@@ -803,10 +803,10 @@ end
803
803
804
804
The Swagger UI on Grape could be secured from unauthorized access using any middleware, which provides certain methods:
805
805
806
- - a *before* method to be run in the Grape controller for authorization purpose;
806
+ - a *before* method to be run in the Grape controller for authorization purpose;
807
807
- some guard method, which could receive as argument a string or an array of authorization scopes;
808
808
- a method which processes and returns the access token received in the HTTP request headers (usually in the ' HTTP_AUTHORIZATION ' header).
809
-
809
+
810
810
Below are some examples of securing the Swagger UI on Grape installed along with Ruby on Rails:
811
811
812
812
- The WineBouncer and Doorkeeper gems are used in the examples;
@@ -828,9 +828,9 @@ This is how to configure the grape_swagger documentation:
828
828
829
829
The guard method should inject the Security Requirement Object into the endpoint' s route settings (see Grape ::DSL ::Settings .route_setting method).
830
830
831
- The ' oauth2 false' added to swagger_documentation is making the main Swagger endpoint protected with OAuth , i.e. it
831
+ The ' oauth2 false' added to swagger_documentation is making the main Swagger endpoint protected with OAuth , i.e. it
832
832
is retreiving the access_token from the HTTP request, but the ' false' scope is for skipping authorization and showing
833
- the UI for everyone. If the scope would be set to something else , like ' oauth2 admin' , for example, than the UI
833
+ the UI for everyone. If the scope would be set to something else , like ' oauth2 admin' , for example, than the UI
834
834
wouldn' t be displayed at all to unauthorized users.
835
835
836
836
Further on, the guard could be used, where necessary, for endpoint access protection. Put it prior to the endpoint' s method:
@@ -841,20 +841,20 @@ Further on, the guard could be used, where necessary, for endpoint access protec
841
841
get do
842
842
render_users
843
843
end
844
-
844
+
845
845
oauth2 'admin'
846
846
post do
847
847
User.create!...
848
848
end
849
849
end
850
850
` ` `
851
851
852
- And , finally, if you want to not only restrict the access, but to completely hide the endpoint from unauthorized
852
+ And , finally, if you want to not only restrict the access, but to completely hide the endpoint from unauthorized
853
853
users, you could pass a lambda to the :hidden key of a endpoint' s description:
854
-
854
+
855
855
```ruby
856
856
not_admins = lambda { |token=nil| token.nil? || !User.find(token.resource_owner_id).admin? }
857
-
857
+
858
858
resource :users do
859
859
desc ' Create user' , hidden: not_admins
860
860
oauth2 ' admin'
@@ -864,8 +864,8 @@ users, you could pass a lambda to the :hidden key of a endpoint's description:
864
864
end
865
865
```
866
866
867
- The lambda is checking whether the user is authenticated (if not, the token is nil by default), and has the admin
868
- role - only admins can see this endpoint.
867
+ The lambda is checking whether the user is authenticated (if not, the token is nil by default), and has the admin
868
+ role - only admins can see this endpoint.
869
869
870
870
<a name="md_usage" />
871
871
## Markdown in Detail
@@ -1122,15 +1122,20 @@ GrapeSwagger::Rake::OapiTasks.new(::Api::Base)
1122
1122
1123
1123
```
1124
1124
rake oapi:fetch
1125
- rake oapi:fetch store=true # writes to swagger_doc.json
1125
+ params:
1126
+ - store={ true | file_name } – save as JSON (optional)
1127
+ - resource=resource_name – get only for this one (optional)
1126
1128
```
1127
1129
1128
1130
#### OpenApi/Swagger Validation
1129
1131
1130
1132
**requires**: `npm` and `swagger-cli` to be installed
1131
1133
1134
+
1132
1135
```
1133
1136
rake oapi:validate
1137
+ params:
1138
+ - resource=resource_name – get only for this one (optional)
1134
1139
```
1135
1140
1136
1141
0 commit comments