DerManoMann / openapi-introspector / 39874832849

98%

push

github

Add a 401 and security requirements for Laravel routes behind auth middleware (#15)

A route behind Laravel's `auth` middleware now gets a `401` response,
and `security` requirements where its guards map to security schemes.

- Authentication is read from the route's middleware, its controller's
included, less what the route excludes: the `auth` alias with or without
guards (`auth:sanctum,api`), and the `Authenticate` middleware or a
subclass.
- Which scheme a guard stands for is the application's to say.
`Routing\Laravel\Authentication` takes a guard to scheme map, the guard
a bare `auth` uses (`web` unless given), and the middleware names that
count as authenticating. It can be extended for a project's own
conventions.
- Security requirements are added only when every guard on the route
maps to a scheme, since naming only some would say the others are not
accepted. The `401` is added either way.
- `security` set on the attributes, including an empty `[]` for a public
route, wins, and so does a `401` they declare.
- A controller that cannot be built outside the application keeps the
route's own middleware.

31 of 31 new or added lines in 3 files covered. (100.0%)

561 of 574 relevant lines covered (97.74%)

19.18 hits per line