[TT-5588] [OAS] gateway apiKey import generates unnecessary object #7270
Conversation
|
I'm a bot and I 👍 this PR title. 🤖 |
PR Reviewer Guide 🔍Here are some key observations to aid the review process:
|
PR Code Suggestions ✨Explore these optional code suggestions:
|
|
API Changes --- prev.txt 2025-08-11 08:25:56.484167431 +0000
+++ current.txt 2025-08-11 08:25:47.216030778 +0000
@@ -4555,7 +4555,7 @@
Enabled bool `bson:"enabled" json:"enabled"` // required
// AuthSources contains the configuration for authentication sources.
- AuthSources `bson:",inline" json:",inline"`
+ AuthSources `bson:",inline" json:"-"`
// EnableClientCertificate allows to create dynamic keys based on certificates.
// |
📦 Impact Review Snapshot
## Impact AssessmentThis PR makes a targeted change to prevent the The change is isolated to the serialization behavior of the ## Required UpdatesNo updates are required in downstream repositories:
## Compatibility ConcernsThis change is backward compatible:
No consumers should be relying on these fields being present in the serialized output, as they were being unnecessarily included. ## Summary & Recommendations
No suggestions to provide – change LGTM. Tip: Mention me again using |
🚀 Performance Snapshot
## Performance Impact AnalysisThe PR changes the JSON serialization behavior of the ## Critical AreasThe change affects the API loading and serialization path, which is not in the critical request path. This modification only impacts:
Since this change only affects control plane operations (API definition management) and not data plane operations (request processing), the performance impact on gateway throughput is negligible. ## Optimization RecommendationsThe change is already an optimization that reduces the size of serialized API definitions by omitting unnecessary fields. This should result in:
No further optimizations are needed for this specific change. ## Summary
No suggestions to provide – change LGTM. Tip: Mention me again using |
🚦 Connectivity Review Snapshot
## Connectivity Assessment
## Test Coverage Validation
## Security & Performance Impact
## Summary & Recommendations
Tip: Mention me again using |
🛡️ Security Snapshot
## Security Impact AnalysisThe PR modifies the JSON serialization tag for the ## Identified VulnerabilitiesNo vulnerabilities were identified in this change. The modification is a security improvement that:
## Security RecommendationsThe implementation is appropriate and includes proper test coverage. No additional security measures are needed for this change. Consider applying similar pattern to other authentication-related structs that might have the same issue (JWT, Basic, OAuth, ExternalOAuth) if they also unnecessarily expose authentication configuration details. ## OWASP ComplianceThis change aligns with OWASP best practices:
## Summary
Tip: Mention me again using |
…es-unnecessary-object
PR Analysis: Preventing Unnecessary Object Generation in OAS API ImportThis PR addresses a bug where unnecessary objects were being generated during the creation of a Tyk OAS API by importing an OpenAPI description with security schemes defined. Issue and SolutionThe issue occurs because the The PR fixes this by:
Technical DetailsThe
The change only affects the JSON serialization of the ImpactThis is a low-impact change that:
The added test properly verifies that after serialization and deserialization, the Tip: Mention me again using |
🛡️ Security Snapshot
## Security Impact AnalysisThe PR modifies the JSON serialization tag for the ## Identified VulnerabilitiesNo vulnerabilities were identified in this change. The modification is a security improvement that:
## Security RecommendationsThe implementation is appropriate and includes proper test coverage. No additional security measures are needed for this change. Consider applying similar pattern to other authentication-related structs that might have the same issue (JWT, Basic, OAuth, ExternalOAuth) if they also unnecessarily expose authentication configuration details. ## OWASP ComplianceThis change aligns with OWASP best practices:
## Summary
Tip: Mention me again using |
Performance Impact Analysis of PR #7270This PR addresses an issue where unnecessary objects were being generated during OAS API import with security schemes defined. The fix is simple but effective - changing the JSON serialization tag for the Key Changes
Impact AssessmentThis change is low-impact and focused on improving the cleanliness of the API definition:
The PR correctly addresses the issue of unnecessary object generation during OAS API import with security schemes defined, making the API definition cleaner and more accurate without introducing any regressions. Tip: Mention me again using |
Analysis of PR #7270: [OAS] Gateway apiKey Import Generates Unnecessary ObjectOverviewThis PR addresses a bug where unnecessary objects are generated during the creation of a Tyk OAS API when importing an OpenAPI description with security schemes defined. The fix is minimal but effective, changing a single JSON struct tag to prevent serialization of embedded fields. The IssueThe // Before the change
type Token struct {
// ...
