feat(core): add asyncapi-operation-security-defined lint rule by harshit078 · Pull Request #2759 · Redocly/redocly-cli

harshit078 · 2026-04-21T09:52:21Z

What/Why/How?

Added asyncapi-operation-security-defined rule for AsyncAPI 2.x which reports when a security scheme referenced from an operation or server security array is not defined in ``components.securitySchemes.

Reference

#2667

Testing

Screenshots (optional)

Check yourself

This PR follows the contributing guide
All new/updated code is covered by tests
Core code changed? - Tested with other Redocly products (internal contributions only)
New package installed? - Tested in different environments (browser/node)
Documentation update has been considered

Security

The security impact of the change has been considered
Code follows company security practices and guidelines

Note

Medium Risk
New default-severity lint behavior on AsyncAPI presets may surface many findings on specs missing operation security or with bad scheme refs; logic is security-adjacent but read-only validation with broad test coverage.

Overview
Adds the built-in security-defined lint rule for AsyncAPI 2.x and 3.0, aligned with the existing OpenAPI rule name and behavior.

AsyncAPI 2.x validates named schemes in operation/server security against components.securitySchemes, and flags operations with no security unless an applicable server (respecting channel servers) or operation traits supply it.

AsyncAPI 3.0 resolves $ref entries in security lists, requires refs under #/components/securitySchemes, and applies the same “operation must have security” checks via channel-bound servers.

Shared helper operationHasSecurity covers direct security and traits. The rule is registered in async2/async3 rule sets, wired into preset configs (minimal warn, recommended/all error), documented, and covered by unit tests; config/e2e snapshots reflect new assertion subject types.

^{Reviewed by Cursor Bugbot for commit df986cf. Bugbot is set up for automated code reviews on this repo. Configure here.}

changeset-bot · 2026-04-21T09:52:26Z

🦋 Changeset detected

Latest commit: df986cf

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 3 packages

Name	Type
@redocly/openapi-core	Minor
@redocly/cli	Minor
@redocly/respect-core	Minor

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

vadyvas

I would suggest a slightly different approach:

keep the AsyncAPI logic separate and do not reuse shared logic from the OAS rule
use the same rule name, security-defined, for AsyncAPI as well, and register the AsyncAPI implementation in the AsyncAPI ruleset
do not update the v1 docs in this PR

I think this would make the change smaller, clearer, and safer.

Thank you for the contribution, overall the PR looks good

vadyvas

left a few comments, could you take a look?

vadyvas · 2026-05-04T16:37:22Z

  'info-contact': InfoContact as Async2Rule,
  'info-license-strict': InfoLicenseStrict as Async2Rule,
  'operation-operationId': OperationOperationId as Async2Rule,
+  'security-defined': SecurityDefined,


Please add support for AsyncAPI 3 as well. Right now the rule only applies to AsyncAPI2

okay sure !

vadyvas · 2026-05-04T16:39:19Z

The code uses the rule name security-defined, but the docs still say asyncapi-operation-security-defined
Can you update related changes?

vadyvas · 2026-05-04T16:40:22Z

@@ -0,0 +1,83 @@
+# asyncapi-operation-security-defined


Please don’t add this rule to the v1 docs

AlbinaBlazhko17 · 2026-05-20T06:46:47Z

+        if (!list) return;
+        for (let i = 0; i < list.length; i++) {
+          const item = list[i];
+          if (!isRef(item)) continue;


Could you explain why are you skipping not refs? And the purpose of this statement item.$ref.split('/').pop()?

my intent behind the skipping not refs in the logic is that since every security item can be either be a $ref or an inline object. Since inline objects are complete in itself hence there's nothing to check or cross check against components.securitySchemes hence only $ref items can be tracked as references.

The purpose of tthis statement is that it basically just grabs the last pointer segment purely as a display name in the "There is no name security scheme defined." message which matches with the async2 wording.

I hope my explanation did a justice to what I was trying to say. If not, I'm happy to provide further explanation. Thanks !

Co-authored-by: Jacek Łękawa <164185257+JLekawa@users.noreply.github.com>

harshit078 · 2026-05-29T11:08:45Z

Hi @AlbinaBlazhko17 , I have addressed all comments and resolved comments left by cursor. Though I have no clue on how to resolve the failing test hence I did not fix it. Can you review the PR again ? Thanks !

cursor

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 555f60b. Configure here.}

feat: add 'asyncapi-operation-security-defined' rule

7acc84a

harshit078 and others added 6 commits April 21, 2026 15:22

Merge branch 'main' into add-asyncapi-rule

ddcf5e1

feat: added asyncapi-operation-security-define rule in tests

e1a30b6

feat: added async operation function and updated rules

1fa95ec

Merge branch 'main' into add-asyncapi-rule

14e7719

feat: updated lint md docs and added tests

d6df2bf

feat: added changset

d31dfbc

harshit078 changed the title ~~feat: Add asyncapi-operation-security-defined lint rule~~ feat(core): Add asyncapi-operation-security-defined lint rule Apr 24, 2026

