@scalar/workspace-store 0.43.0 → 0.43.1

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @scalar/workspace-store
 
+## 0.43.1
+
+### Patch Changes
+
+- [#8728](https://github.com/scalar/scalar/pull/8728): fix: correctly merge security schemes with the config security
+
 ## 0.43.0
 
 ### Minor Changes

package/dist/request-example/context/get-request-example-context.d.ts

@@ -1,3 +1,4 @@
+import type { AuthenticationConfiguration } from '@scalar/types/api-reference';
 import type { WorkspaceStore } from '../../client.js';
 import type { SelectedSecurity } from '../../entities/auth/index.js';
 import type { AuthMeta, ServerMeta } from '../../events/index.js';
@@ -46,6 +47,8 @@ export declare const getRequestExampleContext: (workspaceStore: WorkspaceStore,
     layout: Layout;
     appVersion: string;
     isElectron: boolean;
+    /** User facing authentication configuration */
+    authentication: AuthenticationConfiguration;
     /**
      * When the document is not in `workspace.documents[documentName]` yet, use this copy (same shape as the
      * workspace entry). Callers that already hold the resolved document should pass it so behavior matches

package/dist/request-example/context/get-request-example-context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"get-request-example-context.d.ts","sourceRoot":"","sources":["../../../src/request-example/context/get-request-example-context.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAA;AAC9C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAA;AACvD,OAAO,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,UAAU,CAAA;AAEpD,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,iDAAiD,CAAA;AAIjG,OAAO,EAAE,KAAK,MAAM,EAAqB,MAAM,iCAAiC,CAAA;AAIhF,OAAO,EAAE,KAAK,qBAAqB,EAAiB,MAAM,mDAAmD,CAAA;AAE7G,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAA;AACzE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,qDAAqD,CAAA;AAC7F,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,+CAA+C,CAAA;AAClF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAA;AACtE,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,4CAA4C,CAAA;AAC3F,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAA;AAChE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AAE5D,KAAK,0BAA0B,GAAG;IAChC,SAAS,EAAE,eAAe,CAAA;IAC1B,WAAW,EAAE;QACX,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;QACnB,WAAW,EAAE,kBAAkB,CAAA;KAChC,CAAA;IACD,OAAO,EAAE;QACP,SAAS,EAAE,aAAa,EAAE,CAAA;QAC1B,QAAQ,EAAE,aAAa,EAAE,CAAA;KAC1B,CAAA;IACD,OAAO,EAAE;QACP,IAAI,EAAE,YAAY,EAAE,CAAA;QACpB,QAAQ,EAAE,YAAY,GAAG,IAAI,CAAA;QAC7B,IAAI,EAAE,UAAU,CAAA;KACjB,CAAA;IACD,KAAK,EAAE;QACL,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;KACnB,CAAA;IACD,OAAO,EAAE;QACP,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAChC,CAAA;IACD,QAAQ,EAAE;QACR,OAAO,EAAE,qBAAqB,CAAA;QAC9B,YAAY,EAAE,yBAAyB,EAAE,CAAA;QACzC,QAAQ,EAAE,gBAAgB,CAAA;QAC1B,eAAe,EAAE,0BAA0B,EAAE,CAAA;QAC7C,IAAI,EAAE,QAAQ,CAAA;KACf,CAAA;CACF,CAAA;AAED,eAAO,MAAM,wBAAwB,GACnC,gBAAgB,cAAc,EAC9B,cAAc,MAAM,EACpB,oBAAoB,kBAAkB,EACtC,UAAS,OAAO,CAAC;IACf,OAAO,EAAE,YAAY,EAAE,CAAA;IACvB,aAAa,EAAE,MAAM,CAAA;IACrB,MAAM,EAAE,MAAM,CAAA;IACd,UAAU,EAAE,MAAM,CAAA;IAClB,UAAU,EAAE,OAAO,CAAA;IACnB;;;;OAIG;IACH,gBAAgB,EAAE,iBAAiB,GAAG,IAAI,CAAA;CAC3C,CAAM,KACN,MAAM,CAAC,0BAA0B,CAmInC,CAAA"}
+{"version":3,"file":"get-request-example-context.d.ts","sourceRoot":"","sources":["../../../src/request-example/context/get-request-example-context.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,6BAA6B,CAAA;AAE9E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAA;AAC9C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAA;AACvD,OAAO,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,UAAU,CAAA;AAEpD,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,iDAAiD,CAAA;AAIjG,OAAO,EAAE,KAAK,MAAM,EAAqB,MAAM,iCAAiC,CAAA;AAIhF,OAAO,EAAE,KAAK,qBAAqB,EAAiB,MAAM,mDAAmD,CAAA;AAE7G,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAA;AACzE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,qDAAqD,CAAA;AAC7F,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,+CAA+C,CAAA;AAClF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAA;AACtE,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,4CAA4C,CAAA;AAC3F,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAA;AAChE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AAE5D,KAAK,0BAA0B,GAAG;IAChC,SAAS,EAAE,eAAe,CAAA;IAC1B,WAAW,EAAE;QACX,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;QACnB,WAAW,EAAE,kBAAkB,CAAA;KAChC,CAAA;IACD,OAAO,EAAE;QACP,SAAS,EAAE,aAAa,EAAE,CAAA;QAC1B,QAAQ,EAAE,aAAa,EAAE,CAAA;KAC1B,CAAA;IACD,OAAO,EAAE;QACP,IAAI,EAAE,YAAY,EAAE,CAAA;QACpB,QAAQ,EAAE,YAAY,GAAG,IAAI,CAAA;QAC7B,IAAI,EAAE,UAAU,CAAA;KACjB,CAAA;IACD,KAAK,EAAE;QACL,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;KACnB,CAAA;IACD,OAAO,EAAE;QACP,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAChC,CAAA;IACD,QAAQ,EAAE;QACR,OAAO,EAAE,qBAAqB,CAAA;QAC9B,YAAY,EAAE,yBAAyB,EAAE,CAAA;QACzC,QAAQ,EAAE,gBAAgB,CAAA;QAC1B,eAAe,EAAE,0BAA0B,EAAE,CAAA;QAC7C,IAAI,EAAE,QAAQ,CAAA;KACf,CAAA;CACF,CAAA;AAED,eAAO,MAAM,wBAAwB,GACnC,gBAAgB,cAAc,EAC9B,cAAc,MAAM,EACpB,oBAAoB,kBAAkB,EACtC,UAAS,OAAO,CAAC;IACf,OAAO,EAAE,YAAY,EAAE,CAAA;IACvB,aAAa,EAAE,MAAM,CAAA;IACrB,MAAM,EAAE,MAAM,CAAA;IACd,UAAU,EAAE,MAAM,CAAA;IAClB,UAAU,EAAE,OAAO,CAAA;IACnB,+CAA+C;IAC/C,cAAc,EAAE,2BAA2B,CAAA;IAC3C;;;;OAIG;IACH,gBAAgB,EAAE,iBAAiB,GAAG,IAAI,CAAA;CAC3C,CAAM,KACN,MAAM,CAAC,0BAA0B,CAoInC,CAAA"}

