@seshuk/payload-plugin-openapi 0.1.0 → 0.2.0

package/README.md

@@ -33,6 +33,7 @@
   - [OpenAPI Version](#openapi-version)
   - [Filters](#filters)
   - [Interactive Auth](#interactive-auth)
+  - [Security Marking](#security-marking)
   - [Caching](#caching)
 - [Docs UI](#docs-ui)
 - [Documenting Custom Endpoints](#documenting-custom-endpoints)
@@ -99,18 +100,19 @@ Prefer Swagger UI? Swap `scalar()` for `swaggerUi()` — or mount both on differ
 
 ### Plugin Options
 
-| Option            | Type                      | Default           | Description                                                                                                                |
-| ----------------- | ------------------------- | ----------------- | -------------------------------------------------------------------------------------------------------------------------- |
-| `metadata`        | `OpenApiMetadata`         | —                 | API title, version, and description. **Required.**                                                                         |
-| `openapiVersion`  | `'3.0' \| '3.1' \| '3.2'` | `'3.2'`           | Spec version to serve                                                                                                      |
-| `specEndpoint`    | `string`                  | `'/openapi.json'` | Path the spec is served from (relative to the API route)                                                                   |
-| `enabled`         | `boolean`                 | `true`            | Set `false` to disable the plugin entirely                                                                                 |
-| `serve`           | `boolean`                 | `true`            | Set `false` to register only the CLI generator and serve nothing over HTTP ([details](#generate-only-no-runtime-endpoint)) |
-| `filters`         | `FilterOptions`           | see below         | Which entities and operations to document ([details](#filters))                                                            |
-| `interactiveAuth` | `boolean \| { endpoint }` | `false`           | Username/password login for the docs UI                                                                                    |
-| `nestedTags`      | `boolean`                 | `false`           | Emit an OpenAPI 3.2 nested tag hierarchy (see below)                                                                       |
-| `cache`           | `boolean`                 | `true`            | Cache the built document for the life of the process                                                                       |
-| `extensions`      | `OpenApiExtension[]`      | `[]`              | Inject paths, components, tags, or transform the document                                                                  |
+| Option            | Type                            | Default           | Description                                                                                                                |
+| ----------------- | ------------------------------- | ----------------- | -------------------------------------------------------------------------------------------------------------------------- |
+| `metadata`        | `OpenApiMetadata`               | —                 | API title, version, and description. **Required.**                                                                         |
+| `openapiVersion`  | `'3.0' \| '3.1' \| '3.2'`       | `'3.2'`           | Spec version to serve                                                                                                      |
+| `specEndpoint`    | `string`                        | `'/openapi.json'` | Path the spec is served from (relative to the API route)                                                                   |
+| `enabled`         | `boolean`                       | `true`            | Set `false` to disable the plugin entirely                                                                                 |
+| `serve`           | `boolean`                       | `true`            | Set `false` to register only the CLI generator and serve nothing over HTTP ([details](#generate-only-no-runtime-endpoint)) |
+| `filters`         | `FilterOptions`                 | see below         | Which entities and operations to document ([details](#filters))                                                            |
+| `interactiveAuth` | `boolean \| { endpoint }`       | `false`           | Username/password login for the docs UI                                                                                    |
+| `nestedTags`      | `boolean`                       | `false`           | Emit an OpenAPI 3.2 nested tag hierarchy (see below)                                                                       |
+| `securityWhen`    | `(ctx) => boolean \| undefined` | —                 | Override the auto-detected security marking per operation ([details](#security-marking))                                   |
+| `cache`           | `boolean`                       | `true`            | Cache the built document for the life of the process                                                                       |
+| `extensions`      | `OpenApiExtension[]`            | `[]`              | Inject paths, components, tags, or transform the document                                                                  |
 
 ### Metadata
 
@@ -267,6 +269,47 @@ The endpoint logs in against your first auth-enabled collection (falling back to
 > [!WARNING]
 > The interactive auth endpoint exchanges credentials for a live JWT. Only enable it on docs you intend real users to authenticate against, and serve them over HTTPS.
 
