@@ -14,6 +14,7 @@ import {
1414} from "../results/index" ;
1515import { minimumSchema } from "../transform/index" ;
1616import { isValidRequest } from "../utils/interaction" ;
17+ import { isQuirky } from "../utils/quirks" ;
1718import { dereferenceOas , splitPath } from "../utils/schema" ;
1819import { getValidateFunction } from "../utils/validation" ;
1920import { findMatchingType , standardHttpRequestHeaders } from "./utils/content" ;
@@ -176,15 +177,19 @@ export function* compareReqHeader(
176177 // security headers
177178 // ----------------
178179 if ( isValidRequest ( interaction ) ) {
180+ let isSecured = false ;
181+ const maybeResults : Result [ ] = [ ] ;
179182 for ( const scheme of operation . security || [ ] ) {
180183 for ( const schemeName of Object . keys ( scheme ) ) {
181184 const scheme = securitySchemes [ schemeName ] ;
182185 switch ( scheme ?. type ) {
183186 case "apiKey" :
184187 switch ( scheme . in ) {
185188 case "header" :
186- if ( ! requestHeaders . has ( scheme . name ) ) {
187- yield {
189+ if ( requestHeaders . has ( scheme . name ) ) {
190+ isSecured = true ;
191+ } else {
192+ maybeResults . push ( {
188193 code : "request.authorization.missing" ,
189194 message :
190195 "Request Authorization header is missing but is required by the spec file" ,
@@ -200,21 +205,20 @@ export function* compareReqHeader(
200205 value : operation ,
201206 } ,
202207 type : "error" ,
203- } ;
208+ } ) ;
204209 }
205210 requestHeaders . delete ( scheme . name ) ;
206211 break ;
207212 case "cookie" :
208- // FIXME: handle cookies
209- break ;
210213 case "query" :
211- // ignore
212214 }
213215 break ;
214216 case "basic" : {
215217 const basicAuth = requestHeaders . get ( "authorization" ) || "" ;
216- if ( ! basicAuth . startsWith ( "Basic " ) ) {
217- yield {
218+ if ( basicAuth . startsWith ( "Basic " ) ) {
219+ isSecured = true ;
220+ } else {
221+ maybeResults . push ( {
218222 code : "request.authorization.missing" ,
219223 message :
220224 "Request Authorization header is missing but is required by the spec file" ,
@@ -230,7 +234,7 @@ export function* compareReqHeader(
230234 value : operation ,
231235 } ,
232236 type : "error" ,
233- } ;
237+ } ) ;
234238 }
235239 break ;
236240 }
@@ -246,8 +250,14 @@ export function* compareReqHeader(
246250 break ;
247251 }
248252
249- if ( ! isValid ) {
250- yield {
253+ if ( process . env . QUIRKS ) {
254+ isValid = requestHeaders . get ( "authorization" ) !== null ;
255+ }
256+
257+ if ( isValid ) {
258+ isSecured = true ;
259+ } else {
260+ maybeResults . push ( {
251261 code : "request.authorization.missing" ,
252262 message :
253263 "Request Authorization header is missing but is required by the spec file" ,
@@ -263,7 +273,7 @@ export function* compareReqHeader(
263273 value : operation ,
264274 } ,
265275 type : "error" ,
266- } ;
276+ } ) ;
267277 }
268278 break ;
269279 }
@@ -274,6 +284,10 @@ export function* compareReqHeader(
274284 }
275285 }
276286 }
287+
288+ if ( ! isSecured ) {
289+ yield * maybeResults ;
290+ }
277291 }
278292
279293 // specified headers
@@ -300,10 +314,12 @@ export function* compareReqHeader(
300314 ? requestHeaders . get ( dereferencedParameter . name )
301315 : parseValue ( requestHeaders . get ( dereferencedParameter . name ) ) ;
302316
303- if ( value && schema && isValidRequest ( interaction ) ) {
317+ if ( value !== null && schema && isValidRequest ( interaction ) ) {
304318 const schemaId = `[root].paths.${ path } .${ method } .parameters[${ parameterIndex } ]` ;
305319 const validate = getValidateFunction ( ajv , schemaId , ( ) =>
306- minimumSchema ( schema , oas ) ,
320+ process . env . QUIRKS && value && isQuirky ( schema )
321+ ? { }
322+ : minimumSchema ( schema , oas ) ,
307323 ) ;
308324 if ( ! validate ( value ) ) {
309325 for ( const error of validate . errors ! ) {
@@ -330,7 +346,7 @@ export function* compareReqHeader(
330346 }
331347
332348 if (
333- ! value &&
349+ value === null &&
334350 dereferencedParameter . required &&
335351 isValidRequest ( interaction )
336352 ) {
0 commit comments