package/dist/request-example/context/get-request-example-context.js

@@ -63,9 +63,9 @@ export const getRequestExampleContext = (workspaceStore, documentName, requestEx
         path: path ?? '',
         method: method ?? 'get',
     });
-    const securitySchemes = mergeSecurity(document.components?.securitySchemes ?? {}, {}, workspaceStore.auth, documentName);
+    const securitySchemes = mergeSecurity(document.components?.securitySchemes ?? {}, options.authentication?.securitySchemes ?? {}, workspaceStore.auth, documentName);
     const securityRequirements = getSecurityRequirements(document.security, operation.security);
-    const selectedSecurity = getSelectedSecurity(documentSelectedSecurity, operationSelectedSecurity, securityRequirements, securitySchemes);
+    const selectedSecurity = getSelectedSecurity(documentSelectedSecurity, operationSelectedSecurity, securityRequirements, securitySchemes, options.authentication?.preferredSecurityScheme);
     /** The above selected requirements in scheme form */
     const selectedSecuritySchemes = getSecuritySchemes(securitySchemes, selectedSecurity.selectedSchemes);
     const serverMeta = operation.servers != null ? { type: 'operation', path: path ?? '', method: method ?? 'get' } : { type: 'document' };

package/dist/request-example/context/security/get-selected-security.d.ts

@@ -1,3 +1,4 @@
+import type { AuthenticationConfiguration } from '@scalar/types/api-reference';
 import type { SelectedSecurity } from '@scalar/workspace-store/entities/auth';
 import type { OpenApiDocument } from '@scalar/workspace-store/schemas/v3.1/strict/openapi-document';
 type DefaultScopeScheme = {
@@ -6,10 +7,14 @@ type DefaultScopeScheme = {
 };
 /**
  * Resolves which security selection to use for an operation.
- * Priority: operation-level selection, then document-level selection, then a default.
- * When neither level has a selection, returns the first security requirement unless
- * authentication is optional or there are no requirements, in which case returns no selection.
+ *
+ * Priority order:
+ * 1. Operation-level selection (if set)
+ * 2. Document-level selection (if set)
+ * 3. Preferred security scheme from configuration (if provided)
+ * 4. First security requirement from the OpenAPI spec
+ * 5. No selection (if auth is optional or no requirements exist)
  */
-export declare const getSelectedSecurity: (documentSelectedSecurity: SelectedSecurity | undefined, operationSelectedSecurity: SelectedSecurity | undefined, securityRequirements?: NonNullable<OpenApiDocument["security"]>, securitySchemes?: Record<string, DefaultScopeScheme | undefined>) => SelectedSecurity;
+export declare const getSelectedSecurity: (documentSelectedSecurity: SelectedSecurity | undefined, operationSelectedSecurity: SelectedSecurity | undefined, securityRequirements?: NonNullable<OpenApiDocument["security"]>, securitySchemes?: Record<string, DefaultScopeScheme | undefined>, preferredSecurityScheme?: AuthenticationConfiguration["preferredSecurityScheme"]) => SelectedSecurity;
 export {};
 //# sourceMappingURL=get-selected-security.d.ts.map

package/dist/request-example/context/security/get-selected-security.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"get-selected-security.d.ts","sourceRoot":"","sources":["../../../../src/request-example/context/security/get-selected-security.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAA;AAE7E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8DAA8D,CAAA;AAInG,KAAK,kBAAkB,GAAG;IACxB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAA;CAC9B,CAAA;AA4BD;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,GAC9B,0BAA0B,gBAAgB,GAAG,SAAS,EACtD,2BAA2B,gBAAgB,GAAG,SAAS,EACvD,uBAAsB,WAAW,CAAC,eAAe,CAAC,UAAU,CAAC,CAAM,EACnE,kBAAiB,MAAM,CAAC,MAAM,EAAE,kBAAkB,GAAG,SAAS,CAAM,KACnE,gBA4BF,CAAA"}
+{"version":3,"file":"get-selected-security.d.ts","sourceRoot":"","sources":["../../../../src/request-example/context/security/get-selected-security.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,6BAA6B,CAAA;AAC9E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAA;AAE7E,OAAO,KAAK,EACV,eAAe,EAEhB,MAAM,8DAA8D,CAAA;AAIrE,KAAK,kBAAkB,GAAG;IACxB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAA;CAC9B,CAAA;AAkED;;;;;;;;;GASG;AACH,eAAO,MAAM,mBAAmB,GAC9B,0BAA0B,gBAAgB,GAAG,SAAS,EACtD,2BAA2B,gBAAgB,GAAG,SAAS,EACvD,uBAAsB,WAAW,CAAC,eAAe,CAAC,UAAU,CAAC,CAAM,EACnE,kBAAiB,MAAM,CAAC,MAAM,EAAE,kBAAkB,GAAG,SAAS,CAAM,EACpE,0BAA0B,2BAA2B,CAAC,yBAAyB,CAAC,KAC/E,gBAgDF,CAAA"}

