Include the scheme when using http security

[tommyengstrom]

Using https://editor.swagger.io/ to view the API it was complaining about the scheme property not being included when using http auth.

I used this with servant-auth and an orphan instance of HasOpenApi:

instance HasOpenApi sub => HasOpenApi (Auth '[JWT] AuthToken :> sub) where
    toOpenApi _ = authStuff <> toOpenApi (Proxy @sub)
      where
        authStuff :: OpenApi
        authStuff =
            mempty
                &   components
                .   securitySchemes
                <>~ [ ( "BearerAuth"
                      , SecurityScheme (SecuritySchemeHttp HttpSchemeBearer)
                                       (Just "Bearer authentication")
                      )
                    ]
                &   security
                <>~ [SecurityRequirement [("BearerAuth", [])]]

[maksbotan]

Hi @tommyengstrom! Thanks for your PR. It's great, modulo two very minor points.

Sorry for taking so long to review it. And thanks for using openapi3 :)

[maksbotan]

The spec (https://swagger.io/specification/#security-scheme-object) for scheme property with http type says:

The values used SHOULD be registered in the IANA Authentication Scheme registry.

So I'd say we should either add other options as well (Digest, HOBA, ...) or at least provide HttpSchemeCustom Text constructor.

Also, for Bearer scheme the spec mentions an optional field bearerFormat:

A hint to the client to identify how the bearer token is formatted. Bearer tokens are usually generated by an authorization server, so this information is primarily for documentation purposes.

Please add it to the HttpSchemeBearer constructor as Maybe Text field.

[maksbotan]

Please move these instances lower in the file, near instances for other security schemes.

[tommyengstrom]

Hey

I'll have a look at this next week. A bit busy right now, but I intend to do it.

[maksbotan]

Hi @tommyengstrom! Did you have a chance to finish this PR?

[tommyengstrom]

Sorry for the delay.

Not sure this is what you wanted. I dropped the To/FromJSON instances for HttpSchemeType as the bearerFormat thing shows up in the level above.

[maksbotan]

Thanks!

[maksbotan]

Released in https://hackage.haskell.org/package/openapi3-3.0.2.0