feat(core): add asyncapi-operation-security-defined lint rule by harshit078 · Pull Request #2759 · Redocly/redocly-cli

harshit078 · 2026-04-21T09:52:21Z

What/Why/How?

Added asyncapi-operation-security-defined rule for AsyncAPI 2.x which reports when a security scheme referenced from an operation or server security array is not defined in ``components.securitySchemes.

Reference

#2667

Testing

Screenshots (optional)

Check yourself

This PR follows the contributing guide
All new/updated code is covered by tests
Core code changed? - Tested with other Redocly products (internal contributions only)
New package installed? - Tested in different environments (browser/node)
Documentation update has been considered

Security

The security impact of the change has been considered
Code follows company security practices and guidelines

Note

Medium Risk
New recommended-rule errors can break existing CI for AsyncAPI, and the rule enforces security documentation correctness (not runtime auth), with nuanced server/channel/trait behavior that users must align with.

Overview
Adds the security-defined built-in lint rule for AsyncAPI 2.x and 3.x, mirroring the OpenAPI rule: it validates security scheme references on operations and servers, and requires operations to declare security when applicable servers do not cover it.

AsyncAPI 2.x checks named schemes in security requirements against components.securitySchemes, tracks root server security (ignoring components.servers), and considers channel server bindings and operation traits via new isOperationSecured helper and expanded Async2 visitor hooks.

AsyncAPI 3.x validates $ref targets under #/components/securitySchemes/, enforces operation security on root operations (not reusable components.operations), and applies channel/server applicability similar to 2.x.

The rule is wired into async2Rules / async3Rules presets (error in recommended / all, warn in minimal, off in spec). Docs, changeset, and sidebar are updated. AsyncAPI typings are tightened to support the walkers; CLI split code gets a small AnyAsyncApiComponents typing refactor only.

Breaking: AsyncAPI specs using recommended may newly fail lint until security references and missing operation security are fixed.

^{Reviewed by Cursor Bugbot for commit 75389dc. Bugbot is set up for automated code reviews on this repo. Configure here.}

changeset-bot · 2026-04-21T09:52:26Z

🦋 Changeset detected

Latest commit: 75389dc

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 3 packages

Name	Type
@redocly/openapi-core	Minor
@redocly/cli	Minor
@redocly/respect-core	Minor

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

vadyvas

I would suggest a slightly different approach:

keep the AsyncAPI logic separate and do not reuse shared logic from the OAS rule
use the same rule name, security-defined, for AsyncAPI as well, and register the AsyncAPI implementation in the AsyncAPI ruleset
do not update the v1 docs in this PR

I think this would make the change smaller, clearer, and safer.

Thank you for the contribution, overall the PR looks good

vadyvas

left a few comments, could you take a look?

vadyvas · 2026-05-04T16:37:22Z

  'info-contact': InfoContact as Async2Rule,
  'info-license-strict': InfoLicenseStrict as Async2Rule,
  'operation-operationId': OperationOperationId as Async2Rule,
+  'security-defined': SecurityDefined,


Please add support for AsyncAPI 3 as well. Right now the rule only applies to AsyncAPI2

okay sure !

vadyvas · 2026-05-04T16:39:19Z

The code uses the rule name security-defined, but the docs still say asyncapi-operation-security-defined
Can you update related changes?

vadyvas · 2026-05-04T16:40:22Z

@@ -0,0 +1,83 @@
+# asyncapi-operation-security-defined


Please don’t add this rule to the v1 docs

harshit078 · 2026-06-08T10:53:09Z

Hi @AlbinaBlazhko17 , I have addressed all the refactoring you mentioned and fixed all comments by cursor. Can you check again ? Thanks for the patience to go back and forth !

AlbinaBlazhko17 · 2026-06-08T12:59:41Z

+---
+
+Added `security-defined` rule for AsyncAPI 2.x and 3.x.
+This rule reports when a security scheme referenced from an operation or server `security` array is not defined in `components.securitySchemes`.


Please, add warning here, because it is breaking change due to adding new rule in recommended ruleset with error severity.
e.g.
**Warning**: this change may break workflows that relied on root-level server inheritance.
And, i think, we need to remove second sentence, which explain how rule works.

cursor

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit cc37359. Configure here.}

AlbinaBlazhko17 · 2026-06-08T14:04:48Z

+
+Added `security-defined` rule for AsyncAPI 2.x and 3.x.
+
+**Warning**: this change may break workflows that relied on root-level server inheritance.


I provided to you just an example from another PR. Please update this warning to align with this PR.

I just realiased that and completely missed that in hurry. Aplogies !

No worries! Please, fix the issue from bugbot and i will review PR one more time. Thanks!

