feat(core): add asyncapi-operation-security-defined lint rule by harshit078 · Pull Request #2759 · Redocly/redocly-cli

harshit078 · 2026-04-21T09:52:21Z

What/Why/How?

Added asyncapi-operation-security-defined rule for AsyncAPI 2.x which reports when a security scheme referenced from an operation or server security array is not defined in ``components.securitySchemes.

Reference

#2667

Testing

Screenshots (optional)

Check yourself

This PR follows the contributing guide
All new/updated code is covered by tests
Core code changed? - Tested with other Redocly products (internal contributions only)
New package installed? - Tested in different environments (browser/node)
Documentation update has been considered

Security

The security impact of the change has been considered
Code follows company security practices and guidelines

Note

Medium Risk
Adds a new built-in lint rule and enables it in default AsyncAPI rulesets, which can introduce new lint failures for existing AsyncAPI specs and affects core linting behavior.

Overview
Adds a new AsyncAPI built-in rule, security-defined, for both AsyncAPI 2.6 and AsyncAPI 3.0 to flag operations/servers that reference missing components.securitySchemes (and, for 3.0, $refs that don’t point into #/components/securitySchemes).

Wires the rule into the AsyncAPI rule registries and default configs (recommended, recommended-strict, minimal, all, spec), updates config resolver snapshots, and adds dedicated unit tests plus documentation/sidebars and a changeset bump.

^{Reviewed by Cursor Bugbot for commit 59e91b6. Bugbot is set up for automated code reviews on this repo. Configure here.}

changeset-bot · 2026-04-21T09:52:26Z

🦋 Changeset detected

Latest commit: 59e91b6

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 3 packages

Name	Type
@redocly/openapi-core	Minor
@redocly/cli	Minor
@redocly/respect-core	Minor

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

vadyvas

I would suggest a slightly different approach:

keep the AsyncAPI logic separate and do not reuse shared logic from the OAS rule
use the same rule name, security-defined, for AsyncAPI as well, and register the AsyncAPI implementation in the AsyncAPI ruleset
do not update the v1 docs in this PR

I think this would make the change smaller, clearer, and safer.

Thank you for the contribution, overall the PR looks good

vadyvas

left a few comments, could you take a look?

vadyvas · 2026-05-04T16:37:22Z

  'info-contact': InfoContact as Async2Rule,
  'info-license-strict': InfoLicenseStrict as Async2Rule,
  'operation-operationId': OperationOperationId as Async2Rule,
+  'security-defined': SecurityDefined,


Please add support for AsyncAPI 3 as well. Right now the rule only applies to AsyncAPI2

okay sure !

vadyvas · 2026-05-04T16:39:19Z

The code uses the rule name security-defined, but the docs still say asyncapi-operation-security-defined
Can you update related changes?

vadyvas · 2026-05-04T16:40:22Z

@@ -0,0 +1,83 @@
+# asyncapi-operation-security-defined


Please don’t add this rule to the v1 docs

AlbinaBlazhko17 · 2026-05-12T13:45:14Z

+  return {
+    ref: {
+      leave(node, { type, location, report }, resolved) {
+        if (type.name !== 'SecurityScheme') return;


Please, follow our visitors pattern as you did in rule for async2

AlbinaBlazhko17 · 2026-05-12T13:57:04Z

+          if (scheme.defined) continue;
+          for (const reportedFromLocation of scheme.from) {
+            report({
+              message: `There is no \`${name}\` security scheme defined.`,


I think we should align these rules with the existing OpenAPI; in other words, we need to report if any operation doesn't have a security defined

cursor

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 1c4f368. Configure here.}

AlbinaBlazhko17 · 2026-05-14T14:10:56Z

+          if (!isRef(item)) continue;
+          const itemLocation = location.child([i]);
+          const ref = item.$ref;
+          if (!ref.startsWith(COMPONENT_SCHEME_PREFIX)) {


Please, avoid using this type of check, because it will cause issues in future. e.g. other.yaml#/components/securitySchemes/jwt will be rejected. Try to track defined schemes by their location.absolutePointer and in SecuritySchemeList resolve each ref and compare absolute pointers.