Merge branch 'main' into add-asyncapi-rule

ce2789b

harshit078 marked this pull request as ready for review April 24, 2026 07:51

harshit078 requested review from a team as code owners April 24, 2026 07:51

harshit078 changed the title ~~feat(core): Add asyncapi-operation-security-defined lint rule~~ feat(core): add asyncapi-operation-security-defined lint rule Apr 24, 2026

cursor Bot reviewed Apr 24, 2026

View reviewed changes

Comment thread packages/core/src/rules/async2/asyncapi-operation-security-defined.ts

harshit078 and others added 2 commits April 24, 2026 15:36

fix: address comments by cursor

726a43e

Merge branch 'main' into add-asyncapi-rule

bb01316

vadyvas requested changes Apr 28, 2026

View reviewed changes

harshit078 and others added 5 commits April 30, 2026 13:18

Merge branch 'main' into add-asyncapi-rule

f671deb

fix: removed v1 doc update for async api

573cbef

fix: adress comments and remove shared helper

e0229df

fix: security defined package

27f2667

Merge branch 'main' into add-asyncapi-rule

0663a44

cursor Bot reviewed Apr 30, 2026

View reviewed changes

Comment thread packages/core/src/config/__tests__/__snapshots__/config-resolvers.test.ts.snap Outdated

fix: address cursor comment

dd80e01

harshit078 requested a review from vadyvas April 30, 2026 12:45

vadyvas requested changes May 4, 2026

View reviewed changes

harshit078 and others added 2 commits May 5, 2026 20:01

Merge branch 'main' into add-asyncapi-rule

cc6133e

removed: asyncapi from v1 docs

4bd8b15

cursor Bot reviewed May 6, 2026

View reviewed changes

Comment thread docs/@v1/v1.sidebars.yaml Outdated

Comment thread packages/core/src/rules/async2/index.ts

AlbinaBlazhko17 reviewed May 20, 2026

View reviewed changes

JLekawa reviewed May 20, 2026

View reviewed changes

Comment thread .changeset/stupid-dryers-add.md Outdated

harshit078 and others added 2 commits May 20, 2026 15:59

Update .changeset/stupid-dryers-add.md

bd40779

Co-authored-by: Jacek Łękawa <164185257+JLekawa@users.noreply.github.com>

Merge branch 'main' into add-asyncapi-rule

0784245

JLekawa reviewed May 20, 2026

View reviewed changes

Comment thread docs/@v2/rules/async/security-defined.md Outdated

Comment thread docs/@v2/rules/async/security-defined.md Outdated

harshit078 and others added 2 commits May 20, 2026 19:13

Update docs/@v2/rules/async/security-defined.md

599c548

Co-authored-by: Jacek Łękawa <164185257+JLekawa@users.noreply.github.com>

Update docs/@v2/rules/async/security-defined.md

a6b8177

Co-authored-by: Jacek Łękawa <164185257+JLekawa@users.noreply.github.com>

JLekawa reviewed May 20, 2026

View reviewed changes

Comment thread docs/@v2/rules/async/security-defined.md Outdated

Apply suggestion from @JLekawa

59e91b6

JLekawa approved these changes May 20, 2026

View reviewed changes

Merge branch 'main' into add-asyncapi-rule

fc291c0

harshit078 requested a review from AlbinaBlazhko17 May 26, 2026 09:22

cursor Bot reviewed May 26, 2026

View reviewed changes

Comment thread packages/core/src/rules/async3/security-defined.ts

Comment thread packages/core/src/rules/async2/security-defined.ts

fix: address cursor comment

82ff698

cursor Bot reviewed May 26, 2026

View reviewed changes

Comment thread packages/core/src/rules/async2/security-defined.ts

harshit078 added 2 commits May 26, 2026 17:53

feat: added tests for async3

a9c29bf

fix: added shared security logic and checks for operations

c9a0f47

cursor Bot reviewed May 26, 2026

View reviewed changes

Comment thread packages/core/src/rules/async3/security-defined.ts

Comment thread packages/core/src/rules/async2/security-defined.ts Outdated

harshit078 and others added 2 commits May 29, 2026 15:26

fix: address left by cursor and added tests

64bc514

Merge branch 'main' into add-asyncapi-rule

bbca4dd

cursor Bot reviewed May 29, 2026

View reviewed changes

Comment thread packages/core/src/rules/async3/security-defined.ts

fix: address comment by cursor

3d3a7fc

harshit078 and others added 2 commits June 1, 2026 13:58

fix: failing build test

1652463

Merge branch 'main' into add-asyncapi-rule

1acedaf

cursor Bot reviewed Jun 1, 2026

View reviewed changes

Comment thread packages/core/src/rules/async3/security-defined.ts

Comment thread packages/core/src/rules/async2/security-defined.ts

harshit078 added 2 commits June 1, 2026 16:53

fix: cursor comment

76f023e

fix: failing lint test

555f60b

cursor Bot reviewed Jun 2, 2026

View reviewed changes

Comment thread packages/core/src/rules/async3/security-defined.ts

fix: failing lint test

df986cf

Conversation

harshit078 commented Apr 21, 2026 • edited by cursor Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What/Why/How?

Reference

Testing

Screenshots (optional)

Check yourself

Security

Uh oh!

changeset-bot Bot commented Apr 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🦋 Changeset detected

Uh oh!

Uh oh!

vadyvas left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

vadyvas left a comment

Choose a reason for hiding this comment

Uh oh!

vadyvas May 4, 2026

Choose a reason for hiding this comment

Uh oh!

harshit078 May 5, 2026

Choose a reason for hiding this comment

Uh oh!

vadyvas May 4, 2026

Choose a reason for hiding this comment

Uh oh!

vadyvas May 4, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

AlbinaBlazhko17 May 20, 2026

Choose a reason for hiding this comment

Uh oh!

harshit078 May 20, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

harshit078 commented May 29, 2026

Uh oh!

Uh oh!

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

harshit078 commented Apr 21, 2026 •

edited by cursor Bot

Loading

changeset-bot Bot commented Apr 21, 2026 •

edited

Loading