[dinwwwh]

Requested by dinwwwh · project thread

Summary

3.2 lets a security requirement name a scheme either by its component name or by a URI reference to it, such as #/components/securitySchemes/key. 3.1 only allows component names. Kept as written, a URI name in the 3.1 output names no declared scheme, so no request can meet that requirement, which makes the document stricter.

The fix keeps each requirement name that is a key of components.securitySchemes and leaves out any other name, on the document's security and each operation's. Removing a name asks for less, so every request the 3.2 document accepts is still accepted.

Tradeoffs

• I first mapped # references back to their component name, but went with the simpler rule (drop a restriction rather than add logic). The cost: a 3.2 document that names its schemes by URI loses them in 3.1, so code generators may build clients that do not send those credentials, and docs show the operation as open. The README states this as a limitation. oRPC writes component names only, so its output is unchanged.

Test plan

• New test: component names are kept (including one that looks like a URI), URI names are left out, and malformed security values stay as they are.
• vitest run packages/downgrader (301 passed) and pnpm check pass locally.

---

Generated by Claude Code

[codspeed]

Merging this PR will not alter performance

1 warning

⚠️ 1 benchmark is dominated by system calls

System calls cannot be simulated consistently and are left out of the measure. The reported value understates the real cost. Switch to the Walltime instrument to measure them.

Learn more about system calls

See affected benchmarks

✅ 29 untouched benchmarks
⏩ 2 skipped benchmarks¹

---

_{Comparing claude/project-thread-h3q238 (ab1cc0e) with main (cf0459b)}

Footnotes

1. 2 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[pullfrog]

✅ No new issues found.

Reviewed changes

• convertSecurity in the 3.2→3.1 converter — packages/downgrader/src/v3.2-to-v3.1.ts keeps only security requirement names that are own keys of #/components/securitySchemes, dropping URI references, and wires this into both the document and operation security fields.
• README — records the dropped-name behavior in the downgrade table and the limitations list.
• Tests — a new case covers component names (including one that looks like a URI), URI names, and malformed security values.

The logic matches OAS 3.2.1 §4.30 (a name or URI must resolve to a declared Security Scheme, with component-name matching taking precedence), and the documented "asks for less" tradeoff keeps every 3.2-accepted request accepted. pnpm vitest run packages/downgrader passes (301 tests).

  ^{｜ View workflow run ｜ Using deepseek-v4.1-flash (free via Pullfrog for OSS) ｜ 𝕏}