OpenAPI docs for scopes defined on a single route

[andrewsnowden]

Scopes that are defined on an individual route as part of a Security Dependency were not being returned on the OpenAPI JSON that is generated.

This seems to be because when the dependencies are flattened the security_scopes are not being flattened (unlike security_requirements and others which are). This sets the default scopes to an empty list and flattens the scopes of sub dependencies. I've added a test which confirms this in the OAuth2 test.

I'm brand new to the FastAPI code base so I am unsure if there are any unintended consequences with this approach - but all the tests seem to pass and the new behaviour makes sense in my understanding of what the code should do.

[codecov]

Codecov Report

Merging #1592 into master will not change coverage.
The diff coverage is 100.00%.

@@            Coverage Diff            @@
##            master     #1592   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files          236       236           
  Lines         7068      7076    +8     
=========================================
+ Hits          7068      7076    +8     

Impacted Files	Coverage Δ
fastapi/dependencies/models.py	100.00% <100.00%> (ø)
fastapi/dependencies/utils.py	100.00% <100.00%> (ø)
tests/test_security_oauth2.py	100.00% <100.00%> (ø)

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update b87072b...ca7770b. Read the comment docs.

[tiangolo]

Hey @andrewsnowden , thanks for your contribution! Do you have an example code that shows the current problem?

I think there are things to update in the way scopes are currently handled, but I ran your test and it seems to pass with the current version, so I'm not sure this PR would fix it.

Could you write a simple self-contained example that shows the problem?

[github-actions]

Assuming the original need was handled, this will be automatically closed now. But feel free to add more comments or create new issues or PRs.