Multiple scheme security requirement should be allowed

[jormaechea]

openapi-validator/src/plugins/validation/2and3/semantic-validators/security-ibm.js

Lines 60 to 75 in 0c0b39c

	function validateSecurityObject({ security, path }) {
	security.forEach(schemeObject => {
	// each object in this array should only have one key - the name of the scheme
	const schemeNames = Object.keys(schemeObject);
	const schemeName = schemeNames[0];
	// if there is more than one key, they will be ignored. the structural validator should
	// catch these but in case the spec changes in later versions of swagger,
	// a non-configurable warning should be printed to alert the user
	if (schemeNames.length > 1) {
	result.warning.push({
	path,
	message:
	'The validator expects only 1 key-value pair for each object in a security array.'
	});
	}

According to the standard:

Security Requirement Objects that contain multiple schemes require that all schemes MUST be satisfied for a request to be authorized. This enables support for scenarios where multiple query parameters or HTTP headers are required to convey security information.

You're checking that each Security Requirement Object contains only one scheme, and setting a non-configurable warning.

I suggest one of the following:
a) Remove this validation, because is non-standard.
b) Make it configurable so user can decide what to do with it.

Thanks.

PD: Are you reviewing PRs?

UPDATE
This should be also be fixed, because it only labels the first one as used.

openapi-validator/src/plugins/validation/2and3/semantic-validators/security-definitions-ibm.js

Lines 77 to 78 in f8cc2bd

	// each object in this array should only have one key - the name of the scheme
	const name = Object.keys(scheme)[0];

[dpopp07]

@jormaechea Thanks for pointing this out - this does look like a mistake. To answer your question, yes, we are happy to review PRs so feel free to open one!

[jormaechea]

@dpopp07 Great! I'll tackle it this week and get back to you!

[dpopp07]

🎉 This issue has been resolved in version 0.15.1 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