+### Security Marking
+
+Each operation in the spec is marked either public or secured (referencing the `PayloadToken` scheme). The marking is a **static hint**, not a live access check — it tells a reader which endpoints need a token.
+
+By default the plugin figures this out per operation by probing your Payload access functions as an **anonymous request** (`user: null`): an operation is marked public only if its access function settles on `true`. The probe is deliberately conservative:
+
+- An `async` access function is awaited — `async () => true` is correctly public.
+- A function that returns a `Where` query (partial access), throws, or times out is marked secured.
+- A function that reaches into the database (`req.payload.find(...)`) is marked secured — the probe never runs live queries, so DB-driven access always errs on the side of a padlock.
+
+The marking is per operation: `read` covers list/find-by-id/count, `create` covers create/duplicate, `update` covers update and bulk update, `delete` covers delete and bulk delete.
+
+When the guess is wrong, override it — two ways, override wins over the probe:
+
+**Per entity, with `custom.openapi.security`** on a collection or global:
+
+```ts
+export const Posts: CollectionConfig = {
+  slug: 'posts',
+  custom: {
+    openapi: {
+      // true → all operations public; false → all secured; or per operation:
+      security: { read: true, create: false, update: false, delete: false },
+    },
+  },
+  // ...
+}
+```
+
+**Across the whole document, with `securityWhen`** — an escape hatch mirroring `filters.excludeWhen`. Return `true` to mark an operation public, `false` to mark it secured, or `undefined` to keep the detected marking. It runs last, after `custom.openapi.security` and the probe, over collection, global, auth, and version operations alike:
+
+```ts
+openapi({
+  metadata: { title: 'My API', version: '1.0.0' },
+  securityWhen: ({ slug, method }) => (slug === 'public-feed' && method === 'get' ? true : undefined),
+})
+```
+
+> [!NOTE]
+> This is public-access marking only — the plugin never runs per-user access checks. The generated spec matches what the HTTP endpoint enforces at runtime; the marking just documents it.
+
 ### Caching
 
 The Payload config is static after boot, so the document is identical on every request apart from the server URL (which is always filled in fresh). Caching is on by default. Disable it in development so edits to your config show up without a restart:

package/dist/index.d.ts

@@ -6,4 +6,4 @@ export type { BuildOpenApiInput } from './spec/build.js';
 export { toOpenApi30, toOpenApi31 } from './spec/downconvert.js';
 export { scalar } from './ui/scalar.js';
 export { swaggerUi } from './ui/swagger.js';
-export type { BuildContext, FilterOptions, OpenApiExtension, OpenApiMetadata, OpenApiPluginOptions, OpenApiVersion, UiPluginOptions, } from './types.js';
+export type { BuildContext, EntityOperation, EntitySecurityOverride, FilterOptions, OpenApiExtension, OpenApiMetadata, OpenApiPluginOptions, OpenApiVersion, OperationContext, UiPluginOptions, } from './types.js';

package/dist/options.js

@@ -37,6 +37,7 @@ const resolveOptions = (options)=>{
         filters: resolveFilters(options.filters),
         interactiveAuth: resolveInteractiveAuth(options.interactiveAuth),
         nestedTags: options.nestedTags ?? false,
+        securityWhen: options.securityWhen,
         cache: options.cache ?? true,
         extensions: options.extensions ?? []
     };

