feat: add support for OAuth clientCredential and password flows in Respect core#2824
feat: add support for OAuth clientCredential and password flows in Respect core#2824harshit078 wants to merge 11 commits into
Conversation
🦋 Changeset detectedLatest commit: 9de2521 The changes in this PR will be included in the next version bump. This PR includes changesets to release 3 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 5 potential issues.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 9de2521. Configure here.
| clientId ?? '', | ||
| flow === 'password' ? (values.username ?? '') : '', | ||
| scope ?? '', | ||
| ].join('|'); |
There was a problem hiding this comment.
OAuth cache ignores secret
High Severity
The OAuth2 token cache key omits clientSecret, password, and clientAuthMethod. This can cause tokens fetched with different credentials or authentication methods to be incorrectly reused throughout the run, potentially sending invalid Authorization headers.
Reviewed by Cursor Bugbot for commit 9de2521. Configure here.
| if (flows?.password) { | ||
| return ['username', 'password']; | ||
| } | ||
| return ['accessToken']; |
There was a problem hiding this comment.
Lint ignores password flow choice
Medium Severity
When an OAuth2 scheme defines both clientCredentials and password flows, getOAuth2RequiredValues incorrectly prioritizes clientCredentials. This causes false-positive lint errors by requiring clientId and clientSecret even when username and password are valid for the password flow at runtime.
Reviewed by Cursor Bugbot for commit 9de2521. Configure here.
| ): readonly string[] { | ||
| if (values && 'accessToken' in values) { | ||
| return ['accessToken']; | ||
| } |
There was a problem hiding this comment.
Empty accessToken skips lint checks
Medium Severity
The OAuth2 linter checks for the presence of an accessToken key in x-security.values but doesn't validate its truthiness. This allows empty or falsy accessToken values to pass lint, leading to runtime failures when a valid token is required for authentication or token exchange.
Reviewed by Cursor Bugbot for commit 9de2521. Configure here.
| return { flow: 'clientCredentials', config: flows.clientCredentials }; | ||
| } | ||
| if (flows.password && (values.username || values.password)) { | ||
| return { flow: 'password', config: flows.password }; |
There was a problem hiding this comment.
Password grant mis-selected with clientId
High Severity
When an OAuth2 scheme declares both clientCredentials and password, pickOAuth2ExchangeableFlow chooses client credentials whenever clientId or clientSecret appears in values, even if username and password are also present. Respect then runs the wrong grant and ignores the user credentials.
Additional Locations (1)
Reviewed by Cursor Bugbot for commit 9de2521. Configure here.
| } | ||
| }, | ||
| }; | ||
| }; |
There was a problem hiding this comment.
Unused Async3 SecurityDefined rule
Low Severity
This commit adds SecurityDefined under packages/core/src/rules/async3/security-defined.ts, but it is not imported or registered in packages/core/src/rules/async3/index.ts, so the new rule never runs and adds dead maintenance surface unrelated to OAuth2 Respect work.
Reviewed by Cursor Bugbot for commit 9de2521. Configure here.
1 participant
What/Why/How?
Reference
#2122
Testing
Screenshots (optional)
Check yourself
Security
Note
High Risk
Changes authentication behavior: Respect performs live token requests using user-supplied secrets and updates required credential rules for OAuth2, which affects security-sensitive workflow execution.
Overview
Respect now supports OAuth2
clientCredentialsandpasswordflows on Arazzox-security: when noaccessTokenis supplied, it POSTs to the scheme’stokenUrl, caches tokens onTestContext.oauth2TokenCache, and sendsAuthorization: Beareron workflow requests. Pre-suppliedaccessTokenvalues skip the token call.Linting and runtime validation no longer treat every OAuth2 scheme as requiring only
accessToken. Requiredx-security.valuesdepend on the declared flow (clientId/clientSecret,username/password, oraccessTokenfor other flows).resolveXSecurityParametersis async end-to-end (includingprepare-request).A new
exchange-oauth2-tokenhelper handles grant types, optional scope, Basic vs body client auth (clientAuthMethod), secret masking, and errors. Tests cover exchange, caching, and lint rule cases. A changeset marks minor releases for@redocly/respect-core,@redocly/openapi-core, and@redocly/cli. The diff also adds an AsyncAPI 3security-definedrule module underpackages/core/src/rules/async3/.Reviewed by Cursor Bugbot for commit 9de2521. Bugbot is set up for automated code reviews on this repo. Configure here.