AlbinaBlazhko17 · 2026-05-14T14:11:08Z

+"@redocly/openapi-core": minor
+---
+
+Added `security-defined` rule for AsyncAPI 2.x that reports when a security scheme referenced from an operation or server `security` array is not defined in `components.securitySchemes`.


Please, add in changeset AsyncAPI 3.x support.

AlbinaBlazhko17 · 2026-05-14T14:13:25Z

Thanks @harshit078 for your patience. Almost there. My biggest concern is based on AsyncAPI v3 rule and manually checking ref locations, i left comment regarding it.

harshit078 · 2026-05-18T08:31:18Z

Hey @AlbinaBlazhko17 , post your comment I understood the mistake I did for that check in the async3 security defined. I have pushed a fix addressing it. Thanks !

AlbinaBlazhko17 · 2026-05-20T06:46:47Z

+        if (!list) return;
+        for (let i = 0; i < list.length; i++) {
+          const item = list[i];
+          if (!isRef(item)) continue;


Could you explain why are you skipping not refs? And the purpose of this statement item.$ref.split('/').pop()?

my intent behind the skipping not refs in the logic is that since every security item can be either be a $ref or an inline object. Since inline objects are complete in itself hence there's nothing to check or cross check against components.securitySchemes hence only $ref items can be tracked as references.

The purpose of tthis statement is that it basically just grabs the last pointer segment purely as a display name in the "There is no name security scheme defined." message which matches with the async2 wording.

I hope my explanation did a justice to what I was trying to say. If not, I'm happy to provide further explanation. Thanks !

Co-authored-by: Jacek Łękawa <164185257+JLekawa@users.noreply.github.com>

feat: add 'asyncapi-operation-security-defined' rule

7acc84a

harshit078 and others added 6 commits April 21, 2026 15:22

Merge branch 'main' into add-asyncapi-rule

ddcf5e1

feat: added asyncapi-operation-security-define rule in tests

e1a30b6

feat: added async operation function and updated rules

1fa95ec

Merge branch 'main' into add-asyncapi-rule

14e7719

feat: updated lint md docs and added tests

d6df2bf

feat: added changset

d31dfbc

harshit078 changed the title ~~feat: Add asyncapi-operation-security-defined lint rule~~ feat(core): Add asyncapi-operation-security-defined lint rule Apr 24, 2026

Merge branch 'main' into add-asyncapi-rule

ce2789b

harshit078 marked this pull request as ready for review April 24, 2026 07:51

harshit078 requested review from a team as code owners April 24, 2026 07:51

harshit078 changed the title ~~feat(core): Add asyncapi-operation-security-defined lint rule~~ feat(core): add asyncapi-operation-security-defined lint rule Apr 24, 2026

cursor Bot reviewed Apr 24, 2026

View reviewed changes

Comment thread packages/core/src/rules/async2/asyncapi-operation-security-defined.ts

harshit078 and others added 2 commits April 24, 2026 15:36

fix: address comments by cursor

726a43e

Merge branch 'main' into add-asyncapi-rule

bb01316

vadyvas requested changes Apr 28, 2026

View reviewed changes

harshit078 and others added 5 commits April 30, 2026 13:18

Merge branch 'main' into add-asyncapi-rule

f671deb

fix: removed v1 doc update for async api

573cbef

fix: adress comments and remove shared helper

e0229df

fix: security defined package

27f2667

Merge branch 'main' into add-asyncapi-rule

0663a44

cursor Bot reviewed Apr 30, 2026

View reviewed changes

Comment thread packages/core/src/config/__tests__/__snapshots__/config-resolvers.test.ts.snap Outdated

