSecurityFile, config);
+
+                if (doc?.security !== undefined || root.security === undefined){
+                root.security = doc?.security;


What if the openapi already has security defined? Will this decorator override the existing one?

BTW, let's apply some formatting.

It shouldn't. That was a typo, condition here should be AND not OR, fixed that.
Also, fixed formatting.

tatomyr · 2026-06-09T14:38:09Z

+              leave(root, { config }) {
+                const doc = resolvePath(pathSecurityFile, config);
+
+                if (doc?.security !== undefined && root.security === undefined){


Maybe we can merge the doc and root security somehow? Does it make sense?

Yeah, good point

tatomyr · 2026-06-12T07:30:57Z

+
+        validateOpenapiSpecification(pathSecurityFile, doc, specVersion);
+
+        if (specVersion === 'oas2') {


Let's not overcomplicate it. The purpose of the Cookbook is to demonstrate the possibility, not provide the ultimate solution. Let's focus on OAS3 first.

tatomyr · 2026-06-12T07:31:49Z

+
+function mergeSecurityRequirements(root, doc) {
+  if (!Array.isArray(doc?.security)) return;
+  root.security = [...(root.security || []), ...doc.security];


If there's already such a security requirement, will it duplicate it?

Good catch, It will duplicate. Added a check for that

tatomyr · 2026-06-12T07:34:13Z

+  root.security = [...(root.security || []), ...doc.security];
+};
+
+function mergeSecuritySchemes(root, doc) {


Could you use names like source and targed?

Yes, I can. Renamed

tatomyr · 2026-06-12T07:36:42Z

@@ -0,0 +1,11 @@
+import applyRootSecurity from "./decorator.js";


Suggested change

import applyRootSecurity from "./decorator.js";

import { applyRootSecurity } from "./decorator.js";

tatomyr · 2026-06-12T07:36:51Z

@@ -0,0 +1,54 @@
+const applyRootSecurity = ({ pathSecurityFile } = {}) => {


Suggested change

const applyRootSecurity = ({ pathSecurityFile } = {}) => {

export const applyRootSecurity = ({ pathSecurityFile } = {}) => {

feat: add spread-security-to-operations decorator

ffd3ed2

Daryna-del self-assigned this Jun 3, 2026

tatomyr reviewed Jun 3, 2026

View reviewed changes

chore: address to comments

5dd896c

tatomyr reviewed Jun 4, 2026

View reviewed changes

fix: apply securitySchema

8723d55

Daryna-del changed the title ~~feat: add spread-security-to-operations decorator~~ feat: add apply-root-security decorator Jun 9, 2026

tatomyr reviewed Jun 9, 2026

View reviewed changes

fix: fix override root security and formatting

cfc6070

tatomyr reviewed Jun 9, 2026

View reviewed changes

Daryna-del added 2 commits June 11, 2026 13:35

chore: address to comments and add oas2

5529a31

fix: add empty line at the end

307e3fe

tatomyr reviewed Jun 12, 2026

View reviewed changes

Daryna-del added 3 commits June 12, 2026 11:21

chore: remove oas2 and address to comments

261cde1

chore: improve logic

e65e84c

chore: adjust summary

79aca50

tatomyr approved these changes Jun 12, 2026

View reviewed changes

Daryna-del merged commit 991b270 into main Jun 12, 2026
2 checks passed

Daryna-del deleted the feat/spread-security-to-operation-decorator branch June 12, 2026 13:42

		@@ -0,0 +1,12 @@
		import spreadSecurityToOperations from "./decorator";

	"spread-root-security": ({ pathSecurityFile }) => {
	"apply-root-security": ({ pathSecurityFile }) => {


		validateOpenapiSpecification(pathSecurityFile, doc, specVersion);

		if (specVersion === 'oas2') {

		@@ -0,0 +1,11 @@
		import applyRootSecurity from "./decorator.js";

	import applyRootSecurity from "./decorator.js";
	import { applyRootSecurity } from "./decorator.js";

		@@ -0,0 +1,54 @@
		const applyRootSecurity = ({ pathSecurityFile } = {}) => {

	const applyRootSecurity = ({ pathSecurityFile } = {}) => {
	export const applyRootSecurity = ({ pathSecurityFile } = {}) => {

Uh oh!

Conversation

Daryna-del commented Jun 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

tatomyr Jun 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Daryna-del commented Jun 2, 2026 •

edited

Loading

tatomyr Jun 12, 2026 •

edited

Loading