Wire the SessionManager, which T427481: Extend MediaWiki Session framework to support OpenAPI metadata modified to communicate necessary OpenAPI information, into ModuleSpecHandler. Update the specification generator to build the global components.securitySchemes object and dynamically compute route-level security requirements based on whether an endpoint needs read/write access.
Conditions of Acceptance
- Updated ModuleSpecHandler::getComponentsSpec() to include securitySchemes. Reference: https://docs.google.com/document/d/1fQvy_Y7AIW4H-aa3HbDVqJK0Yz9ONVZynLbLcjQNKN8/edit?tab=t.0#heading=h.lbqh3abg16ub
- Updated the constructor of ModuleSpecHandler.php to inject SessionManagerInterface.
- Registered the SessionManager service in specs.v0.json for ModuleSpecHandler.
- Updated any ModuleSpecHandler tests that need a mocked or real SessionManagerInterface to be passed.
- Updated ModuleSpecHandler::getRouteSpec() to inject a security array with the correct information into every OpenAPI operation object, for every path. References: https://docs.google.com/document/d/1fQvy_Y7AIW4H-aa3HbDVqJK0Yz9ONVZynLbLcjQNKN8/edit?tab=t.0#heading=h.r81lxihffxjg , https://docs.google.com/document/d/1fQvy_Y7AIW4H-aa3HbDVqJK0Yz9ONVZynLbLcjQNKN8/edit?tab=t.0#heading=h.6vbsm3r55frn
- Expanded integration tests in [[ https://gerrit.wikimedia.org/r/plugins/gitiles/mediawiki/core/+/refs/heads/master/tests/phpunit/integration/includes/Rest/Handler/ModuleSpecHandlerTest.php | ModuleSpecHandlerTest.php ]] to verify correct structure of security outputs.
References
- Parent task: T422484: [5.2.5b Epic] Add security mechanism information to the MediaWiki REST API description.
- To do after T427481: Extend MediaWiki Session framework to support OpenAPI metadata.
- Two examples below are from the concrete YAML sketch of a target spec, to illustrate the security array, where grouping of security schemes is intentional so that operations represent AND/OR requirements.
A resulting get example in an OpenAPI spec could be:
security:
- {}
- MediaWiki-Session-CookieSessionProvider-Session: []
MediaWiki-Session-CookieSessionProvider-UserID: []
MediaWiki-Session-CookieSessionProvider-Token: []
- MediaWiki-Extension-OAuth-SessionProvider: []A resulting put example in an OpenAPI spec could be:
security:
- MediaWiki-Session-CookieSessionProvider-Session: []
MediaWiki-Session-CookieSessionProvider-UserID: []
MediaWiki-Session-CookieSessionProvider-Token: []
- MediaWiki-Extension-OAuth-SessionProvider: []View of This Task in Context of Related Tasks