Addressed cursor bot comment. The Pr is good to review again. Thanks !

feat: add 'asyncapi-operation-security-defined' rule

7acc84a

harshit078 and others added 6 commits April 21, 2026 15:22

Merge branch 'main' into add-asyncapi-rule

ddcf5e1

feat: added asyncapi-operation-security-define rule in tests

e1a30b6

feat: added async operation function and updated rules

1fa95ec

Merge branch 'main' into add-asyncapi-rule

14e7719

feat: updated lint md docs and added tests

d6df2bf

feat: added changset

d31dfbc

harshit078 changed the title ~~feat: Add asyncapi-operation-security-defined lint rule~~ feat(core): Add asyncapi-operation-security-defined lint rule Apr 24, 2026

Merge branch 'main' into add-asyncapi-rule

ce2789b

harshit078 marked this pull request as ready for review April 24, 2026 07:51

harshit078 requested review from a team as code owners April 24, 2026 07:51

harshit078 changed the title ~~feat(core): Add asyncapi-operation-security-defined lint rule~~ feat(core): add asyncapi-operation-security-defined lint rule Apr 24, 2026

cursor Bot reviewed Apr 24, 2026

View reviewed changes

Comment thread packages/core/src/rules/async2/asyncapi-operation-security-defined.ts

harshit078 and others added 2 commits April 24, 2026 15:36

fix: address comments by cursor

726a43e

Merge branch 'main' into add-asyncapi-rule

bb01316

vadyvas requested changes Apr 28, 2026

View reviewed changes

harshit078 and others added 5 commits April 30, 2026 13:18

Merge branch 'main' into add-asyncapi-rule

f671deb

fix: removed v1 doc update for async api

573cbef

fix: adress comments and remove shared helper

e0229df

fix: security defined package

27f2667

Merge branch 'main' into add-asyncapi-rule

0663a44

cursor Bot reviewed Apr 30, 2026

View reviewed changes

Comment thread packages/core/src/config/__tests__/__snapshots__/config-resolvers.test.ts.snap Outdated

fix: address cursor comment

dd80e01

harshit078 requested a review from vadyvas April 30, 2026 12:45

vadyvas requested changes May 4, 2026

View reviewed changes

harshit078 and others added 2 commits May 5, 2026 20:01

Merge branch 'main' into add-asyncapi-rule

cc6133e

removed: asyncapi from v1 docs

4bd8b15

cursor Bot reviewed May 6, 2026

View reviewed changes

Comment thread docs/@v1/v1.sidebars.yaml Outdated

Comment thread packages/core/src/rules/async2/index.ts

harshit078 added 2 commits June 5, 2026 17:19

feat: added types to typings for asyncapi3 and asyncapi

24ec054

fix: updated visitor with new typing

60ec40d

cursor Bot reviewed Jun 5, 2026

View reviewed changes

Comment thread packages/core/src/utils/is-operation-secured.ts

harshit078 and others added 2 commits June 5, 2026 17:27

fix: updated security handling with new types and address comments

a3d69d4

Merge branch 'main' into add-asyncapi-rule

ccb78a7

cursor Bot reviewed Jun 5, 2026

View reviewed changes

Comment thread packages/core/src/rules/async2/security-defined.ts

fix: updated failing tests

379d695

cursor Bot reviewed Jun 5, 2026

View reviewed changes

Comment thread packages/core/src/rules/async3/security-defined.ts Outdated

harshit078 added 4 commits June 5, 2026 17:45

fix: failing build types

6373bd6

fix: updated failing e2e tests

a7e4405

fix: update failing tests and address cursor comments

be5f44a

fix: linting test failing

f2feadf

cursor Bot reviewed Jun 8, 2026

View reviewed changes

Comment thread packages/core/src/rules/async3/security-defined.ts

harshit078 added 4 commits June 8, 2026 13:41

fix: address cursor comments

9bb159a

fix: test failing

eba02fa

revert: previous failing commit

0de6c2c

revert: smoke test commit

2ebefe3

cursor Bot reviewed Jun 8, 2026

View reviewed changes

Comment thread packages/core/src/rules/async3/security-defined.ts Outdated

fix: address cursor comment

1cc78f5

cursor Bot reviewed Jun 8, 2026

View reviewed changes

Comment thread packages/core/src/rules/async2/security-defined.ts

Comment thread packages/core/src/rules/async2/security-defined.ts

fix: address cursor comment for async2

e61acd2

AlbinaBlazhko17 reviewed Jun 8, 2026

View reviewed changes

fix: changeset as per comment

d8693bc

AlbinaBlazhko17 reviewed Jun 8, 2026

View reviewed changes

Comment thread packages/cli/src/commands/split/asyncapi/gather-asyncapi-component-files.ts Outdated

fix: addrress comment

cc37359

cursor Bot reviewed Jun 8, 2026

View reviewed changes

Comment thread packages/core/src/rules/async3/security-defined.ts Outdated

AlbinaBlazhko17 reviewed Jun 8, 2026

View reviewed changes

harshit078 added 2 commits June 8, 2026 19:41

fix: address changeset and cursor comment

98dd9b5

fix: address comment from cursor

75389dc


		Added `security-defined` rule for AsyncAPI 2.x and 3.x.

		Warning: this change may break workflows that relied on root-level server inheritance.

Conversation

harshit078 commented Apr 21, 2026 • edited by cursor Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What/Why/How?

Reference

Testing

Screenshots (optional)

Check yourself

Security

Uh oh!

changeset-bot Bot commented Apr 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🦋 Changeset detected

Uh oh!

Uh oh!

vadyvas left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

vadyvas left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

harshit078 commented Jun 8, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

harshit078 commented Apr 21, 2026 •

edited by cursor Bot

Loading

changeset-bot Bot commented Apr 21, 2026 •

edited

Loading