Skip to content

Add configurable OpenAPI security schemes and API version documentation - #153

Merged
vrslev merged 10 commits into
mainfrom
feature/openapi-security-schemes-version-documentation
Oct 5, 2026
Merged

vrslev merged 10 commits into
mainfrom
feature/openapi-security-schemes-version-documentation

Conversation

@Mernus

@Mernus Mernus commented Oct 1, 2026

Copy link
Copy Markdown
Contributor

Summary

Add optional OpenAPI configuration for FastAPI and Litestar:

  • Typed security schemes for HTTP, API key, OAuth 2.0 and OpenID Connect.
  • API version documentation through operation descriptions and an
    x-accept-versioning extension.
  • Per-operation version overrides, with an empty override skipping
    microbootstrap's version-documentation additions.

Both features are disabled by default and configured through the existing
Swagger settings and instrument lifecycle.

Security schemes

Configured definitions are merged into components.securitySchemes without
replacing existing components or security requirements. Identical definitions
are accepted; conflicting definitions raise ValueError.

Consumers can annotate their settings with the concrete scheme classes they
use. Python field names and OpenAPI aliases are supported.

This does not add authentication enforcement or global/operation-level
security requirements.

API version documentation

When configured, the vendor media type and supported versions are documented
for each operation. Overrides select an exact path and HTTP method.

FastAPI delegates lazily to the application's original OpenAPI generator.
Litestar extends standard Operation objects and rejects unsupported custom
operation subclasses rather than silently discarding their fields.

Repeated schema reads do not duplicate documentation. This does not implement
runtime version negotiation, add an Accept parameter, change response media
types or introduce a Swagger UI version selector.

Compatibility updates

Dependency Previous requirement New requirement
FastAPI >=0.100 >=0.110.1
prometheus-fastapi-instrumentator >=6.1 >=7.1
Litestar >=2.9 >=2.21.1
FastStream ~=0.6.2 >=0.6.7,<0.8

The updated bounds reflect tested compatibility:

  • FastAPI is aligned with the tested Starlette/httpx combination.
  • Instrumentator 7.1 provides the custom_labels API already used by the
    existing integration.
  • The Litestar floor excludes versions missing the required ASGIMiddleware
    API and selects a tested framework/telemetry combination.
  • The FastStream range retains the tested 0.6.x line and allows 0.7.x.

The FastStream adapter also omits the positional broker argument when no broker
is supplied, while forwarding a configured broker normally.

Consumers pinned below these bounds must update their dependency graph.
These bounds do not imply exhaustive validation of every permitted combination.

Validation

  • 103 targeted model, Swagger and OpenAPI integration tests pass in each
    Python 3.12.7 environment with Litestar 2.24.0 and 2.21.1.
  • Ruff lint and formatting checks pass.
  • Strict mypy checks pass.
  • Both independent README configuration examples were checked.

@Mernus
Mernus requested review from kek0vi4, mrkaaa and vrslev October 1, 2026 09:09
@Mernus Mernus self-assigned this Oct 1, 2026
@Mernus
Mernus marked this pull request as draft October 1, 2026 09:11
@vrslev
vrslev marked this pull request as ready for review October 1, 2026 10:09
@vrslev
vrslev marked this pull request as draft October 1, 2026 10:09
@Mernus
Mernus marked this pull request as ready for review October 1, 2026 10:42
@codecov

codecov Bot commented Oct 1, 2026 •

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.

Flag Coverage Δ
unittests 99.19% <100.00%> (+0.16%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines Coverage Δ
microbootstrap/__init__.py 100.00% <100.00%> (ø)
microbootstrap/bootstrappers/fastapi.py 100.00% <100.00%> (ø)
microbootstrap/bootstrappers/faststream.py 100.00% <100.00%> (ø)
microbootstrap/bootstrappers/litestar.py 98.80% <100.00%> (+0.67%) ⬆️
microbootstrap/helpers.py 98.36% <100.00%> (ø)
...obootstrap/instruments/openapi_security_schemes.py 100.00% <100.00%> (ø)
microbootstrap/instruments/openapi_version_docs.py 100.00% <100.00%> (ø)
microbootstrap/instruments/swagger_instrument.py 100.00% <100.00%> (ø)
🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@Mernus
Mernus force-pushed the feature/openapi-security-schemes-version-documentation branch from 6d956fa to 8d991d2 Compare October 5, 2026 08:51
@Mernus

Mernus commented Oct 5, 2026

Copy link
Copy Markdown
Contributor Author

Simplified Litestar security-scheme conversion, inlined version-extension validation, and removed single-use test fixtures. Fixed FastAPI OpenAPI augmentation for schemas without paths and with Paths Object extensions, plus Litestar bootstrap with OpenAPI disabled. Added regression coverage for pathless schemas, unsupported security-scheme models, and disabled version documentation.

@Mernus
Mernus requested a review from vrslev October 5, 2026 14:00
@Mernus Mernus added enhancement New feature or request dependencies Pull requests that update a dependency file labels Oct 5, 2026
@vrslev
vrslev merged commit 0d7696a into main Oct 5, 2026
18 checks passed
@vrslev
vrslev deleted the feature/openapi-security-schemes-version-documentation branch October 5, 2026 15:43
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file enhancement New feature or request

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants