Bug: Security schemes are not validated when using operation level

[leandrodamascena]

Expected Behaviour

The OpenAPI specification expects security schemes to define what type of authentication that API will support and then customers can define the operations that will use that authentication or even whether all operations will use the same authentication.

When using this code, the OpenAPI utility should validate the security defined in operation level and throw an exception as it is a schema validation error. But this is not happening.

from aws_lambda_powertools.event_handler import APIGatewayRestResolver

app = APIGatewayRestResolver(enable_validation=True)

@app.get("/hello", security=[{"apiKey": []}])
def get_schema():
    return app.get_openapi_json_schema()

def lambda_handler(event, context):
    return app.resolve(event, context)

Current Behaviour

This is currently not being validated and customers receive an error when trying to use the OpenAPI specification.

openapischema

{
   "openapi":"3.0.3",
   "info":{
      "title":"Powertools API",
      "version":"1.0.0"
   },
   "servers":[
      {
         "url":"/"
      }
   ],
   "paths":{
      "/hello":{
         "get":{
            "summary":"GET /hello",
            "operationId":"get_schema_hello_get",
            "responses":{
               "200":{
                  "description":"Successful Response",
                  "content":{
                     "application/json":{
                        
                     }
                  }
               },
               "422":{
                  "description":"Validation Error",
                  "content":{
                     "application/json":{
                        "schema":{
                           "$ref":"#/components/schemas/HTTPValidationError"
                        }
                     }
                  }
               }
            },
            "security":[
               {
                  "apiKey":[
                     
                  ]
               }
            ]
         }
      }
   },
   "components":{
      "schemas":{
         "HTTPValidationError":{
            "properties":{
               "detail":{
                  "items":{
                     "$ref":"#/components/schemas/ValidationError"
                  },
                  "type":"array",
                  "title":"Detail"
               }
            },
            "type":"object",
            "title":"HTTPValidationError"
         },
         "ValidationError":{
            "properties":{
               "loc":{
                  "items":{
                     "anyOf":[
                        {
                           "type":"string"
                        },
                        {
                           "type":"integer"
                        }
                     ]
                  },
                  "type":"array",
                  "title":"Location"
               },
               "type":{
                  "type":"string",
                  "title":"Error Type"
               }
            },
            "type":"object",
            "required":[
               "loc",
               "msg",
               "type"
            ],
            "title":"ValidationError"
         }
      }
   }
}

Error:

Code snippet

from aws_lambda_powertools.event_handler import APIGatewayRestResolver

app = APIGatewayRestResolver(enable_validation=True)

@app.get("/hello", security=[{"apiKey": []}])
def get_schema():
    return app.get_openapi_json_schema()

def lambda_handler(event, context):
    return app.resolve(event, context)

Possible Solution

No response

Steps to Reproduce

Use this code

from aws_lambda_powertools.event_handler import APIGatewayRestResolver

app = APIGatewayRestResolver(enable_validation=True)

@app.get("/hello", security=[{"apiKey": []}])
def get_schema():
    return app.get_openapi_json_schema()

def lambda_handler(event, context):
    return app.resolve(event, context)

Powertools for AWS Lambda (Python) version

latest

AWS Lambda function runtime

3.11

Packaging format used

PyPi

Debugging logs

No response

[leandrodamascena]

Working on PR #4421

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

This issue is now closed. Please be mindful that future comments are hard for our team to see.

If you need more assistance, please either tag a team member or open a new issue that references this one.

If you wish to keep having a conversation with other community members under this issue feel free to do so.

[github-actions]

This is now released under 2.39.0 version!