AuthSources `bson:",inline" json:",inline"`
// ...
}When an OpenAPI description with a security scheme is imported, this results in unnecessary objects being generated in the API definition, making it more verbose than necessary. The SolutionThe PR changes the JSON tag from // After the change
type Token struct {
// ...
AuthSources `bson:",inline" json:"-"`
// ...
}This prevents the unnecessary generation of Header, Query, and Cookie objects in the serialized output, making the API definition cleaner and more accurate. The MongoDB serialization is maintained with Test CoverageA test has been added to verify this behavior: // Make sure AuthSources are not serialized into json.
token.Query = &AuthSource{Enabled: true}
token.Header = &AuthSource{Enabled: true}
token.Cookie = &AuthSource{Enabled: true}
bytes, err := json.Marshal(token)
assert.NoError(t, err)
var unmarshalledToken Token
err = json.Unmarshal(bytes, &unmarshalledToken)
assert.NoError(t, err)
assert.Nil(t, unmarshalledToken.Query)
assert.Nil(t, unmarshalledToken.Header)
assert.Nil(t, unmarshalledToken.Cookie)This test confirms that after serialization and deserialization, the AuthSources fields are properly excluded. Technical Analysis
ConclusionThis PR provides a clean, focused fix for the issue of unnecessary objects being generated during OAS API import. The change is minimal, well-tested, and improves the cleanliness of the API definition JSON output without introducing any compatibility risks. Tip: Mention me again using |
…es-unnecessary-object
🛡️ Security Snapshot
## Security Impact AnalysisThe PR modifies the JSON serialization tag for the ## Identified VulnerabilitiesNo vulnerabilities were identified in this change. The modification is a security improvement that:
## Security RecommendationsThe implementation is appropriate and includes proper test coverage. No additional security measures are needed for this change. Consider applying similar pattern to other authentication-related structs that might have the same issue (JWT, Basic, OAuth, ExternalOAuth) if they also unnecessarily expose authentication configuration details. ## OWASP ComplianceThis change aligns with OWASP best practices:
## Summary
Tip: Mention me again using |
🚀 Performance Snapshot
## Performance Impact AnalysisThe PR changes the JSON serialization behavior of the The change affects how API definitions are serialized during API creation and updates, particularly when importing OpenAPI descriptions with security schemes defined. This modification prevents unnecessary objects (Header, Query, Cookie) from being generated in the resulting Tyk OAS API, making the API definition cleaner and more accurate. From a performance perspective, this change will slightly reduce:
The change is isolated to the serialization behavior and doesn't affect the runtime functionality of the API or request processing paths. ## Critical AreasThe change affects the API loading and serialization path, which is not in the critical request path. This modification only impacts:
Since this change only affects control plane operations (API definition management) and not data plane operations (request processing), the performance impact on gateway throughput is negligible. The ## Optimization RecommendationsThe change is already an optimization that reduces the size of serialized API definitions by omitting unnecessary fields. This should result in:
No further optimizations are needed for this specific change. The test added ensures that the serialization behavior works as expected, verifying that the If similar issues exist in other authentication-related structs (JWT, Basic, OAuth, ExternalOAuth) that also embed ## Summary
No suggestions to provide – change LGTM. Tip: Mention me again using |
Analysis of PR #7270: Preventing Unnecessary Object Generation in OAS API ImportIssue OverviewThis PR addresses a bug where unnecessary objects were being generated during the creation of a Tyk OAS API when importing an OpenAPI description with security schemes defined. Specifically, the Root CauseThe issue is in the // Token contains the configuration for token authentication.
type Token struct {
// ...
