From d58ec043ae497f84a7bb94b8709e1740b4696624 Mon Sep 17 00:00:00 2001
From: Andrew Rouse <anrouse@uk.ibm.com>
Date: Fri, 17 Jun 2022 17:57:17 +0100
Subject: [PATCH] Test security and securitySet in CallbackOperation

---
 .../apps/airlines/resources/ReviewResource.java      | 10 +++++++++-
 .../microprofile/openapi/tck/AirlinesAppTest.java    | 12 ++++++++++++
 2 files changed, 21 insertions(+), 1 deletion(-)

diff --git a/tck/src/main/java/org/eclipse/microprofile/openapi/apps/airlines/resources/ReviewResource.java b/tck/src/main/java/org/eclipse/microprofile/openapi/apps/airlines/resources/ReviewResource.java
index c1cd210f..5674daf8 100644
--- a/tck/src/main/java/org/eclipse/microprofile/openapi/apps/airlines/resources/ReviewResource.java
+++ b/tck/src/main/java/org/eclipse/microprofile/openapi/apps/airlines/resources/ReviewResource.java
@@ -41,6 +41,7 @@
 import org.eclipse.microprofile.openapi.annotations.security.OAuthFlows;
 import org.eclipse.microprofile.openapi.annotations.security.OAuthScope;
 import org.eclipse.microprofile.openapi.annotations.security.SecurityRequirement;
+import org.eclipse.microprofile.openapi.annotations.security.SecurityRequirementsSet;
 import org.eclipse.microprofile.openapi.annotations.security.SecurityScheme;
 import org.eclipse.microprofile.openapi.annotations.servers.Server;
 import org.eclipse.microprofile.openapi.annotations.servers.ServerVariable;
@@ -268,7 +269,14 @@ public Response getReviewByAirlineAndUser(
                                                                                                   schema = @Schema(type = SchemaType.ARRAY,
                                                                                                                    implementation = Review.class))),
                                                       extensions = @Extension(name = "x-callback-operation",
-                                                                              value = "test-callback-operation")),
+                                                                              value = "test-callback-operation"),
+                                                      security = @SecurityRequirement(name = "httpTestScheme"),
+                                                      securitySets = {@SecurityRequirementsSet({
+                                                              @SecurityRequirement(name = "testScheme1"),
+                                                              @SecurityRequirement(name = "testScheme2")
+                                                      }),
+                                                              @SecurityRequirementsSet()
+                                                      }),
                       extensions = @Extension(name = "x-callback", value = "test-callback"))
     })
     @Tag(ref = "Reviews")
diff --git a/tck/src/main/java/org/eclipse/microprofile/openapi/tck/AirlinesAppTest.java b/tck/src/main/java/org/eclipse/microprofile/openapi/tck/AirlinesAppTest.java
index 8c46b302..692dd419 100644
--- a/tck/src/main/java/org/eclipse/microprofile/openapi/tck/AirlinesAppTest.java
+++ b/tck/src/main/java/org/eclipse/microprofile/openapi/tck/AirlinesAppTest.java
@@ -564,6 +564,18 @@ public void testSecurityRequirement(String type) {
                         hasEntry(equalTo("userBearerHttp"), empty()))));
     }
 
+    @RunAsClient
+    @Test(dataProvider = "formatProvider")
+    public void testSecuirtyRequirementInCallback(String type) {
+        ValidatableResponse vr = callEndpoint(type);
+        String callbackOpPath =
+                "paths.'/reviews'.post.callbacks.testCallback.'http://localhost:9080/oas3-airlines/reviews'.get";
+        vr.body(callbackOpPath + ".security", containsInAnyOrder(
+                hasKey("httpTestScheme"),
+                allOf(hasKey("testScheme1"), hasKey("testScheme2")),
+                anEmptyMap()));
+    }
+
     @RunAsClient
     @Test(dataProvider = "formatProvider")
     public void testSecuritySchemes(String type) {