feat(spec): Parse securitySchemes + root security into Spec

Author: thced

src/main/java/com/retailsvc/http/spec/Spec.java

@@ -2,6 +2,9 @@
 
 import com.retailsvc.http.spec.schema.Schema;
 import com.retailsvc.http.spec.schema.SchemaParser;
+import com.retailsvc.http.spec.security.SecurityRequirement;
+import com.retailsvc.http.spec.security.SecurityScheme;
+import com.retailsvc.http.spec.security.SecuritySchemeParser;
 import java.io.IOException;
 import java.io.UncheckedIOException;
 import java.lang.reflect.Method;
@@ -25,7 +28,9 @@ public record Spec(
     String basePath,
     Map<String, Schema> schemaRefIndex,
     Map<String, Parameter> parameterRefIndex,
-    Map<String, Object> extensions) {
+    Map<String, Object> extensions,
+    Map<String, SecurityScheme> securitySchemes,
+    List<SecurityRequirement> security) {
 
   private static final String SCHEMA_KEY = "schema";
   private static final String SCHEMA_REF_PREFIX = "#/components/schemas/";
@@ -138,6 +143,15 @@ public static Spec from(Map<String, Object> raw) {
     List<Operation> operations =
         parseOperations(
             (Map<String, Object>) raw.getOrDefault("paths", Map.of()), componentParameters);
+    Map<String, Object> rawSchemes =
+        (Map<String, Object>) rawComponents.getOrDefault("securitySchemes", Map.of());
+    Map<String, SecurityScheme> securitySchemes = new LinkedHashMap<>();
+    for (var entry : rawSchemes.entrySet()) {
+      securitySchemes.put(
+          entry.getKey(), SecuritySchemeParser.parse((Map<String, Object>) entry.getValue()));
+    }
+    List<SecurityRequirement> rootSecurity =
+        SecuritySchemeParser.parseRequirements((List<Object>) raw.get("security"));
     return new Spec(
         openapi,
         info,
@@ -148,7 +162,9 @@ public static Spec from(Map<String, Object> raw) {
         computeBasePath(servers),
         indexByRef(componentSchemas, SCHEMA_REF_PREFIX),
         indexByRef(componentParameters, PARAMETER_REF_PREFIX),
-        extractExtensions(raw));
+        extractExtensions(raw),
+        Map.copyOf(securitySchemes),
+        rootSecurity);
   }
 
   private static String computeBasePath(List<Server> servers) {

src/test/java/com/retailsvc/http/internal/RequestPreparationFilterTest.java

@@ -58,7 +58,9 @@ private Spec specWith(Operation... ops) {
         "",
         Map.of(),
         Map.of(),
-        Map.of());
+        Map.of(),
+        Map.of(),
+        List.of());
   }
 
   private Filter newFilter(Spec spec) {

src/test/java/com/retailsvc/http/spec/SpecTest.java

@@ -70,4 +70,54 @@ void parsesExistingFixture() throws Exception {
     Spec spec = Spec.from(loadJson("openapi.json"));
     assertThat(spec.operations()).isNotEmpty();
   }
+
+  @Test
+  void parsesSecuritySchemesFromComponents() {
+    Map<String, Object> raw =
+        Map.of(
+            "openapi", "3.1.0",
+            "info", Map.of("title", "T", "version", "1"),
+            "servers", List.of(Map.of("url", "/v1")),
+            "paths", Map.of(),
+            "components",
+                Map.of(
+                    "securitySchemes",
+                    Map.of(
+                        "apiKeyAuth",
+                        Map.of("type", "apiKey", "name", "X-API-Key", "in", "header"))));
+
+    Spec spec = Spec.from(raw);
+
+    assertThat(spec.securitySchemes()).containsKey("apiKeyAuth");
+  }
+
+  @Test
+  void parsesRootSecurity() {
+    Map<String, Object> raw =
+        Map.of(
+            "openapi", "3.1.0",
+            "info", Map.of("title", "T", "version", "1"),
+            "servers", List.of(Map.of("url", "/v1")),
+            "paths", Map.of(),
+            "security", List.of(Map.of("bearerAuth", List.of())));
+
+    Spec spec = Spec.from(raw);
+
+    assertThat(spec.security()).hasSize(1);
+  }
+
+  @Test
+  void securitySchemesDefaultsEmpty() {
+    Map<String, Object> raw =
+        Map.of(
+            "openapi", "3.1.0",
+            "info", Map.of("title", "T", "version", "1"),
+            "servers", List.of(Map.of("url", "/v1")),
+            "paths", Map.of());
+
+    Spec spec = Spec.from(raw);
+
+    assertThat(spec.securitySchemes()).isEmpty();
+    assertThat(spec.security()).isEmpty();
+  }
 }