// AuthSources contains the configuration for authentication sources.
AuthSources `bson:",inline" json:",inline"`
// ...
}This tag causes all fields from SolutionThe PR changes the JSON tag from // AuthSources contains the configuration for authentication sources.
AuthSources `bson:",inline" json:"-"`This change prevents the Test CoverageA test was added to the existing // Make sure AuthSources are not serialized into json.
token.Query = &AuthSource{Enabled: true}
token.Header = &AuthSource{Enabled: true}
token.Cookie = &AuthSource{Enabled: true}
bytes, err := json.Marshal(token)
assert.NoError(t, err)
var unmarshalledToken Token
err = json.Unmarshal(bytes, &unmarshalledToken)
assert.NoError(t, err)
assert.Nil(t, unmarshalledToken.Query)
assert.Nil(t, unmarshalledToken.Header)
assert.Nil(t, unmarshalledToken.Cookie)This test confirms that after serialization and deserialization, the Impact Analysis
ConclusionThis PR provides a clean, focused fix for the issue of unnecessary objects being generated during OAS API import. The change is minimal, well-tested, and improves the cleanliness of the API definition JSON output without introducing any compatibility risks. The PR maintains the functionality of the Tip: Mention me again using |
|
📦 Impact Review Snapshot
## Impact AssessmentThis PR makes a targeted change to prevent the The change is isolated to the serialization behavior of the ## Required UpdatesNo updates are required in downstream repositories:
## Compatibility ConcernsThis change is backward compatible:
No consumers should be relying on these fields being present in the serialized output, as they were being unnecessarily included. ## Summary & Recommendations
No suggestions to provide – change LGTM. Tip: Mention me again using |
MaciekMis
deleted the
TT-5588-oas-gateway-api-key-import-generates-unnecessary-object
branch
|
/release to release-5.8 |
|
Working on it! Note that it can take a few minutes. |
|
/release to release-5.10 |
…7270) ### **User description** <details open> <summary><a href="https://tyktech.atlassian.net/browse/TT-5588" title="TT-5588" target="_blank">TT-5588</a></summary> <br /> <table> <tr> <th>Summary</th> <td>[OAS] gateway apiKey import generates unnecessary object</td> </tr> <tr> <th>Type</th> <td> <img alt="Bug" src="https://tyktech.atlassian.net/rest/api/2/universal_avatar/view/type/issuetype/avatar/10303?size=medium" /> Bug </td> </tr> <tr> <th>Status</th> <td>In Dev</td> </tr> <tr> <th>Points</th> <td>N/A</td> </tr> <tr> <th>Labels</th> <td><a href="https://tyktech.atlassian.net/issues?jql=project%20%3D%20TT%20AND%20labels%20%3D%20codilime_refined%20ORDER%20BY%20created%20DESC" title="codilime_refined">codilime_refined</a></td> </tr> </table> </details> <!-- do not remove this marker as it will break jira-lint's functionality. added_by_jira_lint --> --- <!-- Provide a general summary of your changes in the Title above --> ## Description The header object is unnecessarily generated during creation of a Tyk OAS API by importing an OpenAPI description with security scheme defined. ## Related Issue <!-- This project only accepts pull requests related to open issues. --> <!-- If suggesting a new feature or change, please discuss it in an issue first. --> <!-- If fixing a bug, there should be an issue describing it with steps to reproduce. --> <!-- OSS: Please link to the issue here. Tyk: please create/link the JIRA ticket. --> ## Motivation and Context <!-- Why is this change required? What problem does it solve? --> ## How This Has Been Tested <!-- Please describe in detail how you tested your changes --> <!