chore: add e2e tests for security propagation during join by Daryna-del · Pull Request #2827 · Redocly/redocly-cli

Daryna-del · 2026-05-20T05:59:31Z

What/Why/How?

Added e2e tests for security propagation during join

Reference

#1409

Testing

Screenshots (optional)

Check yourself

This PR follows the contributing guide
All new/updated code is covered by tests
Core code changed? - Tested with other Redocly products (internal contributions only)
New package installed? - Tested in different environments (browser/node)
Documentation update has been considered

Security

The security impact of the change has been considered
Code follows company security practices and guidelines

Note

Low Risk
Only new e2e fixtures and snapshots; no production join or security logic is modified in this diff.

Overview
Adds join e2e coverage for how root-level security behaves when merging OpenAPI specs, tied to #1409.

Two new parameterized cases are registered in join.test.ts: root-security-in-both-specs (each input has its own root security and paths) and root-security-without-paths (one spec has root security but empty paths). Each case includes foo.yaml / bar.yaml fixtures and a snapshot.txt golden output from the CLI join command.

The snapshots document expected behavior: per-operation security is applied from each source’s root requirement (e.g. oauth2 vs bearerAuth), components.securitySchemes are merged, and root security is not left on the merged document when operations carry the effective requirements.

^{Reviewed by Cursor Bugbot for commit 525a38c. Bugbot is set up for automated code reviews on this repo. Configure here.}

changeset-bot · 2026-05-20T05:59:34Z

⚠️ No Changeset found

Latest commit: 525a38c

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

github-actions · 2026-05-20T06:01:27Z

Performance Benchmark (Lower is Faster)

CLI Version	Bundle	Lint	Check Config
cli-latest	▓ 1.00x ± 0.01	▓ 1.00x (Fastest)	▓ 1.03x ± 0.01
cli-next	▓ 1.00x (Fastest)	▓ 1.01x ± 0.01	▓ 1.00x (Fastest)

github-actions · 2026-05-20T06:01:42Z

Coverage Report

Status	Category	Percentage	Covered / Total
🔵	Lines	81.04% (🎯 80%)	7246 / 8941
🔵	Statements	80.39% (🎯 80%)	7528 / 9364
🔵	Functions	84.22% (🎯 83%)	1458 / 1731
🔵	Branches	72.63% (🎯 72%)	4899 / 6745

File Coverage

No changed files found.

Generated in workflow #10045 for commit 525a38c by the Vitest Coverage Report Action

Daryna-del · 2026-05-20T08:17:25Z

@cursor review

Daryna-del · 2026-05-20T09:31:04Z

@cursor review

Daryna-del · 2026-05-20T09:48:42Z

@cursor review

tatomyr

Please also address the bugbot comments.

tatomyr · 2026-05-21T14:33:36Z

 } from '../../utils/miscellaneous.js';
 import type { CommandArgs } from '../../wrapper.js';
-import { COMPONENTS } from '../split/constants.js';
+// import { COMPONENTS } from '../split/constants.js';


Let's remove comments.

tatomyr · 2026-05-21T16:02:19Z

        },
      });
    }
-    if (!security && openapi.hasOwnProperty('security')) {


Why the previous solution was not working? I see it refers to the root security already.

Yeah, good point. Previous solution was working for each case, except when we have paths: {} and security on root level. Simplified the solution to cover this case, please, review one more time.

tatomyr · 2026-05-25T12:45:29Z

+        200:
+          description: OK
+        400:
+          description: Bad request


Suggested change

description: Bad request

description: Bad request

Let's add a newline on file endings.

Added to each file

tatomyr · 2026-05-25T12:48:18Z

+info:
+  title: "spec1"
+  version: 1.0.0
+servers:


Let's add only essential fields and remove others.

tatomyr · 2026-05-25T12:50:00Z

+servers:
+  - url: https://api.example.com
+paths:
+  /post:


It's bad practice to use verbs in paths (especially mixing post and get), so I'm against using it in our examples.

tatomyr · 2026-05-25T12:51:49Z

+          description: Bad request
+      tags:
+        - bar_other
+      security:


If I'm getting it correctly, this path comes from an API description that doesn't have security defined on it; so how it got the security requirement from another description?

Yes, you are right, updated tests

tatomyr · 2026-05-25T12:56:22Z

+          authorizationUrl: https://example.com/oauth/authorize
+          tokenUrl: https://example.com/oauth/token
+          scopes: {}
+    oauth1:


These names are hard to follow. Please use something more meaningful.

cursor

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit ab620eb. Configure here.}

cursor Bot reviewed May 20, 2026

View reviewed changes

Comment thread packages/cli/src/commands/join/utils/get-effective-components-prefix.ts Outdated

Comment thread packages/cli/src/commands/join/utils/get-effective-components-prefix.ts Outdated

cursor Bot reviewed May 20, 2026

View reviewed changes

Comment thread tests/e2e/join/merged-root-security-from-other-apis/snapshot.txt Outdated

Comment thread packages/cli/src/commands/join/index.ts Outdated

cursor Bot reviewed May 20, 2026

View reviewed changes

Comment thread packages/cli/src/commands/join/utils/get-effective-components-prefix.ts Outdated