fix: address cursor comment

dd80e01

harshit078 requested a review from vadyvas April 30, 2026 12:45

vadyvas requested changes May 4, 2026

View reviewed changes

harshit078 and others added 2 commits May 5, 2026 20:01

Merge branch 'main' into add-asyncapi-rule

cc6133e

removed: asyncapi from v1 docs

4bd8b15

cursor Bot reviewed May 6, 2026

View reviewed changes

Comment thread docs/@v1/v1.sidebars.yaml Outdated

Comment thread packages/core/src/rules/async2/index.ts

harshit078 and others added 3 commits May 12, 2026 18:32

fix: removed rule from v1 docs

37d71d8

fix: address comments and remove location regex

77b8435

Merge branch 'main' into add-asyncapi-rule

b06fc28

harshit078 requested a review from AlbinaBlazhko17 May 12, 2026 13:24

AlbinaBlazhko17 reviewed May 12, 2026

View reviewed changes

Comment thread .changeset/stupid-dryers-add.md Outdated

AlbinaBlazhko17 reviewed May 12, 2026

View reviewed changes

fix: updated naming in changset

1c4f368

cursor Bot reviewed May 13, 2026

View reviewed changes

Comment thread packages/core/src/rules/async3/security-defined.ts Outdated

harshit078 and others added 3 commits May 13, 2026 15:55

fix: updated async2 security defined

12ebb65

fix: updating async3 for visitor pattenr

66876b1

Merge branch 'main' into add-asyncapi-rule

97dbad9

harshit078 requested a review from AlbinaBlazhko17 May 13, 2026 10:44

AlbinaBlazhko17 reviewed May 14, 2026

View reviewed changes

harshit078 and others added 2 commits May 18, 2026 13:58

fix: address comments and update changeset

f4d4315

Merge branch 'main' into add-asyncapi-rule

da2ffb2

harshit078 requested a review from AlbinaBlazhko17 May 18, 2026 10:27

AlbinaBlazhko17 reviewed May 20, 2026

View reviewed changes

JLekawa reviewed May 20, 2026

View reviewed changes

Comment thread .changeset/stupid-dryers-add.md Outdated

harshit078 and others added 2 commits May 20, 2026 15:59

Update .changeset/stupid-dryers-add.md

bd40779

Co-authored-by: Jacek Łękawa <164185257+JLekawa@users.noreply.github.com>

Merge branch 'main' into add-asyncapi-rule

0784245

JLekawa reviewed May 20, 2026

View reviewed changes

Comment thread docs/@v2/rules/async/security-defined.md Outdated

Comment thread docs/@v2/rules/async/security-defined.md Outdated

harshit078 and others added 2 commits May 20, 2026 19:13

Update docs/@v2/rules/async/security-defined.md

599c548

Co-authored-by: Jacek Łękawa <164185257+JLekawa@users.noreply.github.com>

Update docs/@v2/rules/async/security-defined.md

a6b8177

Co-authored-by: Jacek Łękawa <164185257+JLekawa@users.noreply.github.com>

JLekawa reviewed May 20, 2026

View reviewed changes

Comment thread docs/@v2/rules/async/security-defined.md Outdated

Apply suggestion from @JLekawa

59e91b6

JLekawa approved these changes May 20, 2026

View reviewed changes

Conversation

harshit078 commented Apr 21, 2026 • edited by cursor Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What/Why/How?

Reference

Testing

Screenshots (optional)

Check yourself

Security

Uh oh!

changeset-bot Bot commented Apr 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🦋 Changeset detected

Uh oh!

Uh oh!

vadyvas left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

vadyvas left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

AlbinaBlazhko17 commented May 14, 2026

Uh oh!

harshit078 commented May 18, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

harshit078 commented Apr 21, 2026 •

edited by cursor Bot

Loading

changeset-bot Bot commented Apr 21, 2026 •

edited

Loading