-- Include details of your testing environment, and the tests --> <!-- you ran to see how your change affects other areas of the code, etc. --> <!-- This information is helpful for reviewers and QA. --> ## Screenshots (if appropriate) ## Types of changes <!-- What types of changes does your code introduce? Put an `x` in all the boxes that apply: --> - [x] Bug fix (non-breaking change which fixes an issue) - [ ] New feature (non-breaking change which adds functionality) - [ ] Breaking change (fix or feature that would cause existing functionality to change) - [ ] Refactoring or add test (improvements in base code or adds test coverage to functionality) ## Checklist <!-- Go over all the following points, and put an `x` in all the boxes that apply --> <!-- If there are no documentation updates required, mark the item as checked. --> <!-- Raise up any additional concerns not covered by the checklist. --> - [ ] I ensured that the documentation is up to date - [ ] I explained why this PR updates go.mod in detail with reasoning why it's required - [ ] I would like a code coverage CI quality gate exception and have explained why ___ ### **PR Type** Bug fix, Tests ___ ### **Description** - Prevent `AuthSources` from being serialized in `Token` struct - Update JSON serialization tags to exclude `AuthSources` - Add test to verify `AuthSources` are not serialized - Ensure unmarshalled `Token` omits `AuthSources` fields ___ ### Diagram Walkthrough ```mermaid flowchart LR TokenStruct["Token struct"] Serialization["JSON Serialization"] TestCase["Test: AuthSources not serialized"] TokenStruct -- "exclude AuthSources from JSON" --> Serialization Serialization -- "verify exclusion" --> TestCase ``` <details> <summary><h3> File Walkthrough</h3></summary> <table><thead><tr><th></th><th align="left">Relevant files</th></tr></thead><tbody><tr><td><strong>Bug fix</strong></td><td><table> <tr> <td> <details> <summary><strong>security.go</strong><dd><code>Exclude AuthSources from Token JSON serialization</code> </dd></summary> <hr> apidef/oas/security.go <ul><li>Changed JSON struct tag for <code>AuthSources</code> to exclude from serialization<br> <li> Prevents <code>AuthSources</code> from appearing in serialized JSON output</ul> </details> </td> <td><a href="https://github.com/TykTechnologies/tyk/pull/7270/files#diff-15e7d47137452ca4f3f6139aa8c007cdb426152c41846f712f8bf5dfb607afcc">+1/-1</a> </td> </tr> </table></td></tr><tr><td><strong>Tests</strong></td><td><table> <tr> <td> <details> <summary><strong>security_test.go</strong><dd><code>Add test for non-serialization of AuthSources in Token</code> </dd></summary> <hr> apidef/oas/security_test.go <ul><li>Added test to ensure <code>AuthSources</code> fields are not serialized<br> <li> Verifies that <code>Query</code>, <code>Header</code>, and <code>Cookie</code> are nil after serialization <br>round-trip</ul> </details> </td> <td><a href="https://github.com/TykTechnologies/tyk/pull/7270/files#diff-5184167309db0462243e424baca87b5bb668962d8cc1076629fdcf11f00487e5">+15/-0</a> </td> </tr> </table></td></tr></tr></tbody></table> </details> ___ (cherry picked from commit 8b4fa8e)
|
@MaciekMis Created merge PRs |
|
@MaciekMis Release branch not found |