package/dist/spec/buildDocument.js

@@ -7,6 +7,7 @@ import { buildBlockSchema, buildEntitySchemas } from "./entitySchemas.js";
 import { filterOperations, shouldIncludeCollection, shouldIncludeGlobal } from "./filters.js";
 import { blockSchemaName, createSchemaName, globalSchemaName, joinsSchemaName, listSchemaName, populateSchemaName, querySchemaName, schemaName, selectSchemaName, updateSchemaName } from "./names.js";
 import { buildParamSchemas, buildQueryOperationsSchema, collectionHasFilters } from "./params.js";
+import { applySecurityWhen, resolveEntitySecurity } from "./security.js";
 import { buildTagHierarchy } from "./tags.js";
 import { buildAuthPaths } from "./paths/auth.js";
 import { buildCollectionPaths } from "./paths/collections.js";
@@ -66,10 +67,21 @@ const buildDocument = async (input)=>{
             ctx
         });
         registerParamSchemas(schemas, base, collection.fields, ctx);
+        const security = await resolveEntitySecurity({
+            entity: collection,
+            operations: [
+                'read',
+                'create',
+                'update',
+                'delete'
+            ],
+            locale: ctx.locales[0]
+        });
         const collectionPaths = {
             ...buildCollectionPaths({
                 collection,
-                ctx
+                ctx,
+                security
             })
         };
         if (filters.includeAuth) Object.assign(collectionPaths, buildAuthPaths({
@@ -94,11 +106,17 @@ const buildDocument = async (input)=>{
                 nestedTags: options.nestedTags
             }));
         }
-        Object.assign(paths, filterOperations({
+        const filteredCollectionPaths = filterOperations({
             paths: collectionPaths,
             slug: collection.slug,
             kind: 'collection',
             filters
+        });
+        Object.assign(paths, applySecurityWhen({
+            paths: filteredCollectionPaths,
+            slug: collection.slug,
+            kind: 'collection',
+            securityWhen: options.securityWhen
         }));
     } catch (error) {
         logger.warn(`${PLUGIN_NAME}: skipped collection "${collection.slug}": ${error.message}`);
@@ -118,10 +136,19 @@ const buildDocument = async (input)=>{
         schemas[gbase] = read;
         schemas[updateSchemaName(gbase)] = update;
         registerParamSchemas(schemas, gbase, global.fields, ctx);
+        const security = await resolveEntitySecurity({
+            entity: global,
+            operations: [
+                'read',
+                'update'
+            ],
+            locale: ctx.locales[0]
+        });
         const globalPaths = {
             ...buildGlobalPaths({
                 global,
-                ctx
+                ctx,
+                security
             })
         };
         if (filters.includeVersions && global.versions) {
@@ -140,11 +167,17 @@ const buildDocument = async (input)=>{
                 nestedTags: options.nestedTags
             }));
         }
-        Object.assign(paths, filterOperations({
+        const filteredGlobalPaths = filterOperations({
             paths: globalPaths,
             slug: global.slug,
             kind: 'global',
             filters
+        });
+        Object.assign(paths, applySecurityWhen({
+            paths: filteredGlobalPaths,
+            slug: global.slug,
+            kind: 'global',
+            securityWhen: options.securityWhen
         }));
     } catch (error) {
         logger.warn(`${PLUGIN_NAME}: skipped global "${global.slug}": ${error.message}`);

package/dist/spec/components.d.ts

@@ -1,4 +1,3 @@
-import type { Access } from 'payload';
 import type { ReferenceObject, RequestBodyObject, ResponseObject, ResponsesObject, SchemaObject, SecuritySchemeObject } from '@scalar/openapi-types/3.2';
 import type { Translate } from '../translations/types.js';
 type SchemaOrRef = SchemaObject | ReferenceObject;
@@ -42,5 +41,4 @@ export declare const securityScheme: ({ cookiePrefix, t }: {
     cookiePrefix: string;
     t: Translate;
 }) => SecuritySchemeObject;
-export declare const isOpenToPublic: (access: Access | undefined) => boolean;
 export {};

package/dist/spec/components.js

@@ -262,19 +262,4 @@ const securityScheme = ({ cookiePrefix, t })=>({
             cookiePrefix
         })
     });
-const isOpenToPublic = (access)=>{
-    if (!access) return true;
-    const trap = new Proxy({}, {
-        get () {
-            throw new Error('req accessed');
-        }
-    });
-    try {
-        return true === access({
-            req: trap
-        });
-    } catch  {
-        return false;
-    }
-};
-export { ERRORS, ERROR_SCHEMA_NAME, INTERACTIVE_SCHEME_NAME, SECURITY_SCHEME_NAME, buildErrorResponseSchema, buildListEnvelopeSchema, errorResponses, interactiveSecurityScheme, isOpenToPublic, jsonBody, jsonOk, jsonResponse, messageResponse, nullableType, securityScheme, uploadRequestBody };
+export { ERRORS, ERROR_SCHEMA_NAME, INTERACTIVE_SCHEME_NAME, SECURITY_SCHEME_NAME, buildErrorResponseSchema, buildListEnvelopeSchema, errorResponses, interactiveSecurityScheme, jsonBody, jsonOk, jsonResponse, messageResponse, nullableType, securityScheme, uploadRequestBody };

