Extend MinimalPermissionsPlugin to support delegated and application permissions

[waldekmastykarz]

Extend MinimalPermissionsPlugin to support delegated and application permissions. To do this, we need to introduce a new property named schemeName. If specified, the plugin retrieves scopes from that scheme. If not specified, plugin reads information from the first oauth2 scheme in the spec, like it does now.

We need this to allow discovering minimal permissions for delegated and application permissions which are specified in the API spec in separate schemes.

[bartizan]

I have been working on it.

@waldekmastykarz
The change would affect also the plugins:

• ApiCenterMinimalPermissionsPlugin,
• MinimalPermissionsGuidancePlugin.

Should schemeName param be added there either? If not, it would be the first OAuth2 schema in the spec (as it is).
Should I create the separate github issues?

[waldekmastykarz]

Good catch! Let's create separate issues indeed but wait with the implementation. Let's tackle this issue first, and once we have working code merged, replicate to other plugins to save time. We appreciate your help!

[bartizan]

@waldekmastykarz
I'd like to correct the spelling of the setting to schemaName to keep it consistent (in OpenAPI docs it is 'scheme' though). What do you think?

[waldekmastykarz]

schema and scheme are two different things so I suggest we stick to scheme. If schemeName is too confusing, then we can use scheme to better align with OpenAPI docs. Thoughts?

[bartizan]

schema and scheme are two different things so I suggest we stick to scheme. If schemeName is too confusing, then we can use scheme to better align with OpenAPI docs. Thoughts?

I tend to confuse 'scheme' and 'schema' but I agree that keeping it as schemeName seems to be the best compromise.

I considered renaming the parameter to a more definitive name, like 'schemeKey', 'schemeDefininitionName' or 'schemeDefinition', to point at the security scheme object in the spec instead of the scheme name field. The scheme object has a "name" field that is applied for an apiKey scheme, which is the name of the header, query or cookie parameter to be used.