auth-fixes #3

aetos · 2026-07-19T12:50:18Z

aetos commented

2026-07-19 12:50:18 +00:00

Summary

Resolve {ENV_VAR} placeholders in the OpenAPI spec before serving it. Replace the monolithic x-introspect-url extension with composable x-server-url + individual x-*-path fields so auth endpoints are configurable per-environment without hardcoding.

Changes

openapi_first/app.py — add _resolve_spec_env_vars() that replaces {ENV_VAR} patterns (e.g. {AUTH_SERVER}) with the corresponding OS environment variable before returning the spec JSON. Called in __init__ after spec load.
openapi_first/security.py — build the introspection URL dynamically from x-server-url + x-introspect-path extensions on the bearerAuth security scheme, instead of reading a single x-introspect-url.

Migration

Existing specs using x-introspect-url: "https://auth.example.com/introspect" must switch to the new extension format:

components:
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      x-server-url: "{AUTH_SERVER}"
      x-login-path: "/login"
      x-register-path: "/register"
      x-logout-path: "/logout"
      x-me-path: "/me"
      x-introspect-path: "/introspect"

## Summary Resolve `{ENV_VAR}` placeholders in the OpenAPI spec before serving it. Replace the monolithic `x-introspect-url` extension with composable `x-server-url` + individual `x-*-path` fields so auth endpoints are configurable per-environment without hardcoding. ## Changes - **`openapi_first/app.py`** — add `_resolve_spec_env_vars()` that replaces `{ENV_VAR}` patterns (e.g. `{AUTH_SERVER}`) with the corresponding OS environment variable before returning the spec JSON. Called in `__init__` after spec load. - **`openapi_first/security.py`** — build the introspection URL dynamically from `x-server-url` + `x-introspect-path` extensions on the `bearerAuth` security scheme, instead of reading a single `x-introspect-url`. ## Migration Existing specs using `x-introspect-url: "https://auth.example.com/introspect"` must switch to the new extension format: ```yaml components: securitySchemes: bearerAuth: type: http scheme: bearer x-server-url: "{AUTH_SERVER}" x-login-path: "/login" x-register-path: "/register" x-logout-path: "/logout" x-me-path: "/me" x-introspect-path: "/introspect"

aetos added 4 commits 2026-07-19 12:50:19 +00:00

add spec-driven auth dependency injection a2169b2bb1

- security.py: parse securitySchemes, resolve {ENV_VAR} from env,
  generate FastAPI Depends for Bearer JWT introspection
- app.py: extract schemes, build deps, pass to binder at init
- binder.py: inject Depends() per operation based on spec's security
- __init__.py: export security module
- pyproject.toml: add httpx dependency

build introspect URL from x-server-url + x-introspect-path cda158e549

- security.py: read x-server-url and x-introspect-path separately
  from resolved security scheme, join to form introspect URL

resolve {ENV_VAR} placeholders in spec before serving 0dc96907fa

- app.py: add _resolve_env and _resolve_spec_env_vars to replace
  {ENV_VAR} patterns (e.g. {AUTH_SERVER}) with os.environ values
  so the frontend receives resolved URLs via /openapi.json

fix indentation on _resolve_spec_env_vars call in __init__ bbd45cbf2d

aetos merged commit b3f3068f8d into main

2026-07-19 14:47:03 +00:00

aetos deleted branch auth-fixes

2026-07-19 14:47:03 +00:00

aetos referenced this issue from a commit

2026-07-19 14:47:03 +00:00

auth-fixes (#3)

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: aetos/openapi-first#3