Fix some edge cases of OAS auth source conversions (TykTechnologies#3912

)

apidef/oas/security.go

@@ -38,15 +38,15 @@ func (s *OAS) fillToken(api apidef.APIDefinition) {
 		token.Signature = nil
 	}
 
+	s.getTykSecuritySchemes()[authConfig.Name] = token
+
 	if ShouldOmit(token) {
-		token = nil
+		delete(s.getTykSecuritySchemes(), authConfig.Name)
 	}
-
-	s.getTykSecuritySchemes()[authConfig.Name] = token
 }
 
 func (s *OAS) extractTokenTo(api *apidef.APIDefinition, name string) {
-	var authConfig apidef.AuthConfig
+	authConfig := apidef.AuthConfig{DisableHeader: true}
 
 	if token := s.getTykTokenAuth(name); token != nil {
 		api.UseStandardAuth = token.Enabled
@@ -122,15 +122,15 @@ func (s *OAS) fillSecurityScheme(ac *apidef.AuthConfig) {
 	var loc, name string
 
 	switch {
-	case ref.Value.In == header || (ref.Value.In == "" && !ac.DisableHeader):
+	case ref.Value.In == header || (ref.Value.In == "" && ac.AuthHeaderName != ""):
 		loc = header
 		name = ac.AuthHeaderName
 		ac.AuthHeaderName = ""
-	case ref.Value.In == query || (ref.Value.In == "" && ac.UseParam):
+	case ref.Value.In == query || (ref.Value.In == "" && ac.ParamName != ""):
 		loc = query
 		name = ac.ParamName
 		ac.ParamName = ""
-	case ref.Value.In == cookie || (ref.Value.In == "" && ac.UseCookie):
+	case ref.Value.In == cookie || (ref.Value.In == "" && ac.CookieName != ""):
 		loc = cookie
 		name = ac.CookieName
 		ac.CookieName = ""

apidef/oas/security_test.go

@@ -95,14 +95,21 @@ func TestOAS_SecurityScheme(t *testing.T) {
 	})
 
 	t.Run("should not set query name in tyk extension", func(t *testing.T) {
-		ac.DisableHeader = true
+		ac.AuthHeaderName = ""
 		check(query, queryName, ac, OAS{})
+
+		// reset
+		ac.AuthHeaderName = headerName
 	})
 
 	t.Run("should not set cookie name in tyk extension", func(t *testing.T) {
-		ac.DisableHeader = true
-		ac.UseParam = false
+		ac.AuthHeaderName = ""
+		ac.ParamName = ""
 		check(cookie, cookieName, ac, OAS{})
+
+		// reset
+		ac.AuthHeaderName = headerName
+		ac.ParamName = queryName
 	})
 
 	testOAS := func(in, name string) (oas OAS) {
@@ -120,20 +127,14 @@ func TestOAS_SecurityScheme(t *testing.T) {
 	}
 
 	t.Run("already filled scheme in=header value should be respected", func(t *testing.T) {
-		ac.DisableHeader = true
 		check(header, headerName, ac, testOAS(header, headerName))
 	})
 
 	t.Run("already filled scheme in=query value should be respected", func(t *testing.T) {
-		ac.DisableHeader = false
-		ac.UseParam = false
 		check(query, queryName, ac, testOAS(query, queryName))
 	})
 
 	t.Run("already filled scheme in=cookie value should be respected", func(t *testing.T) {
-		ac.DisableHeader = false
-		ac.UseParam = true
-		ac.UseCookie = false
 		check(cookie, cookieName, ac, testOAS(cookie, cookieName))
 	})
 }
@@ -185,3 +186,32 @@ func TestOAS_Token(t *testing.T) {
 
 	assert.Equal(t, oas, convertedOAS)
 }
+
+func TestOAS_Token_EmptyTykAuthentication(t *testing.T) {
+	const securityName = "custom"
+
+	var oas OAS
+	oas.Security = openapi3.SecurityRequirements{
+		{
+			securityName: []string{},
+		},
+	}
+
+	oas.Components.SecuritySchemes = openapi3.SecuritySchemes{
+		securityName: {
+			Value: &openapi3.SecurityScheme{
+				Type: apiKey,
+				Name: "x-query",
+				In:   query,
+			},
+		},
+	}
+
+	var api apidef.APIDefinition
+	oas.ExtractTo(&api)
+
+	var convertedOAS OAS
+	convertedOAS.Fill(api)
+
+	assert.Equal(t, oas, convertedOAS)
+}