fix: resolve root security during join by Daryna-del · Pull Request #2827 · Redocly/redocly-cli

Daryna-del · 2026-05-20T05:59:31Z

What/Why/How?

Fixes a bug where root-level security from joined API descriptions was silently dropped in the output.

Previously, the join command ignored the security field defined at the root of each input spec. According to OpenAPI semantics, root-level security serves as a default for all operations that don't declare their own security. Simply merging root securities into the joined output would incorrectly apply one API's security to another API's operations.

Reference

Closes #1409

Testing

Screenshots (optional)

Check yourself

This PR follows the contributing guide
All new/updated code is covered by tests
Core code changed? - Tested with other Redocly products (internal contributions only)
New package installed? - Tested in different environments (browser/node)
Documentation update has been considered

Security

The security impact of the change has been considered
Code follows company security practices and guidelines

Note

Medium Risk
Changes how merged OpenAPI documents express authentication defaults; wrong behavior could mis-document which schemes apply to operations, though scope is limited to the join command and covered by new e2e snapshots.

Overview
Fixes join so root-level security from each input OpenAPI document is no longer dropped. Operations without their own security now get that spec’s root default (with component prefixing), including when another joined file only defines root security and no paths.

Operation-level rules are unchanged: explicit security on an operation wins; security: [] stays public and is not overridden by root defaults. New e2e cases cover both specs with root security, root-only on a paths-empty file, and operation vs root precedence.

^{Reviewed by Cursor Bugbot for commit 1ecab94. Bugbot is set up for automated code reviews on this repo. Configure here.}

changeset-bot · 2026-05-20T05:59:34Z

🦋 Changeset detected

Latest commit: 1ecab94

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 3 packages

Name	Type
@redocly/cli	Patch
@redocly/openapi-core	Patch
@redocly/respect-core	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

github-actions · 2026-05-20T06:01:27Z

CLI Version	Mean Time ± Std Dev (s)	Relative Performance (Lower is Faster)
cli-latest	1.745s ± 0.022s	▓ 1.00x (Fastest)
cli-next	1.760s ± 0.028s	▓ 1.01x

github-actions · 2026-05-20T06:01:42Z

Coverage Report

Status	Category	Percentage	Covered / Total
🔵	Lines	81% (🎯 80%)	7279 / 8986
🔵	Statements	80.35% (🎯 80%)	7563 / 9412
🔵	Functions	83.96% (🎯 83%)	1456 / 1734
🔵	Branches	72.51% (🎯 72%)	4932 / 6801

File Coverage

No changed files found.

Generated in workflow #9946 for commit 1ecab94 by the Vitest Coverage Report Action

Daryna-del · 2026-05-20T08:17:25Z

@cursor review

Daryna-del · 2026-05-20T09:31:04Z

@cursor review

Daryna-del · 2026-05-20T09:48:42Z

@cursor review

tatomyr

Please also address the bugbot comments.

tatomyr · 2026-05-21T14:33:36Z

 } from '../../utils/miscellaneous.js';
 import type { CommandArgs } from '../../wrapper.js';
-import { COMPONENTS } from '../split/constants.js';
+// import { COMPONENTS } from '../split/constants.js';


Let's remove comments.

tatomyr · 2026-05-21T16:02:19Z

        },
      });
    }
-    if (!security && openapi.hasOwnProperty('security')) {


Why the previous solution was not working? I see it refers to the root security already.

Yeah, good point. Previous solution was working for each case, except when we have paths: {} and security on root level. Simplified the solution to cover this case, please, review one more time.

cursor

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit fc563a9. Configure here.}

tatomyr · 2026-05-25T12:45:29Z

+        200:
+          description: OK
+        400:
+          description: Bad request


Suggested change

description: Bad request

description: Bad request

Let's add a newline on file endings.

tatomyr · 2026-05-25T12:48:18Z

+info:
+  title: "spec1"
+  version: 1.0.0
+servers:


Let's add only essential fields and remove others.

tatomyr · 2026-05-25T12:50:00Z

+servers:
+  - url: https://api.example.com
+paths:
+  /post:


It's bad practice to use verbs in paths (especially mixing post and get), so I'm against using it in our examples.

