openapi swagger connexion中基于角色的令牌认证及其apikey安全性

Question

/lab/samples/list:
    get:
      tags:
      - lab
      summary: get a list of all registered samples
      operationId: list_samples
      responses:
        "200":
          description: successfully returned all available samples and their notification status
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/Sample-For-Lab'
                x-content-type: application/json
        "400":
          description: invalid request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/inline_response'
      security:
      - bearerAuth: ['labuser']

securitySchemes:
    bearerAuth:
      type: apiKey
      name: Authorization
      in: header
      x-apikeyInfoFunc: swagger_server.controllers.authorization_controller.check_bearerAuth

到目前为止还好。我使用swagger-codegen构建了相应的服务器存根，它遵循connexion安全模型，并提供了两个字段api_key，即承载令牌和“required_scopes”，即应该包含“labuser”。访问endpoint时，调用控制器函数：

def check_adminuserAuth(api_key, required_scopes):
    return {'sample_key' : 'sample_value}

当承载令牌正确传递时，required_scopes是none。因此，无法实际验证提供的令牌中显示的凭据和权限是否与授权控制器中endpoint所需的LabUser范围相匹配。我考虑在调用的endpointlist_systemusers()中处理验证，但是该标记没有通过connexion传递。

在做了一些挖掘之后，我发现OpenAPI3.0在全局API级别上提供了apiKey验证（即是否经过身份验证），但不支持每个endpoint的单个作用域。如果您想要单独的作用域，则需要切换到OAuth安全性。然而，OpenAPI3.1通过apiKey安全性支持安全范围

Answer 1

因此，目前使承载令牌安全与单个作用域有效的唯一方法是为每个作用域定义一个安全方案。

securitySchemes:
    adminuserAuth:
      type: apiKey
      description: Provide your bearer token in the format **Bearer <token>**
      name: Authorization
      in: header
      x-apikeyInfoFunc: swagger_server.controllers.authorization_controller.check_adminuserAuth
    statsuserAuth:
      type: apiKey
      description: Provide your bearer token in the format **Bearer <token>**
      name: Authorization
      in: header
      x-apikeyInfoFunc: swagger_server.controllers.authorization_controller.check_statsuserAuth
    labuserAuth:
      type: apiKey
      description: Provide your bearer token in the format **Bearer <token>** 
      name: Authorization
      in: header
      x-apikeyInfoFunc: swagger_server.controllers.authorization_controller.check_labuserAuth

然后在路径定义中添加所需的安全身份验证方案

security:
- labuserAuth: []
- adminuserAuth: []
x-openapi-router-controller: swagger_server.controllers.lab_controller

现在我知道了哪个授权控制器方法被称为用户需要显示的所需作用域，因此可以根据令牌中显示的作用域来验证它。