Repository: apiflask/apiflask
Pull request #304 (2022-05-21 07:53:37)

Fix OpenAPI security scheme value
The scheme value should be in lowercase.



Patch:
diff --git a/src/apiflask/openapi.py b/src/apiflask/openapi.py
index a1132fa..4029a09 100644
--- a/src/apiflask/openapi.py
+++ b/src/apiflask/openapi.py
@@ -66,7 +66,7 @@ def get_auth_name(
     if isinstance(auth, HTTPBasicAuth):
         name = 'BasicAuth'
     elif isinstance(auth, HTTPTokenAuth):
-        if auth.scheme == 'Bearer' and auth.header is None:
+        if auth.scheme.lower() == 'bearer' and auth.header is None:
             name = 'BearerAuth'
         else:
             name = 'ApiKeyAuth'
@@ -86,10 +86,10 @@ def get_security_scheme(auth: HTTPAuthType) -> t.Dict[str, t.Any]:
     """Get security scheme from auth object."""
     security_scheme: t.Dict[str, t.Any]
     if isinstance(auth, HTTPTokenAuth):
-        if auth.scheme == 'Bearer' and auth.header is None:
+        if auth.scheme.lower() == 'bearer' and auth.header is None:
             security_scheme = {
                 'type': 'http',
-                'scheme': 'Bearer',
+                'scheme': 'bearer',
             }
         else:
             security_scheme = {
@@ -100,7 +100,7 @@ def get_security_scheme(auth: HTTPAuthType) -> t.Dict[str, t.Any]:
     else:
         security_scheme = {
             'type': 'http',
-            'scheme': 'Basic',
+            'scheme': 'basic',
         }
     return security_scheme
 


Test patch:
diff --git a/tests/test_decorator_auth_required.py b/tests/test_decorator_auth_required.py
index 7ac3fe6..d5ba5ad 100644
--- a/tests/test_decorator_auth_required.py
+++ b/tests/test_decorator_auth_required.py
@@ -75,7 +75,7 @@ def test_auth_required(app, client):
     validate_spec(rv.json)
     assert 'BasicAuth' in rv.json['components']['securitySchemes']
     assert rv.json['components']['securitySchemes']['BasicAuth'] == {
-        'scheme': 'Basic',
+        'scheme': 'basic',
         'type': 'http'
     }
 
@@ -152,7 +152,7 @@ def test_auth_required_with_methodview(app, client):
     validate_spec(rv.json)
     assert 'BasicAuth' in rv.json['components']['securitySchemes']
     assert rv.json['components']['securitySchemes']['BasicAuth'] == {
-        'scheme': 'Basic',
+        'scheme': 'basic',
         'type': 'http'
     }
 
@@ -213,7 +213,7 @@ def test_auth_required_at_blueprint_before_request(app, client):
 
     assert 'BearerAuth' in rv.json['components']['securitySchemes']
     assert rv.json['components']['securitySchemes']['BearerAuth'] == {
-        'scheme': 'Bearer',
+        'scheme': 'bearer',
         'type': 'http'
     }
 
@@ -222,3 +222,20 @@ def test_auth_required_at_blueprint_before_request(app, client):
     assert 'BearerAuth' in rv.json['paths']['/baz']['get']['security'][0]
     assert 'BearerAuth' in rv.json['paths']['/baz']['post']['security'][0]
     assert 'security' not in rv.json['paths']['/eggs']['get']
+
+
+def test_lowercase_token_scheme_value(app, client):
+
+    auth = HTTPTokenAuth(scheme='bearer')
+
+    @app.route('/')
+    @app.auth_required(auth)
+    def index():
+        pass
+
+    rv = client.get('/openapi.json')
+    assert rv.status_code == 200
+    validate_spec(rv.json)
+
+    assert 'BearerAuth' in rv.json['components']['securitySchemes']
+    assert 'BearerAuth' in rv.json['paths']['/']['get']['security'][0]
diff --git a/tests/test_openapi_security.py b/tests/test_openapi_security.py
index 217928e..cc5fe24 100644
--- a/tests/test_openapi_security.py
+++ b/tests/test_openapi_security.py
@@ -19,7 +19,7 @@ def test_httpbasicauth_security_scheme(app, client):
     assert 'BasicAuth' in rv.json['components']['securitySchemes']
     assert rv.json['components']['securitySchemes']['BasicAuth'] == {
         'type': 'http',
-        'scheme': 'Basic'
+        'scheme': 'basic'
     }
 
 
@@ -36,7 +36,7 @@ def test_httptokenauth_security_scheme(app, client):
     validate_spec(rv.json)
     assert 'BearerAuth' in rv.json['components']['securitySchemes']
     assert rv.json['components']['securitySchemes']['BearerAuth'] == {
-        'scheme': 'Bearer',
+        'scheme': 'bearer',
         'type': 'http'
     }
 
@@ -122,11 +122,11 @@ def test_security_schemes_description(app, client):
     assert 'BearerAuth' in rv.json['components']['securitySchemes']
     assert rv.json['components']['securitySchemes']['BasicAuth'] == {
         'type': 'http',
-        'scheme': 'Basic',
+        'scheme': 'basic',
         'description': 'some description for basic auth'
     }
     assert rv.json['components']['securitySchemes']['BearerAuth'] == {
         'type': 'http',
-        'scheme': 'Bearer',
+        'scheme': 'bearer',
         'description': 'some description for bearer auth'
     }