feat(core): add asyncapi-operation-security-defined lint rule by harshit078 · Pull Request #2759 · Redocly/redocly-cli

harshit078 · 2026-04-21T09:52:21Z

What/Why/How?

Added asyncapi-operation-security-defined rule for AsyncAPI 2.x which reports when a security scheme referenced from an operation or server security array is not defined in ``components.securitySchemes.

Reference

#2667

Testing

Screenshots (optional)

Check yourself

This PR follows the contributing guide
All new/updated code is covered by tests
Core code changed? - Tested with other Redocly products (internal contributions only)
New package installed? - Tested in different environments (browser/node)
Documentation update has been considered

Security

The security impact of the change has been considered
Code follows company security practices and guidelines

Note

Medium Risk
Adds a new built-in AsyncAPI lint rule and enables it in default rulesets (recommended/all), which can introduce new lint failures for existing AsyncAPI specs.

Overview
Adds a new AsyncAPI built-in rule, security-defined, that reports (1) operation/server security references that don’t exist in components.securitySchemes and (2) operations missing security entirely; AsyncAPI 3.0 additionally validates that security $refs point into #/components/securitySchemes.

Enables the rule across core ruleset presets (all, recommended, recommended-strict, minimal, spec), updates config/type plumbing and snapshots, and adds dedicated AsyncAPI 2.x/3.0 test coverage plus new documentation pages and sidebar/ruleset-template entries.

^{Reviewed by Cursor Bugbot for commit 97dbad9. Bugbot is set up for automated code reviews on this repo. Configure here.}

changeset-bot · 2026-04-21T09:52:26Z

🦋 Changeset detected

Latest commit: 97dbad9

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 3 packages

Name	Type
@redocly/openapi-core	Minor
@redocly/cli	Minor
@redocly/respect-core	Minor

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

vadyvas

I would suggest a slightly different approach:

keep the AsyncAPI logic separate and do not reuse shared logic from the OAS rule
use the same rule name, security-defined, for AsyncAPI as well, and register the AsyncAPI implementation in the AsyncAPI ruleset
do not update the v1 docs in this PR

I think this would make the change smaller, clearer, and safer.

Thank you for the contribution, overall the PR looks good

vadyvas

left a few comments, could you take a look?

vadyvas · 2026-05-04T16:37:22Z

  'info-contact': InfoContact as Async2Rule,
  'info-license-strict': InfoLicenseStrict as Async2Rule,
  'operation-operationId': OperationOperationId as Async2Rule,
+  'security-defined': SecurityDefined,


Please add support for AsyncAPI 3 as well. Right now the rule only applies to AsyncAPI2

okay sure !

vadyvas · 2026-05-04T16:39:19Z

The code uses the rule name security-defined, but the docs still say asyncapi-operation-security-defined
Can you update related changes?

vadyvas · 2026-05-04T16:40:22Z

@@ -0,0 +1,83 @@
+# asyncapi-operation-security-defined


Please don’t add this rule to the v1 docs

AlbinaBlazhko17 · 2026-05-11T14:23:59Z

+  return {
+    ref: {
+      leave(node, { location, report }, resolved) {
+        if (!SECURITY_LOCATION.test(location.pointer)) return;


Please, avoid using regex pattern to check the location. For the rules we have visitors pattern, so you can use SecurityScheme visitor here.

sure thanks for the help. I'll push a fix for it

AlbinaBlazhko17 · 2026-05-11T14:26:09Z

  info-contact: off
  info-license-strict: warn
  operation-operationId: warn
+  asyncapi-operation-security-defined: error


It looks like you forgot to remove the new rule from the v1 docs. Please, remove this line

AlbinaBlazhko17 · 2026-05-12T13:45:14Z

+  return {
+    ref: {
+      leave(node, { type, location, report }, resolved) {
+        if (type.name !== 'SecurityScheme') return;


Please, follow our visitors pattern as you did in rule for async2

AlbinaBlazhko17 · 2026-05-12T13:57:04Z

+          if (scheme.defined) continue;
+          for (const reportedFromLocation of scheme.from) {
+            report({
+              message: `There is no \`${name}\` security scheme defined.`,


I think we should align these rules with the existing OpenAPI; in other words, we need to report if any operation doesn't have a security defined

cursor

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 1c4f368. Configure here.}

AlbinaBlazhko17 · 2026-05-14T14:10:56Z

+          if (!isRef(item)) continue;
+          const itemLocation = location.child([i]);
+          const ref = item.$ref;
+          if (!ref.startsWith(COMPONENT_SCHEME_PREFIX)) {


Please, avoid using this type of check, because it will cause issues in future. e.g. other.yaml#/components/securitySchemes/jwt will be rejected. Try to track defined schemes by their location.absolutePointer and in SecuritySchemeList resolve each ref and compare absolute pointers.

AlbinaBlazhko17 · 2026-05-14T14:11:08Z

+"@redocly/openapi-core": minor
+---
+
+Added `security-defined` rule for AsyncAPI 2.x that reports when a security scheme referenced from an operation or server `security` array is not defined in `components.securitySchemes`.


Please, add in changeset AsyncAPI 3.x support.