package/dist/request-example/context/security/get-selected-security.js

@@ -1,5 +1,12 @@
 import { getResolvedRef } from '@scalar/workspace-store/helpers/get-resolved-ref';
 import { isAuthOptional } from './is-auth-optional.js';
+/** Extracts the default scopes for a security scheme (only OAuth2 schemes support this) */
+const getDefaultScopes = (scheme) => {
+    if (!scheme || scheme.type !== 'oauth2') {
+        return [];
+    }
+    return scheme['x-default-scopes'] ?? [];
+};
 const applyDefaultScopes = (requirement, securitySchemes) => {
     let didApplyDefaultScopes = false;
     const hydratedRequirement = Object.fromEntries(Object.entries(requirement).map(([name, scopes]) => {
@@ -16,25 +23,68 @@ const applyDefaultScopes = (requirement, securitySchemes) => {
     }));
     return didApplyDefaultScopes ? hydratedRequirement : requirement;
 };
+/**
+ * Builds a security requirement from the preferred security scheme configuration.
+ * Handles both string and array formats for complex auth scenarios.
+ */
+const buildSecurityRequirementFromPreferred = (preferredSecurityScheme, securitySchemes) => {
+    if (!Array.isArray(preferredSecurityScheme)) {
+        const scheme = getResolvedRef(securitySchemes[preferredSecurityScheme]);
+        return { [preferredSecurityScheme]: getDefaultScopes(scheme) };
+    }
+    const requirement = {};
+    for (const item of preferredSecurityScheme) {
+        if (Array.isArray(item)) {
+            for (const schemeName of item) {
+                const scheme = getResolvedRef(securitySchemes[schemeName]);
+                requirement[schemeName] = getDefaultScopes(scheme);
+            }
+        }
+        else {
+            const scheme = getResolvedRef(securitySchemes[item]);
+            requirement[item] = getDefaultScopes(scheme);
+        }
+    }
+    return requirement;
+};
 /**
  * Resolves which security selection to use for an operation.
- * Priority: operation-level selection, then document-level selection, then a default.
- * When neither level has a selection, returns the first security requirement unless
- * authentication is optional or there are no requirements, in which case returns no selection.
+ *
+ * Priority order:
+ * 1. Operation-level selection (if set)
+ * 2. Document-level selection (if set)
+ * 3. Preferred security scheme from configuration (if provided)
+ * 4. First security requirement from the OpenAPI spec
+ * 5. No selection (if auth is optional or no requirements exist)
  */
-export const getSelectedSecurity = (documentSelectedSecurity, operationSelectedSecurity, securityRequirements = [], securitySchemes = {}) => {
-    // Operation level security
+export const getSelectedSecurity = (documentSelectedSecurity, operationSelectedSecurity, securityRequirements = [], securitySchemes = {}, preferredSecurityScheme) => {
+    // Operation level security takes highest priority
     if (operationSelectedSecurity) {
         return operationSelectedSecurity;
     }
-    // Document level security
+    // Document level security is next
     if (documentSelectedSecurity) {
         return documentSelectedSecurity;
     }
     const isOptional = isAuthOptional(securityRequirements);
+    // No need to default if auth is optional and no preferred scheme
+    if (isOptional && !preferredSecurityScheme) {
+        return {
+            selectedIndex: -1,
+            selectedSchemes: [],
+        };
+    }
+    // Use preferred security scheme if configured
+    if (preferredSecurityScheme) {
+        const requirement = buildSecurityRequirementFromPreferred(preferredSecurityScheme, securitySchemes);
+        return {
+            selectedIndex: 0,
+            selectedSchemes: [requirement],
+        };
+    }
     const firstRequirement = securityRequirements[0];
-    // No need to default if auth is optional
-    if (isOptional || !firstRequirement) {
+    // No requirements and no preferred scheme
+    if (!firstRequirement) {
         return {
             selectedIndex: -1,
             selectedSchemes: [],

package/package.json

@@ -16,7 +16,7 @@
     "openapi",
     "scalar"
   ],
-  "version": "0.43.0",
+  "version": "0.43.1",
   "engines": {
     "node": ">=22"
   },
@@ -147,8 +147,8 @@
     "@scalar/helpers": "0.4.3",
     "@scalar/json-magic": "0.12.5",
     "@scalar/openapi-upgrader": "0.2.4",
-    "@scalar/types": "0.7.6",
     "@scalar/snippetz": "0.7.8",
+    "@scalar/types": "0.7.6",
     "@scalar/validation": "0.3.0"
   },
   "devDependencies": {