…es unnecessary object (#7270) [TT-5588] [OAS] gateway apiKey import generates unnecessary object (#7270) ### **User description** <details open> <summary><a href="https://tyktech.atlassian.net/browse/TT-5588" title="TT-5588" target="_blank">TT-5588</a></summary> <br /> <table> <tr> <th>Summary</th> <td>[OAS] gateway apiKey import generates unnecessary object</td> </tr> <tr> <th>Type</th> <td> <img alt="Bug" src="https://tyktech.atlassian.net/rest/api/2/universal_avatar/view/type/issuetype/avatar/10303?size=medium" /> Bug </td> </tr> <tr> <th>Status</th> <td>In Dev</td> </tr> <tr> <th>Points</th> <td>N/A</td> </tr> <tr> <th>Labels</th> <td><a href="https://tyktech.atlassian.net/issues?jql=project%20%3D%20TT%20AND%20labels%20%3D%20codilime_refined%20ORDER%20BY%20created%20DESC" title="codilime_refined">codilime_refined</a></td> </tr> </table> </details> <!-- do not remove this marker as it will break jira-lint's functionality. added_by_jira_lint --> --- <!-- Provide a general summary of your changes in the Title above --> ## Description The header object is unnecessarily generated during creation of a Tyk OAS API by importing an OpenAPI description with security scheme defined. ## Related Issue <!-- This project only accepts pull requests related to open issues. --> <!-- If suggesting a new feature or change, please discuss it in an issue first. --> <!-- If fixing a bug, there should be an issue describing it with steps to reproduce. --> <!-- OSS: Please link to the issue here. Tyk: please create/link the JIRA ticket. --> ## Motivation and Context <!-- Why is this change required? What problem does it solve? --> ## How This Has Been Tested <!-- Please describe in detail how you tested your changes --> <!-- Include details of your testing environment, and the tests --> <!-- you ran to see how your change affects other areas of the code, etc. --> <!-- This information is helpful for reviewers and QA. --> ## Screenshots (if appropriate) ## Types of changes <!-- What types of changes does your code introduce? Put an `x` in all the boxes that apply: --> - [x] Bug fix (non-breaking change which fixes an issue) - [ ] New feature (non-breaking change which adds functionality) - [ ] Breaking change (fix or feature that would cause existing functionality to change) - [ ] Refactoring or add test (improvements in base code or adds test coverage to functionality) ## Checklist <!-- Go over all the following points, and put an `x` in all the boxes that apply --> <!-- If there are no documentation updates required, mark the item as checked. --> <!-- Raise up any additional concerns not covered by the checklist. --> - [ ] I ensured that the documentation is up to date - [ ] I explained why this PR updates go.mod in detail with reasoning why it's required - [ ] I would like a code coverage CI quality gate exception and have explained why ___ ### **PR Type** Bug fix, Tests ___ ### **Description** - Prevent `AuthSources` from being serialized in `Token` struct - Update JSON serialization tags to exclude `AuthSources` - Add test to verify `AuthSources` are not serialized - Ensure unmarshalled `Token` omits `AuthSources` fields ___ ### Diagram Walkthrough ```mermaid flowchart LR TokenStruct["Token struct"] Serialization["JSON Serialization"] TestCase["Test: AuthSources not serialized"] TokenStruct -- "exclude AuthSources from JSON" --> Serialization Serialization -- "verify exclusion" --> TestCase ``` <details> <summary><h3> File Walkthrough</h3></summary> <table><thead><tr><th></th><th align="left">Relevant files</th></tr></thead><tbody><tr><td><strong>Bug fix</strong></td><td><table> <tr> <td> <details> <summary><strong>security.go</strong><dd><code>Exclude AuthSources from Token JSON serialization</code> </dd></summary> <hr> apidef/oas/security.go <ul><li>Changed JSON struct tag for <code>AuthSources</code> to exclude from serialization<br> <li> Prevents <code>AuthSources</code> from appearing in serialized JSON output</ul> </details> </td> <td><a