chore: add e2e tests for security propagation during join by Daryna-del · Pull Request #2827 · Redocly/redocly-cli

Daryna-del · 2026-05-20T05:59:31Z

What/Why/How?

Added e2e tests for security propagation during join

Reference

#1409

Testing

Screenshots (optional)

Check yourself

This PR follows the contributing guide
All new/updated code is covered by tests
Core code changed? - Tested with other Redocly products (internal contributions only)
New package installed? - Tested in different environments (browser/node)
Documentation update has been considered

Security

The security impact of the change has been considered
Code follows company security practices and guidelines

Note

Medium Risk
Join output affects how merged OpenAPI describes authentication; wrong propagation could misstate required security, though this PR is primarily tests and a changeset note.

Overview
Documents a patch for @redocly/cli where join copies each source API’s root security onto operations that omit their own security, instead of dropping that inheritance when merging specs.

Adds two e2e scenarios under tests/e2e/join/: root-security-in-both-specs (Foo oauth2 and Bar bearerAuth at the root; joined output expects per-operation security on getProducts and getPets) and root-security-without-paths (one input has root security but empty paths; snapshot locks join behavior for the other file’s operations). Both are wired into the existing snapshot-based join test matrix.

^{Reviewed by Cursor Bugbot for commit 4b8bca5. Bugbot is set up for automated code reviews on this repo. Configure here.}

changeset-bot · 2026-05-20T05:59:34Z

🦋 Changeset detected

Latest commit: 4b8bca5

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 3 packages

Name	Type
@redocly/cli	Patch
@redocly/openapi-core	Patch
@redocly/respect-core	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

github-actions · 2026-05-20T06:01:27Z

CLI Version	Mean Time ± Std Dev (s)	Relative Performance (Lower is Faster)
cli-latest	1.903s ± 0.028s	▓ 1.00x (Fastest)
cli-next	1.918s ± 0.039s	▓ 1.01x

github-actions · 2026-05-20T06:01:42Z

Coverage Report

Status	Category	Percentage	Covered / Total
🔵	Lines	81.05% (🎯 80%)	7301 / 9007
🔵	Statements	80.4% (🎯 80%)	7585 / 9433
🔵	Functions	84.08% (🎯 83%)	1463 / 1740
🔵	Branches	72.55% (🎯 72%)	4939 / 6807

File Coverage

No changed files found.

Generated in workflow #9997 for commit 4b8bca5 by the Vitest Coverage Report Action

Daryna-del · 2026-05-20T08:17:25Z

@cursor review

Daryna-del · 2026-05-20T09:31:04Z

@cursor review

Daryna-del · 2026-05-20T09:48:42Z

@cursor review

tatomyr

Please also address the bugbot comments.

tatomyr · 2026-05-21T14:33:36Z

 } from '../../utils/miscellaneous.js';
 import type { CommandArgs } from '../../wrapper.js';
-import { COMPONENTS } from '../split/constants.js';
+// import { COMPONENTS } from '../split/constants.js';


Let's remove comments.

tatomyr · 2026-05-21T16:02:19Z

        },
      });
    }
-    if (!security && openapi.hasOwnProperty('security')) {


Why the previous solution was not working? I see it refers to the root security already.

Yeah, good point. Previous solution was working for each case, except when we have paths: {} and security on root level. Simplified the solution to cover this case, please, review one more time.

tatomyr · 2026-05-25T12:45:29Z

+        200:
+          description: OK
+        400:
+          description: Bad request


Suggested change

description: Bad request

description: Bad request

Let's add a newline on file endings.

Added to each file

tatomyr · 2026-05-25T12:48:18Z

+info:
+  title: "spec1"
+  version: 1.0.0
+servers:


Let's add only essential fields and remove others.

tatomyr · 2026-05-25T12:50:00Z

+servers:
+  - url: https://api.example.com
+paths:
+  /post:


It's bad practice to use verbs in paths (especially mixing post and get), so I'm against using it in our examples.

tatomyr · 2026-05-25T12:51:49Z

+          description: Bad request
+      tags:
+        - bar_other
+      security:


If I'm getting it correctly, this path comes from an API description that doesn't have security defined on it; so how it got the security requirement from another description?