Daryna-del force-pushed the fix/resolve-root-security-in-join branch from 5bc9605 to ecc35f1 Compare May 20, 2026 11:29

Daryna-del marked this pull request as ready for review May 20, 2026 11:40

Daryna-del requested review from a team as code owners May 20, 2026 11:40

JLekawa approved these changes May 20, 2026

View reviewed changes

JLekawa reviewed May 20, 2026

View reviewed changes

Comment thread .changeset/curvy-ghosts-listen.md Outdated

cursor Bot reviewed May 20, 2026

View reviewed changes

Comment thread packages/cli/src/commands/join/utils/resolve-operation-security.ts Outdated

cursor Bot reviewed May 20, 2026

View reviewed changes

Comment thread packages/cli/src/commands/join/utils/get-effective-components-prefix.ts Outdated

Comment thread packages/cli/src/commands/join/index.ts Outdated

tatomyr reviewed May 21, 2026

View reviewed changes

cursor Bot reviewed May 25, 2026

View reviewed changes

Comment thread packages/cli/src/commands/join/index.ts Outdated

Comment thread packages/cli/src/commands/join/utils/collect-paths.ts Outdated

Comment thread packages/cli/src/commands/join/utils/resolve-operation-security.ts Outdated

cursor Bot reviewed May 25, 2026

View reviewed changes

Comment thread packages/cli/src/commands/join/utils/collect-paths.ts Outdated

Daryna-del force-pushed the fix/resolve-root-security-in-join branch from 11a4935 to 09e577e Compare May 25, 2026 11:51

tatomyr requested changes May 25, 2026

View reviewed changes

Daryna-del force-pushed the fix/resolve-root-security-in-join branch from b887c33 to 1ecab94 Compare May 27, 2026 08:20

Daryna-del changed the title ~~fix: resolve root security during join~~ tests: add e2e tests for security propagation during join May 27, 2026

Daryna-del changed the title ~~tests: add e2e tests for security propagation during join~~ chore: add e2e tests for security propagation during join May 27, 2026

cursor Bot reviewed May 27, 2026

View reviewed changes

Comment thread tests/e2e/join/root-security-without-paths/snapshot.txt Outdated

cursor Bot reviewed May 27, 2026

View reviewed changes

Comment thread tests/e2e/join/root-security-in-both-specs/snapshot.txt Outdated

cursor Bot reviewed May 27, 2026

View reviewed changes

Comment thread tests/e2e/join/root-security-in-both-specs/joined.yaml Outdated

Daryna-del force-pushed the fix/resolve-root-security-in-join branch 2 times, most recently from c4ad9b7 to 4b8bca5 Compare May 29, 2026 07:22

Daryna-del requested a review from tatomyr May 29, 2026 07:23

tatomyr approved these changes Jun 2, 2026

View reviewed changes

Daryna-del force-pushed the fix/resolve-root-security-in-join branch from 4b8bca5 to cdac599 Compare June 2, 2026 19:59

Daryna-del and others added 16 commits June 3, 2026 09:45

fix: resolve root security during join

793ccc2

fix: address to cursor comments and added e2e tests

86a6c1c

fix: address to cursor comments

435b26b

chore: add changeset

2befbef

Apply suggestion from @JLekawa

274ffda

fix: address to cursor comments and improve tests

f5de1a0

chore: simplify solution

1dfeba3

fix: remove unnecessary files

3ca07fa

tests: add test with empty security

1e1d2af

chore: revert changes

a12e7ba

tests: adjust security test in join

e7aaa5d

fix: snapshots

cc9329b

fix: snapshots

b38fd30

fix: snapshot

e958327

fix: remove unnecessary files

542a5f1

fix: remove unnecessary fields from examples

5f66807

Daryna-del force-pushed the fix/resolve-root-security-in-join branch from cdac599 to 5f66807 Compare June 3, 2026 06:45

chore: remove changeset

525a38c

Daryna-del added the no changeset needed label Jun 3, 2026

Daryna-del self-assigned this Jun 3, 2026

Daryna-del merged commit d7e0b7a into main Jun 3, 2026
51 of 52 checks passed

Daryna-del deleted the fix/resolve-root-security-in-join branch June 3, 2026 07:04

Conversation

Daryna-del commented May 20, 2026 • edited by cursor Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What/Why/How?

Reference

Testing

Screenshots (optional)

Check yourself

Security

Uh oh!

changeset-bot Bot commented May 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ No Changeset found

Uh oh!

github-actions Bot commented May 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Performance Benchmark (Lower is Faster)

Uh oh!

github-actions Bot commented May 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Coverage Report

Uh oh!

Daryna-del commented May 20, 2026

Uh oh!

Uh oh!

Uh oh!

Daryna-del commented May 20, 2026

Uh oh!

Uh oh!

Uh oh!

Daryna-del commented May 20, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

tatomyr left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Daryna-del commented May 20, 2026 •

edited by cursor Bot

Loading

changeset-bot Bot commented May 20, 2026 •

edited

Loading

github-actions Bot commented May 20, 2026 •

edited

Loading

github-actions Bot commented May 20, 2026 •

edited

Loading