merged

example/package.json

@@ -14,10 +14,11 @@
     "express": "^4.16.4",
     "body-parser": "^1.18.3",
     "cookie-parser": "^1.4.4",
-    "morgan": "^1.9.1",
-    "express-openapi-validator": "file:../"
+    "express-openapi-validator": "file:../",
+    "morgan": "^1.9.1"
   },
   "devDependencies": {
-    "nodemon": "^2.0.1"
+    "nodemon": "^2.0.1",
+    "prettier": "^1.19.1"
   }
 }

package.json

@@ -58,7 +58,7 @@
     "morgan": "^1.9.1",
     "nodemon": "^2.0.0",
     "nyc": "^14.1.1",
-    "prettier": "^1.18.2",
+    "prettier": "^1.19.1",
     "source-map-support": "0.5.14",
     "supertest": "^4.0.2",
     "ts-node": "^8.3.0",

src/framework/types.ts

@@ -1,7 +1,5 @@
 import ajv = require('ajv');
 import { Request, Response, NextFunction } from 'express';
-import { BasePath } from './base.path';
-import { OpenAPIFramework } from '.';
 export { OpenAPIFrameworkArgs };
 
 export interface OpenAPIFrameworkInit {
@@ -28,10 +26,15 @@ export type ValidateResponseOpts = {
   removeAdditional?: 'failing' | boolean;
 };
 
+export type ValidateSecurityOpts = {
+  handlers?: SecurityHandlers;
+};
+
 export interface OpenApiValidatorOpts {
   apiSpec: OpenAPIV3.Document | string;
   validateResponses?: boolean | ValidateResponseOpts;
   validateRequests?: boolean | ValidateRequestOpts;
+  validateSecurity?: boolean | ValidateSecurityOpts;
   ignorePaths?: RegExp;
   securityHandlers?: SecurityHandlers;
   coerceTypes?: boolean | 'array';

src/index.ts

@@ -11,18 +11,22 @@ import {
   OpenApiRequest,
   OpenApiRequestHandler,
   OpenApiRequestMetadata,
+  ValidateSecurityOpts,
 } from './framework/types';
+import { deprecationWarning } from './middlewares/util';
 
 export class OpenApiValidator {
   private readonly options: OpenApiValidatorOpts;
 
   constructor(options: OpenApiValidatorOpts) {
     this.validateOptions(options);
+    this.normalizeOptions(options);
 
     if (options.unknownFormats == null) options.unknownFormats === true;
     if (options.coerceTypes == null) options.coerceTypes = true;
     if (options.validateRequests == null) options.validateRequests = true;
     if (options.validateResponses == null) options.validateResponses = false;
+    if (options.validateSecurity == null) options.validateSecurity = true;
 
     if (options.validateResponses === true) {
       options.validateResponses = {
@@ -36,6 +40,10 @@ export class OpenApiValidator {
       };
     }
 
+    if (options.validateSecurity === true) {
+      options.validateSecurity = {};
+    }
+
     this.options = options;
   }
 
@@ -76,7 +84,7 @@ export class OpenApiValidator {
     this.installMultipartMiddleware(app, context);
 
     const components = context.apiDoc.components;
-    if (components && components.securitySchemes) {
+    if (this.options.validateSecurity && components?.securitySchemes) {
       this.installSecurityMiddleware(app, context);
     }
 
@@ -137,10 +145,10 @@ export class OpenApiValidator {
     app: Application,
     context: OpenApiContext,
   ): void {
-    const securityMiddleware = middlewares.security(
-      context,
-      this.options.securityHandlers,
-    );
+    const securityHandlers = (<ValidateSecurityOpts>(
+      this.options.validateSecurity
+    ))?.handlers;
+    const securityMiddleware = middlewares.security(context, securityHandlers);
     app.use(securityMiddleware);
   }
 
@@ -197,6 +205,15 @@ export class OpenApiValidator {
       ) {
         throw ono('securityHandlers must be an object or undefined');
       }
+      deprecationWarning(
+        'securityHandlers is deprecated. Use validateSecurities.handlers instead.',
+      );
+    }
+
+    if (options.securityHandlers && options.validateSecurity) {
+      throw ono(
+        'securityHandlers and validateSecurity may not be used together. Use validateSecurities.handlers to specify handlers.',
+      );
     }
 
     const unknownFormats = options.unknownFormats;
@@ -215,4 +232,14 @@ export class OpenApiValidator {
         "unknownFormats must contain an array of unknownFormats, 'ignore' or true",
       );
   }
+
+  private normalizeOptions(options: OpenApiValidatorOpts): void {
+    // Modify the recquest
+    if (options.securityHandlers) {
+      options.validateSecurity = {
+        handlers: options.securityHandlers,
+      };
+      delete options.securityHandlers;
+    }
+  }
 }

src/middlewares/util.ts

@@ -101,3 +101,6 @@ export function ajvErrorsToValidatorError(
     }),
   };
 }
+
+export const deprecationWarning =
+  process.env.NODE_ENV !== 'production' ? console.warn : () => {};