package/dist/spec/filters.js

@@ -20,8 +20,15 @@ const matchesEntity = (matcher, { slug, kind })=>{
 const anyMatch = (matchers, entity)=>matchers.some((m)=>matchesEntity(m, entity));
 const isHiddenCollection = (collection)=>{
     if (true === collection.hidden) return true;
-    const adminHidden = collection.admin?.hidden;
-    return true === adminHidden || 'function' == typeof adminHidden;
+    const hidden = collection.admin?.hidden;
+    if ('function' == typeof hidden) try {
+        return true === hidden({
+            user: null
+        });
+    } catch  {
+        return false;
+    }
+    return true === hidden;
 };
 const passesIncludeExclude = (entity, filters)=>{
     if (filters.include.length > 0 && !anyMatch(filters.include, entity)) return false;

package/dist/spec/paths/collections.d.ts

@@ -1,7 +1,9 @@
 import type { SanitizedCollectionConfig } from 'payload';
 import type { PathsObject } from '@scalar/openapi-types/3.2';
 import type { BuildContext } from '../../types.js';
-export declare const buildCollectionPaths: ({ collection, ctx, }: {
+import type { EntitySecurity } from '../security.js';
+export declare const buildCollectionPaths: ({ collection, ctx, security, }: {
     collection: SanitizedCollectionConfig;
     ctx: BuildContext;
+    security?: EntitySecurity;
 }) => PathsObject;

package/dist/spec/paths/collections.js

@@ -1,8 +1,8 @@
 import { makeT } from "../../translations/index.js";
-import { ERRORS, SECURITY_SCHEME_NAME, errorResponses, isOpenToPublic, jsonOk, uploadRequestBody } from "../components.js";
+import { ERRORS, errorResponses, jsonOk, uploadRequestBody } from "../components.js";
 import { createSchemaName, listSchemaName, refTo, schemaName, updateSchemaName } from "../names.js";
 import { buildListParams, buildParamSchemas, commonReadParams } from "../params.js";
-const buildCollectionPaths = ({ collection, ctx })=>{
+const buildCollectionPaths = ({ collection, ctx, security = {} })=>{
     const t = makeT(ctx.i18n);
     const name = schemaName(collection.slug);
     const base = `${ctx.apiRoute}/${collection.slug}`;
@@ -19,11 +19,7 @@ const buildCollectionPaths = ({ collection, ctx })=>{
         $ref: refTo(updateSchemaName(name))
     };
     const idType = 'number' === ctx.defaultIDType ? 'integer' : 'string';
-    const secured = isOpenToPublic(collection.access?.read) ? void 0 : [
-        {
-            [SECURITY_SCHEME_NAME]: []
-        }
-    ];
+    const { read: secRead, create: secCreate, update: secUpdate, delete: secDelete } = security;
     const allowBulk = true !== collection.disableBulkEdit;
     const allowDuplicate = true !== collection.disableDuplicate;
     const paramSchemas = buildParamSchemas({
@@ -140,7 +136,7 @@ const buildCollectionPaths = ({ collection, ctx })=>{
             parameters: bulkParams,
             requestBody: requestBody(updateRef, false),
             responses: bulkUpdateResponse,
-            security: secured
+            security: secUpdate
         },
         delete: {
             tags: [
@@ -149,7 +145,7 @@ const buildCollectionPaths = ({ collection, ctx })=>{
             operationId: `delete${name}`,
             parameters: bulkParams,
             responses: bulkDeleteResponse,
-            security: secured
+            security: secDelete
         }
     } : {};
     const paths = {
@@ -166,7 +162,7 @@ const buildCollectionPaths = ({ collection, ctx })=>{
                     refs
                 }),
                 responses: listResponse,
-                security: secured
+                security: secRead
             },
             post: {
                 tags: [
@@ -175,7 +171,7 @@ const buildCollectionPaths = ({ collection, ctx })=>{
                 operationId: `create${name}`,
                 requestBody: requestBody(createRef, fileRequiredOnCreate),
                 responses: createResponse,
-                security: secured
+                security: secCreate
             },
             ...bulkOps
         },
@@ -187,7 +183,7 @@ const buildCollectionPaths = ({ collection, ctx })=>{
                 operationId: `count${name}`,
                 parameters: bulkParams,
                 responses: countResponse,
-                security: secured
+                security: secRead
             }
         },
         [`${base}/{id}`]: {
@@ -212,7 +208,7 @@ const buildCollectionPaths = ({ collection, ctx })=>{
                     refs
                 }),
                 responses: findByIdResponse,
-                security: secured
+                security: secRead
             },
             patch: {
                 tags: [
@@ -221,7 +217,7 @@ const buildCollectionPaths = ({ collection, ctx })=>{
                 operationId: `update${name}ById`,
                 requestBody: requestBody(updateRef, false),
                 responses: updateResponse,
-                security: secured
+                security: secUpdate
             },
             delete: {
                 tags: [
@@ -229,7 +225,7 @@ const buildCollectionPaths = ({ collection, ctx })=>{
                 ],
                 operationId: `delete${name}ById`,
                 responses: deleteResponse,
-                security: secured
+                security: secDelete
             }
         }
     };
@@ -253,7 +249,7 @@ const buildCollectionPaths = ({ collection, ctx })=>{
                 ...jsonOk(t('collectionDuplicated'), mutationSchema),
                 ...errorResponses(ERRORS.create, t)
             },
-            security: secured
+            security: secCreate
         }
     };
     return paths;