href="https://github.com/TykTechnologies/tyk/pull/7270/files#diff-15e7d47137452ca4f3f6139aa8c007cdb426152c41846f712f8bf5dfb607afcc">+1/-1</a> </td> </tr> </table></td></tr><tr><td><strong>Tests</strong></td><td><table> <tr> <td> <details> <summary><strong>security_test.go</strong><dd><code>Add test for non-serialization of AuthSources in Token</code> </dd></summary> <hr> apidef/oas/security_test.go <ul><li>Added test to ensure <code>AuthSources</code> fields are not serialized<br> <li> Verifies that <code>Query</code>, <code>Header</code>, and <code>Cookie</code> are nil after serialization <br>round-trip</ul> </details> </td> <td><a href="https://github.com/TykTechnologies/tyk/pull/7270/files#diff-5184167309db0462243e424baca87b5bb668962d8cc1076629fdcf11f00487e5">+15/-0</a> </td> </tr> </table></td></tr></tr></tbody></table> </details> ___
… generates unnecessary object (#7270)" (#7298) ### **User description** <details open> <summary><a href="https://tyktech.atlassian.net/browse/TT-5588" title="TT-5588" target="_blank">TT-5588</a></summary> <br /> <table> <tr> <th>Summary</th> <td>[OAS] gateway apiKey import generates unnecessary object</td> </tr> <tr> <th>Type</th> <td> <img alt="Bug" src="https://tyktech.atlassian.net/rest/api/2/universal_avatar/view/type/issuetype/avatar/10303?size=medium" /> Bug </td> </tr> <tr> <th>Status</th> <td>In Dev</td> </tr> <tr> <th>Points</th> <td>N/A</td> </tr> <tr> <th>Labels</th> <td><a href="https://tyktech.atlassian.net/issues?jql=project%20%3D%20TT%20AND%20labels%20%3D%20codilime_refined%20ORDER%20BY%20created%20DESC" title="codilime_refined">codilime_refined</a></td> </tr> </table> </details> <!-- do not remove this marker as it will break jira-lint's functionality. added_by_jira_lint --> --- Reverts #7291 ___ ### **PR Type** Bug fix, Tests ___ ### **Description** Revert exclusion of `AuthSources` from JSON. Restore JSON inline serialization for `Token.AuthSources`. Remove test asserting non-serialization of `AuthSources`. Keep token fill logic and assertions intact. ___ ### Diagram Walkthrough ```mermaid flowchart LR Token["Token struct"] JSONTag["JSON tag for AuthSources"] Tests["Security tests"] Token -- "AuthSources json:',inline'" --> JSONTag Tests -- "remove non-serialization round-trip" --> JSONTag ``` <details> <summary><h3> File Walkthrough</h3></summary> <table><thead><tr><th></th><th align="left">Relevant files</th></tr></thead><tbody><tr><td><strong>Bug fix</strong></td><td><table> <tr> <td> <details> <summary><strong>security.go</strong><dd><code>Restore inline JSON serialization for AuthSources</code> </dd></summary> <hr> apidef/oas/security.go <ul><li>Change <code>Token.AuthSources</code> tag to <code>json:",inline"</code>.<br> <li> Re-enable JSON serialization of embedded <code>AuthSources</code>.</ul> </details> </td> <td><a href="https://github.com/TykTechnologies/tyk/pull/7298/files#diff-15e7d47137452ca4f3f6139aa8c007cdb426152c41846f712f8bf5dfb607afcc">+1/-1</a> </td> </tr> </table></td></tr><tr><td><strong>Tests</strong></td><td><table> <tr> <td> <details> <summary><strong>security_test.go</strong><dd><code>Remove test asserting AuthSources non-serialization</code> </dd></summary> <hr> apidef/oas/security_test.go <ul><li>Remove JSON round-trip test for <code>AuthSources</code>.<br> <li> Drop <code>encoding/json</code> import no longer used.</ul> </details> </td> <td><a href="https://github.com/TykTechnologies/tyk/pull/7298/files#diff-5184167309db0462243e424baca87b5bb668962d8cc1076629fdcf11f00487e5">+0/-15</a> </td> </tr> </table></td></tr></tr></tbody></table> </details> ___
