Repository: juspay/hyperswitch
File: crates/openapi/src/openapi_v2.rs (Rust)

Code before:
        api_models::payments::DeviceDetails,
        common_types::payments::PaymentMethodsConfig,
        common_types::payments::PaymentMethodConfig,
        common_types::payments::CustomTerms,
        common_types::payments::CustomMessage,
        common_types::payments::SdkDisplayMode,
    )),
    modifiers(&SecurityAddon)
)]
// Bypass clippy lint for not being constructed
#[allow(dead_code)]
pub(crate) struct ApiDoc;

struct SecurityAddon;

impl utoipa::Modify for SecurityAddon {
    fn modify(&self, openapi: &mut utoipa::openapi::OpenApi) {
        use utoipa::openapi::security::{ApiKey, ApiKeyValue, SecurityScheme};

        if let Some(components) = openapi.components.as_mut() {
            components.add_security_schemes_from_iter([
                (
                    "api_key",
                    SecurityScheme::ApiKey(ApiKey::Header(ApiKeyValue::with_description(
                        "Authorization",
                        "Format: api-key=<api_key>\n\nUse the API key created under your merchant account from the HyperSwitch dashboard. API key is used to authenticate API requests from your merchant server only. Don't expose this key on a website or embed it in a mobile application."
                    ))),
                ),
                (
                    "admin_api_key",
                    SecurityScheme::ApiKey(ApiKey::Header(ApiKeyValue::with_description(
                        "Authorization",
                        "Format: admin-api-key=<admin-api-key>\n\nAdmin API keys allow you to perform some privileged actions such as \
                        creating a merchant account and Connector account. This is only used during development."
                    ))),
                ),
                (
                    "publishable_key__client_secret",
                    SecurityScheme::ApiKey(ApiKey::Header(ApiKeyValue::with_description(
                        "Authorization",
                        "Format: publishable-key=<publishable-key>,client-secret=<client-secret>\n\nPublishable keys are a type of keys that can be public and have limited \
                        scope of usage. Client Secret provide temporary access to singular data, such as access to a single customer object for a short period of time. This authentication \
                        scheme is used by the SDK."
                    ))),
                ),
                (
                    "jwt_key",
                    SecurityScheme::Http(HttpBuilder::new().scheme(HttpAuthScheme::Bearer).bearer_format("JWT").build())
                )
            ]);
        }

Review comment (security):
Nit: Can probably try enclosing the format in backticks, if it renders correctly.


```suggestion
                        "Format: `api-key=<api_key>`\n\nUse the API key created under your merchant account from the HyperSwitch dashboard. API key is used to authenticate API requests from your merchant server only. Don't expose this key on a website or embed it in a mobile application."
```

Code after:
        api_models::payments::DeviceDetails,
        common_types::payments::PaymentMethodsConfig,
        common_types::payments::PaymentMethodConfig,
        common_types::payments::CustomTerms,
        common_types::payments::CustomMessage,
        common_types::payments::SdkDisplayMode,
    )),
    modifiers(&SecurityAddon)
)]
// Bypass clippy lint for not being constructed
#[allow(dead_code)]
pub(crate) struct ApiDoc;

struct SecurityAddon;

impl utoipa::Modify for SecurityAddon {
    fn modify(&self, openapi: &mut utoipa::openapi::OpenApi) {
        use utoipa::openapi::security::{ApiKey, ApiKeyValue, SecurityScheme};

        if let Some(components) = openapi.components.as_mut() {
            components.add_security_schemes_from_iter([
                (
                    "api_key",
                    SecurityScheme::ApiKey(ApiKey::Header(ApiKeyValue::with_description(
                        "Authorization",
                        "Format: `api-key=<api_key>`\n\nUse the API key created under your merchant account from the HyperSwitch dashboard. API key is used to authenticate API requests from your merchant server only. Don't expose this key on a website or embed it in a mobile application."
                    ))),
                ),
                (
                    "admin_api_key",
                    SecurityScheme::ApiKey(ApiKey::Header(ApiKeyValue::with_description(
                        "Authorization",
                        "Format: `admin-api-key=<admin-api-key>`\n\nAdmin API keys allow you to perform some privileged actions such as \
                        creating a merchant account and Connector account. This is only used during development."
                    ))),
                ),
                (
                    "publishable_key__client_secret",
                    SecurityScheme::ApiKey(ApiKey::Header(ApiKeyValue::with_description(
                        "Authorization",
                        "Format: `publishable-key=<publishable-key>,client-secret=<client-secret>`\n\nPublishable keys are a type of keys that can be public and have limited \
                        scope of usage. Client Secret provide temporary access to singular data, such as access to a single customer object for a short period of time. This authentication \
                        scheme is used by the SDK."
                    ))),
                ),
                (
                    "jwt_key",
                    SecurityScheme::Http(HttpBuilder::new().scheme(HttpAuthScheme::Bearer).bearer_format("JWT").build())
                )
            ]);
        }