tatomyr · 2026-05-25T12:51:49Z

+          description: Bad request
+      tags:
+        - bar_other
+      security:


If I'm getting it correctly, this path comes from an API description that doesn't have security defined on it; so how it got the security requirement from another description?

tatomyr · 2026-05-25T12:56:22Z

+          authorizationUrl: https://example.com/oauth/authorize
+          tokenUrl: https://example.com/oauth/token
+          scopes: {}
+    oauth1:


These names are hard to follow. Please use something more meaningful.

cursor Bot reviewed May 20, 2026

View reviewed changes

Comment thread packages/cli/src/commands/join/utils/get-effective-components-prefix.ts Outdated

Comment thread packages/cli/src/commands/join/utils/get-effective-components-prefix.ts Outdated

cursor Bot reviewed May 20, 2026

View reviewed changes

Comment thread tests/e2e/join/merged-root-security-from-other-apis/snapshot.txt

Comment thread packages/cli/src/commands/join/index.ts Outdated

cursor Bot reviewed May 20, 2026

View reviewed changes

Comment thread packages/cli/src/commands/join/utils/get-effective-components-prefix.ts Outdated

Daryna-del force-pushed the fix/resolve-root-security-in-join branch from 5bc9605 to ecc35f1 Compare May 20, 2026 11:29

Daryna-del marked this pull request as ready for review May 20, 2026 11:40

Daryna-del requested review from a team as code owners May 20, 2026 11:40

JLekawa approved these changes May 20, 2026

View reviewed changes

JLekawa reviewed May 20, 2026

View reviewed changes

Comment thread .changeset/curvy-ghosts-listen.md Outdated

cursor Bot reviewed May 20, 2026

View reviewed changes

Comment thread packages/cli/src/commands/join/utils/resolve-operation-security.ts Outdated

cursor Bot reviewed May 20, 2026

View reviewed changes

Comment thread packages/cli/src/commands/join/utils/get-effective-components-prefix.ts Outdated

Comment thread packages/cli/src/commands/join/index.ts Outdated

tatomyr reviewed May 21, 2026

View reviewed changes

cursor Bot reviewed May 25, 2026

View reviewed changes

Comment thread packages/cli/src/commands/join/index.ts Outdated

Comment thread packages/cli/src/commands/join/utils/collect-paths.ts Outdated

Comment thread packages/cli/src/commands/join/utils/resolve-operation-security.ts Outdated

cursor Bot reviewed May 25, 2026

View reviewed changes

Comment thread packages/cli/src/commands/join/utils/collect-paths.ts Outdated

Daryna-del and others added 9 commits May 25, 2026 14:50

fix: resolve root security during join

072f341

fix: address to cursor comments and added e2e tests

3302461

fix: address to cursor comments

75e2c78

chore: add changeset

dfc6f1c

Apply suggestion from @JLekawa

ffcc745

fix: address to cursor comments and improve tests

1e484a1

chore: simplify solution

394fd5a

fix: remove unnecessary files

a60c960

tests: add test with empty security

09e577e

Daryna-del force-pushed the fix/resolve-root-security-in-join branch from 11a4935 to 09e577e Compare May 25, 2026 11:51

tatomyr requested changes May 25, 2026

View reviewed changes

chore: revert changes

1ecab94

Conversation

Daryna-del commented May 20, 2026 • edited by cursor Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What/Why/How?

Reference

Testing

Screenshots (optional)

Check yourself

Security

Uh oh!

changeset-bot Bot commented May 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🦋 Changeset detected

Uh oh!

github-actions Bot commented May 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented May 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Coverage Report

Uh oh!

Daryna-del commented May 20, 2026

Uh oh!

Uh oh!

Uh oh!

Daryna-del commented May 20, 2026

Uh oh!

Uh oh!

Uh oh!

Daryna-del commented May 20, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

tatomyr left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Daryna-del commented May 20, 2026 •

edited by cursor Bot

Loading

changeset-bot Bot commented May 20, 2026 •

edited

Loading

github-actions Bot commented May 20, 2026 •

edited

Loading

github-actions Bot commented May 20, 2026 •

edited

Loading