package/dist/spec/paths/globals.d.ts

@@ -1,7 +1,9 @@
 import type { SanitizedGlobalConfig } from 'payload';
 import type { PathsObject } from '@scalar/openapi-types/3.2';
 import type { BuildContext } from '../../types.js';
-export declare const buildGlobalPaths: ({ global, ctx, }: {
+import type { EntitySecurity } from '../security.js';
+export declare const buildGlobalPaths: ({ global, ctx, security, }: {
     global: SanitizedGlobalConfig;
     ctx: BuildContext;
+    security?: EntitySecurity;
 }) => PathsObject;

package/dist/spec/paths/globals.js

@@ -1,8 +1,8 @@
 import { makeT } from "../../translations/index.js";
-import { ERRORS, SECURITY_SCHEME_NAME, errorResponses, isOpenToPublic, jsonOk } from "../components.js";
+import { ERRORS, errorResponses, jsonOk } from "../components.js";
 import { globalSchemaName, refTo, updateSchemaName } from "../names.js";
 import { buildParamSchemas, commonReadParams } from "../params.js";
-const buildGlobalPaths = ({ global, ctx })=>{
+const buildGlobalPaths = ({ global, ctx, security = {} })=>{
     const t = makeT(ctx.i18n);
     const name = globalSchemaName(global.slug);
     const docRef = {
@@ -11,11 +11,7 @@ const buildGlobalPaths = ({ global, ctx })=>{
     const updateRef = {
         $ref: refTo(updateSchemaName(name))
     };
-    const secured = isOpenToPublic(global.access?.read) ? void 0 : [
-        {
-            [SECURITY_SCHEME_NAME]: []
-        }
-    ];
+    const { read: secRead, update: secUpdate } = security;
     const paramSchemas = buildParamSchemas({
         fields: global.fields,
         ctx
@@ -42,7 +38,7 @@ const buildGlobalPaths = ({ global, ctx })=>{
                     ...okDoc,
                     ...errorResponses(ERRORS.globalRead, t)
                 },
-                security: secured
+                security: secRead
             },
             post: {
                 tags: [
@@ -60,7 +56,7 @@ const buildGlobalPaths = ({ global, ctx })=>{
                     ...okDoc,
                     ...errorResponses(ERRORS.globalUpdate, t)
                 },
-                security: secured
+                security: secUpdate
             }
         }
     };

package/dist/spec/security.d.ts

@@ -0,0 +1,19 @@
+import type { Access } from 'payload';
+import type { PathsObject, SecurityRequirementObject } from '@scalar/openapi-types/3.2';
+import type { Entity, EntityKind, EntityOperation, OperationContext } from '../types.js';
+export type EntitySecurity = Partial<Record<EntityOperation, SecurityRequirementObject[] | undefined>>;
+export declare const evaluateAccess: (access: Access | undefined, opts?: {
+    locale?: string;
+    timeoutMs?: number;
+}) => Promise<boolean>;
+export declare const resolveEntitySecurity: ({ entity, operations, locale, }: {
+    entity: Entity;
+    operations: EntityOperation[];
+    locale?: string;
+}) => Promise<EntitySecurity>;
+export declare const applySecurityWhen: ({ paths, slug, kind, securityWhen, }: {
+    paths: PathsObject;
+    slug: string;
+    kind: EntityKind;
+    securityWhen?: (ctx: OperationContext) => boolean | undefined;
+}) => PathsObject;

