From 1e05cbbfca2bbd424732142146786ce0f8f26e82 Mon Sep 17 00:00:00 2001
From: Jonas Hendrickx <jhendrickx@bitwarden.com>
Date: Tue, 1 Oct 2024 14:45:49 +0200
Subject: [PATCH] PAS-580 | Use OpenApiSecurityRequirement instead of headers
 for auth (#739)

---
 .../Filters/AuthorizationOperationFilter.cs   | 34 ++++++++++++++-----
 src/Api/OpenApi/OpenApiBootstrap.cs           | 19 +++++++++++
 2 files changed, 44 insertions(+), 9 deletions(-)

diff --git a/src/Api/OpenApi/Filters/AuthorizationOperationFilter.cs b/src/Api/OpenApi/Filters/AuthorizationOperationFilter.cs
index 378c0e82f..1df123e3c 100644
--- a/src/Api/OpenApi/Filters/AuthorizationOperationFilter.cs
+++ b/src/Api/OpenApi/Filters/AuthorizationOperationFilter.cs
@@ -20,6 +20,21 @@ public void Apply(OpenApiOperation operation, OperationFilterContext context)
         switch (policy.AuthenticationSchemes.SingleOrDefault())
         {
             case Constants.PublicKeyAuthenticationScheme:
+                operation.Security.Add(new OpenApiSecurityRequirement
+                {
+                    {
+                        new OpenApiSecurityScheme
+                        {
+                            Reference = new OpenApiReference
+                            {
+                                Type = ReferenceType.SecurityScheme,
+                                Id = Constants.PublicKeyAuthenticationScheme
+                            }
+                        },
+                        []
+                    }
+                });
+
                 operation.Parameters.Add(new OpenApiParameter
                 {
                     Name = Constants.PublicKeyHeaderName,
@@ -35,17 +50,18 @@ public void Apply(OpenApiOperation operation, OperationFilterContext context)
                 });
                 break;
             case Constants.SecretKeyAuthenticationScheme:
-                operation.Parameters.Add(new OpenApiParameter
+                operation.Security.Add(new OpenApiSecurityRequirement
                 {
-                    Name = Constants.SecretKeyHeaderName,
-                    In = ParameterLocation.Header,
-                    Required = true,
-                    Schema = new OpenApiSchema
                     {
-                        Description = "Your private API key",
-                        Example = new OpenApiString("yourappid:secret:00000000000000000000000000000000"),
-                        Nullable = false,
-                        Type = "string"
+                        new OpenApiSecurityScheme
+                        {
+                            Reference = new OpenApiReference
+                            {
+                                Type = ReferenceType.SecurityScheme,
+                                Id = Constants.SecretKeyAuthenticationScheme
+                            }
+                        },
+                        []
                     }
                 });
                 break;
diff --git a/src/Api/OpenApi/OpenApiBootstrap.cs b/src/Api/OpenApi/OpenApiBootstrap.cs
index e620ca258..0abc5f5f1 100644
--- a/src/Api/OpenApi/OpenApiBootstrap.cs
+++ b/src/Api/OpenApi/OpenApiBootstrap.cs
@@ -24,6 +24,25 @@ public static void AddOpenApi(this IServiceCollection services)
             swagger.OperationFilter<AuthorizationOperationFilter>();
             swagger.OperationFilter<ExtendedStatusDescriptionsOperationFilter>();
             swagger.OperationFilter<ExternalDocsOperationFilter>();
+
+            swagger.AddSecurityDefinition(Constants.PublicKeyAuthenticationScheme, new OpenApiSecurityScheme
+            {
+                Description = "Front-end integrations",
+                Type = SecuritySchemeType.ApiKey,
+                Name = Constants.PublicKeyHeaderName,
+                Scheme = Constants.PublicKeyAuthenticationScheme,
+                In = ParameterLocation.Header
+            });
+
+            swagger.AddSecurityDefinition(Constants.SecretKeyAuthenticationScheme, new OpenApiSecurityScheme
+            {
+                Description = "Back-end integrations",
+                Type = SecuritySchemeType.ApiKey,
+                Name = Constants.SecretKeyHeaderName,
+                Scheme = Constants.SecretKeyAuthenticationScheme,
+                In = ParameterLocation.Header
+            });
+
             swagger.SupportNonNullableReferenceTypes();
             swagger.SwaggerDoc("v4", new OpenApiInfo
             {