…bject" (#7299) ### **User description** <details open> <summary><a href="https://tyktech.atlassian.net/browse/TT-5588" title="TT-5588" target="_blank">TT-5588</a></summary> <br /> <table> <tr> <th>Summary</th> <td>[OAS] gateway apiKey import generates unnecessary object</td> </tr> <tr> <th>Type</th> <td> <img alt="Bug" src="https://tyktech.atlassian.net/rest/api/2/universal_avatar/view/type/issuetype/avatar/10303?size=medium" /> Bug </td> </tr> <tr> <th>Status</th> <td>In Dev</td> </tr> <tr> <th>Points</th> <td>N/A</td> </tr> <tr> <th>Labels</th> <td><a href="https://tyktech.atlassian.net/issues?jql=project%20%3D%20TT%20AND%20labels%20%3D%20codilime_refined%20ORDER%20BY%20created%20DESC" title="codilime_refined">codilime_refined</a></td> </tr> </table> </details> <!-- do not remove this marker as it will break jira-lint's functionality. added_by_jira_lint --> --- Reverts #7270 ___ ### **PR Type** Bug fix, Tests ___ ### **Description** Re-enable JSON inlining for `AuthSources` Remove test asserting non-serialization Keep token auth fill/roundtrip behavior intact Align JSON tags with intended API shape ___ ### Diagram Walkthrough ```mermaid flowchart LR Token["Token struct"] AuthSources["AuthSources fields"] JSONTag["json:\",inline\""] TestRemoval["Remove non-serialization test"] Token -- contains --> AuthSources AuthSources -- applied via --> JSONTag JSONTag -- implies --> InlinedInJSON["Inlined in JSON output"] TestRemoval -- aligns with --> InlinedInJSON ``` <details> <summary><h3> File Walkthrough</h3></summary> <table><thead><tr><th></th><th align="left">Relevant files</th></tr></thead><tbody><tr><td><strong>Bug fix</strong></td><td><table> <tr> <td> <details> <summary><strong>security.go</strong><dd><code>Re-enable JSON inlining for AuthSources in Token</code> </dd></summary> <hr> apidef/oas/security.go <ul><li>Change <code>Token.AuthSources</code> JSON tag to <code>",inline"</code><br> <li> Revert exclusion from JSON serialization</ul> </details> </td> <td><a href="https://github.com/TykTechnologies/tyk/pull/7299/files#diff-15e7d47137452ca4f3f6139aa8c007cdb426152c41846f712f8bf5dfb607afcc">+1/-1</a> </td> </tr> </table></td></tr><tr><td><strong>Tests</strong></td><td><table> <tr> <td> <details> <summary><strong>security_test.go</strong><dd><code>Delete test asserting AuthSources not serialized</code> </dd></summary> <hr> apidef/oas/security_test.go <ul><li>Remove round-trip JSON test for <code>AuthSources</code> omission<br> <li> Keep existing Token tests intact</ul> </details> </td> <td><a href="https://github.com/TykTechnologies/tyk/pull/7299/files#diff-5184167309db0462243e424baca87b5bb668962d8cc1076629fdcf11f00487e5">+0/-15</a> </td> </tr> </table></td></tr></tr></tbody></table> </details> ___
User description
TT-5588
Description
The header object is unnecessarily generated during creation of a Tyk OAS API by importing an OpenAPI description with security scheme defined.
Related Issue
Motivation and Context
How This Has Been Tested
Screenshots (if appropriate)
Types of changes
Checklist
PR Type
Bug fix, Tests
Description
Prevent
AuthSourcesfrom being serialized inTokenstructUpdate JSON serialization tags to exclude
AuthSourcesAdd test to verify
AuthSourcesare not serializedEnsure unmarshalled
TokenomitsAuthSourcesfieldsDiagram Walkthrough
File Walkthrough
security.go
Exclude AuthSources from Token JSON serializationapidef/oas/security.go
AuthSourcesto exclude from serializationAuthSourcesfrom appearing in serialized JSON outputsecurity_test.go
Add test for non-serialization of AuthSources in Tokenapidef/oas/security_test.go
AuthSourcesfields are not serializedQuery,Header, andCookieare nil after serializationround-trip