package/dist/spec/security.js

@@ -0,0 +1,96 @@
+import { SECURITY_SCHEME_NAME } from "./components.js";
+const HTTP_METHODS = [
+    'get',
+    'post',
+    'patch',
+    'put',
+    'delete'
+];
+const securedRequirement = ()=>[
+        {
+            [SECURITY_SCHEME_NAME]: []
+        }
+    ];
+const withTimeout = async (promise, timeoutMs)=>{
+    let timer;
+    const guard = new Promise((resolve)=>{
+        timer = setTimeout(()=>resolve(false), timeoutMs);
+    });
+    try {
+        return await Promise.race([
+            promise.then((value)=>true === value, ()=>false),
+            guard
+        ]);
+    } finally{
+        if (timer) clearTimeout(timer);
+    }
+};
+const evaluateAccess = async (access, opts = {})=>{
+    if (!access) return false;
+    const { locale, timeoutMs = 250 } = opts;
+    const payloadTrap = new Proxy({}, {
+        get () {
+            throw new Error('req.payload accessed during build');
+        }
+    });
+    const req = {
+        user: null,
+        headers: new Headers(),
+        context: {},
+        locale,
+        payload: payloadTrap
+    };
+    try {
+        const result = access({
+            req
+        });
+        if (result && 'function' == typeof result.then) return await withTimeout(result, timeoutMs);
+        return true === result;
+    } catch  {
+        return false;
+    }
+};
+const readSecurityOverride = (entity)=>{
+    const meta = entity.custom?.openapi?.security;
+    if ('boolean' == typeof meta) return meta;
+    if (meta && 'object' == typeof meta) return meta;
+};
+const overrideFor = (override, op)=>{
+    if (void 0 === override) return;
+    if ('boolean' == typeof override) return override;
+    return override[op];
+};
+const resolveEntitySecurity = async ({ entity, operations, locale })=>{
+    const override = readSecurityOverride(entity);
+    const access = entity.access;
+    const out = {};
+    for (const op of operations){
+        const declared = overrideFor(override, op);
+        const isPublic = declared ?? await evaluateAccess(access?.[op], {
+            locale
+        });
+        out[op] = isPublic ? void 0 : securedRequirement();
+    }
+    return out;
+};
+const applySecurityWhen = ({ paths, slug, kind, securityWhen })=>{
+    if (!securityWhen) return paths;
+    for (const [path, item] of Object.entries(paths)){
+        if (!item) continue;
+        const ops = item;
+        for (const method of HTTP_METHODS){
+            const op = ops[method];
+            if (!op) continue;
+            const decision = securityWhen({
+                method,
+                path,
+                slug,
+                kind
+            });
+            if (true === decision) delete op.security;
+            else if (false === decision) op.security = securedRequirement();
+        }
+    }
+    return paths;
+};
+export { applySecurityWhen, evaluateAccess, resolveEntitySecurity };

package/dist/types.d.ts

@@ -6,6 +6,8 @@ export type EntityKind = 'collection' | 'global';
 export type HttpMethod = 'get' | 'post' | 'patch' | 'put' | 'delete';
 export type IDType = 'text' | 'number';
 export type Entity = SanitizedCollectionConfig | SanitizedGlobalConfig;
+export type EntityOperation = 'read' | 'create' | 'update' | 'delete';
+export type EntitySecurityOverride = boolean | Partial<Record<EntityOperation, boolean>>;
 export interface OpenApiMetadata {
     title: string;
     version: string;
@@ -116,6 +118,12 @@ export type OpenApiPluginOptions = {
      * descriptions.
      */
     nestedTags?: boolean;
+    /**
+     * Override the security marking per operation: `true` marks it public, `false`
+     * secured (`PayloadToken`), `undefined` keeps the detected marking. Runs last,
+     * after `custom.openapi.security` and the probe, across every operation group.
+     */
+    securityWhen?: (ctx: OperationContext) => boolean | undefined;
     /**
      * Cache the built document for the life of the process. The Payload config is
      * static after boot, so the spec is the same every time apart from the server
@@ -169,6 +177,7 @@ export interface ResolvedOptions {
         endpoint: string;
     };
     nestedTags: boolean;
+    securityWhen?: (ctx: OperationContext) => boolean | undefined;
     cache: boolean;
     extensions: OpenApiExtension[];
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seshuk/payload-plugin-openapi",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "OpenAPI 3.0/3.1/3.2 spec generator for Payload CMS, with Scalar/Swagger UI.",
   "keywords": [
     "api-docs",