Two auth methods

[zchira]

Is it possible to allow calling some endpoint if only one of two Security Schemas are satisfied?

OpenApi spec says:

Security Requirement Object

Lists the required security schemes to execute this operation. The name used for each property MUST correspond to a security scheme declared in the Security Schemes under the Components Object.

Security Requirement Objects that contain multiple schemes require that all schemes MUST be satisfied for a request to be authorized. This enables support for scenarios where multiple query parameters or HTTP headers are required to convey security information.

When a list of Security Requirement Objects is defined on the OpenAPI Object or Operation Object, only one of the Security Requirement Objects in the list needs to be satisfied to authorize the request.

The idea is to create API which can be used from the Web Interface or as an API.
In the first case the endpoint /auth would return set-cookie in the header etc...
In the second case the endpoint /auth-api would return api-key which will be used in further requests as a part of header (X-Token: xxx, or Authorization: Bearer xxx)

[sunli829]

It has been added in v3.0.2

poem/poem-openapi/tests/security_scheme.rs

Line 544 in a7aca56

enum MySecurityScheme {