Yes, you are right, updated tests

tatomyr · 2026-05-25T12:56:22Z

+          authorizationUrl: https://example.com/oauth/authorize
+          tokenUrl: https://example.com/oauth/token
+          scopes: {}
+    oauth1:


These names are hard to follow. Please use something more meaningful.

cursor

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit ab620eb. Configure here.}

cursor Bot reviewed May 20, 2026

View reviewed changes

Comment thread packages/cli/src/commands/join/utils/get-effective-components-prefix.ts Outdated

Comment thread packages/cli/src/commands/join/utils/get-effective-components-prefix.ts Outdated

cursor Bot reviewed May 20, 2026

View reviewed changes

Comment thread tests/e2e/join/merged-root-security-from-other-apis/snapshot.txt Outdated

Comment thread packages/cli/src/commands/join/index.ts Outdated

cursor Bot reviewed May 20, 2026

View reviewed changes

Comment thread packages/cli/src/commands/join/utils/get-effective-components-prefix.ts Outdated

Daryna-del force-pushed the fix/resolve-root-security-in-join branch from 5bc9605 to ecc35f1 Compare May 20, 2026 11:29

Daryna-del marked this pull request as ready for review May 20, 2026 11:40

Daryna-del requested review from a team as code owners May 20, 2026 11:40

JLekawa approved these changes May 20, 2026

View reviewed changes

JLekawa reviewed May 20, 2026

View reviewed changes

Comment thread .changeset/curvy-ghosts-listen.md Outdated

cursor Bot reviewed May 20, 2026

View reviewed changes

Comment thread packages/cli/src/commands/join/utils/resolve-operation-security.ts Outdated

cursor Bot reviewed May 20, 2026

View reviewed changes

Comment thread packages/cli/src/commands/join/utils/get-effective-components-prefix.ts Outdated

Comment thread packages/cli/src/commands/join/index.ts Outdated

tatomyr reviewed May 21, 2026

View reviewed changes

cursor Bot reviewed May 25, 2026

View reviewed changes

Comment thread packages/cli/src/commands/join/index.ts Outdated

Comment thread packages/cli/src/commands/join/utils/collect-paths.ts Outdated

Comment thread packages/cli/src/commands/join/utils/resolve-operation-security.ts Outdated

cursor Bot reviewed May 25, 2026

View reviewed changes

Comment thread packages/cli/src/commands/join/utils/collect-paths.ts Outdated

Daryna-del force-pushed the fix/resolve-root-security-in-join branch from 11a4935 to 09e577e Compare May 25, 2026 11:51

tatomyr requested changes May 25, 2026

View reviewed changes

Daryna-del force-pushed the fix/resolve-root-security-in-join branch from b887c33 to 1ecab94 Compare May 27, 2026 08:20

Daryna-del changed the title ~~fix: resolve root security during join~~ tests: add e2e tests for security propagation during join May 27, 2026

Daryna-del changed the title ~~tests: add e2e tests for security propagation during join~~ chore: add e2e tests for security propagation during join May 27, 2026

cursor Bot reviewed May 27, 2026

View reviewed changes

Comment thread tests/e2e/join/root-security-without-paths/snapshot.txt Outdated

cursor Bot reviewed May 27, 2026

View reviewed changes

Comment thread tests/e2e/join/root-security-in-both-specs/snapshot.txt Outdated

cursor Bot reviewed May 27, 2026

View reviewed changes

Comment thread tests/e2e/join/root-security-in-both-specs/joined.yaml Outdated

Daryna-del force-pushed the fix/resolve-root-security-in-join branch from bb740f3 to 046d4d0 Compare May 27, 2026 09:15

fix: resolve root security during join

b293174

Daryna-del and others added 15 commits May 29, 2026 10:22

fix: address to cursor comments and added e2e tests

a1c2a49

fix: address to cursor comments

e7dcbc5

chore: add changeset

3afe95d

Apply suggestion from @JLekawa

7f9b878

fix: address to cursor comments and improve tests

821fa24

chore: simplify solution

9fd3395

fix: remove unnecessary files

534b205

tests: add test with empty security

270e783

chore: revert changes

98794e0

tests: adjust security test in join

6d6155e

fix: snapshots

5b7c7a0

fix: snapshots

a440d0d

fix: snapshot

23a73d1

fix: remove unnecessary files

119e223

fix: remove unnecessary fields from examples

4b8bca5

Daryna-del force-pushed the fix/resolve-root-security-in-join branch from c4ad9b7 to 4b8bca5 Compare May 29, 2026 07:22

Daryna-del requested a review from tatomyr May 29, 2026 07:23

Conversation

Daryna-del commented May 20, 2026 • edited by cursor Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What/Why/How?

Reference

Testing

Screenshots (optional)

Check yourself

Security

Uh oh!

changeset-bot Bot commented May 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🦋 Changeset detected

Uh oh!

github-actions Bot commented May 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented May 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Coverage Report

Uh oh!

Daryna-del commented May 20, 2026

Uh oh!

Uh oh!

Uh oh!

Daryna-del commented May 20, 2026

Uh oh!

Uh oh!

Uh oh!

Daryna-del commented May 20, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

tatomyr left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Daryna-del commented May 20, 2026 •

edited by cursor Bot

Loading

changeset-bot Bot commented May 20, 2026 •

edited

Loading

github-actions Bot commented May 20, 2026 •

edited

Loading

github-actions Bot commented May 20, 2026 •

edited

Loading