AlbinaBlazhko17 · 2026-05-14T14:13:25Z

Thanks @harshit078 for your patience. Almost there. My biggest concern is based on AsyncAPI v3 rule and manually checking ref locations, i left comment regarding it.

feat: add 'asyncapi-operation-security-defined' rule

7acc84a

harshit078 and others added 6 commits April 21, 2026 15:22

Merge branch 'main' into add-asyncapi-rule

ddcf5e1

feat: added asyncapi-operation-security-define rule in tests

e1a30b6

feat: added async operation function and updated rules

1fa95ec

Merge branch 'main' into add-asyncapi-rule

14e7719

feat: updated lint md docs and added tests

d6df2bf

feat: added changset

d31dfbc

harshit078 changed the title ~~feat: Add asyncapi-operation-security-defined lint rule~~ feat(core): Add asyncapi-operation-security-defined lint rule Apr 24, 2026

Merge branch 'main' into add-asyncapi-rule

ce2789b

harshit078 marked this pull request as ready for review April 24, 2026 07:51

harshit078 requested review from a team as code owners April 24, 2026 07:51

harshit078 changed the title ~~feat(core): Add asyncapi-operation-security-defined lint rule~~ feat(core): add asyncapi-operation-security-defined lint rule Apr 24, 2026

cursor Bot reviewed Apr 24, 2026

View reviewed changes

Comment thread packages/core/src/rules/async2/asyncapi-operation-security-defined.ts

harshit078 and others added 2 commits April 24, 2026 15:36

fix: address comments by cursor

726a43e

Merge branch 'main' into add-asyncapi-rule

bb01316

vadyvas requested changes Apr 28, 2026

View reviewed changes

harshit078 and others added 5 commits April 30, 2026 13:18

Merge branch 'main' into add-asyncapi-rule

f671deb

fix: removed v1 doc update for async api

573cbef

fix: adress comments and remove shared helper

e0229df

fix: security defined package

27f2667

Merge branch 'main' into add-asyncapi-rule

0663a44

cursor Bot reviewed Apr 30, 2026

View reviewed changes

Comment thread packages/core/src/config/__tests__/__snapshots__/config-resolvers.test.ts.snap Outdated

fix: address cursor comment

dd80e01

harshit078 requested a review from vadyvas April 30, 2026 12:45

vadyvas requested changes May 4, 2026

View reviewed changes

harshit078 and others added 2 commits May 5, 2026 20:01

Merge branch 'main' into add-asyncapi-rule

cc6133e

removed: asyncapi from v1 docs

4bd8b15

cursor Bot reviewed May 6, 2026

View reviewed changes

Comment thread docs/@v1/v1.sidebars.yaml Outdated

Comment thread packages/core/src/rules/async2/index.ts

harshit078 added 2 commits May 6, 2026 14:05

fix: renamed v2 docs and updated to security defined

f2aee8b

fix: cursor comments

c970602

cursor Bot reviewed May 6, 2026

View reviewed changes

Comment thread docs/@v2/rules/async/security-defined.md

Comment thread docs/@v1/rules/built-in-rules.md Outdated

harshit078 added 2 commits May 6, 2026 15:31

fix: updated AsyncAPI3 docs and files

4675ac4

fix: removed v1 docs for async api

75bf960

cursor Bot reviewed May 6, 2026

View reviewed changes

Comment thread packages/core/src/rules/async3/security-defined.ts

Comment thread docs/@v1/rules/ruleset-templates.md Outdated

fix: address cursor comments

bf96d18

harshit078 requested a review from vadyvas May 6, 2026 10:29

AlbinaBlazhko17 reviewed May 11, 2026

View reviewed changes

harshit078 and others added 3 commits May 12, 2026 18:32

fix: removed rule from v1 docs

37d71d8

fix: address comments and remove location regex

77b8435

Merge branch 'main' into add-asyncapi-rule

b06fc28

harshit078 requested a review from AlbinaBlazhko17 May 12, 2026 13:24

AlbinaBlazhko17 reviewed May 12, 2026

View reviewed changes

Comment thread .changeset/stupid-dryers-add.md Outdated

AlbinaBlazhko17 reviewed May 12, 2026

View reviewed changes

fix: updated naming in changset

1c4f368

cursor Bot reviewed May 13, 2026

View reviewed changes

Comment thread packages/core/src/rules/async3/security-defined.ts Outdated

harshit078 and others added 3 commits May 13, 2026 15:55

fix: updated async2 security defined

12ebb65

fix: updating async3 for visitor pattenr

66876b1

Merge branch 'main' into add-asyncapi-rule

97dbad9

harshit078 requested a review from AlbinaBlazhko17 May 13, 2026 10:44

AlbinaBlazhko17 reviewed May 14, 2026

View reviewed changes

Conversation

harshit078 commented Apr 21, 2026 • edited by cursor Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What/Why/How?

Reference

Testing

Screenshots (optional)

Check yourself

Security

Uh oh!

changeset-bot Bot commented Apr 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🦋 Changeset detected

Uh oh!

Uh oh!

vadyvas left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

vadyvas left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

AlbinaBlazhko17 commented May 14, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

harshit078 commented Apr 21, 2026 •

edited by cursor Bot

Loading

changeset-bot Bot commented Apr 21, 2026 •

edited

Loading