[BUG] PHPSlim4 - Want only 1 authentication method out of multiple

Bug Report Checklist

• Have you provided a full/minimal spec to reproduce the issue?
• Have you validated the input using an OpenAPI validator (example)?
• What’s the version of OpenAPI Generator used? 4.2.1
• Have you search for related issues/PRs?
• What’s the actual output vs expected output? Actual: adds all security schemes in middlewares that all get executed. Expected: only one security scheme should match.

Description

The generator does not take into account the fact that multiple security schemes are defined as ‘OR’. In other words, the generated PHP Slim code will always try to perform all authentication methods simultaneously.

They are added in the middewares like this:

$this->addRoute(..
                $middlewares
            )->setName($operation['operationId']);

openapi-generator version

4.2.1

OpenAPI declaration file content or url

        get:
            ...
            security:
                -
                    AdminToken: []
                -
                    UserJWT: []
                -
                    ExternalToken: []

Steps to reproduce

Create an OpenApi operation with multiple possible security schemes.

Related issues/PRs

Looks similar to https://github.com/OpenAPITools/openapi-generator/issues/3844 for Python. Also https://github.com/OpenAPITools/openapi-generator/issues/797 seems relavant.

[wing328]

I think the example provided by @richardwhiuk is correct to explain AND, OR in security definitions for endpoints.

Your example (even more complex) is also correct.

[richardwhiuk]

Should be confirmed, but my understanding of the spec is:

openapi: 3.0.1
paths:
  /security-requirement-all:
    post:
      security:
      - api_key: []
        oauth: ["scope"]
  /security-requirement-one-of:
    post:
      security:
      - api_key: []
      - oauth: ["scope"]
components:
  securitySchemes:
    api_key:
      type: apiKey
      name: X-Api-Key
      in: header
    oauth:
      type: oauth2
      flow:
        implicit:
          authorizationUrl: https://example.com/api/oauth/dialog
          scopes:
            scope: sample scope

The first specifies a Security Requirement object with two requirements.

The second gives two options for the Security Requirement object, one of which must be satisfied.