api-quality-spectral-ruleset 1.6.1 → 1.8.0

package/README.md

@@ -1,6 +1,6 @@
 <!-- README.md -->
 
-[![Node.js CI](https://github.com/apiaddicts/apquality-spectral/actions/workflows/node.js.yml/badge.svg)](https://github.com/apiaddicts/apquality-spectral/actions/workflows/node.js.yml) ![Coverage](./coverage/badges.svg)
+[![Node.js CI](https://github.com/apiaddicts/apiaddicts-style-guide-spectral/actions/workflows/node.js.yml/badge.svg)](https://github.com/apiaddicts/apiaddicts-style-guide-spectral/actions/workflows/node.js.yml) ![Coverage](./coverage/badges.svg)
 
 # APIAddicts Style Guide Spectral
 
@@ -26,19 +26,19 @@ The Spectral Ruleset requires Node version 14 or later.
 
 You can specify the ruleset directly on the command line:
 
-`spectral lint -r https://raw.githubusercontent.com/apiaddicts/apquality-spectral/refs/heads/main/apq-spectral.yaml <api definition file>`
+`spectral lint -r https://raw.githubusercontent.com/apiaddicts/apiaddicts-style-guide-spectral/refs/heads/main/apq-spectral.yaml <api definition file>`
 
 Or you can create a Spectral configuration file (`.spectral.yaml`) that references the ruleset:
 
 ```yaml
 extends:
-  - https://raw.githubusercontent.com/apiaddicts/apquality-spectral/refs/heads/main/apq-spectral.yaml
+  - https://raw.githubusercontent.com/apiaddicts/apiaddicts-style-guide-spectral/refs/heads/main/apq-spectral.yaml
 ```
 
 ### Example
 
 ```bash
-spectral lint -r https://raw.githubusercontent.com/apiaddicts/apquality-spectral/refs/heads/main/apq-spectral.yaml petstore.yaml
+spectral lint -r https://raw.githubusercontent.com/apiaddicts/apiaddicts-style-guide-spectral/refs/heads/main/apq-spectral.yaml petstore.yaml
 ```
 
 ### Using the Spectral VSCode extension

package/apq-spectral.yaml

@@ -40,7 +40,7 @@ functions:
   - apq-numeric-invalid-format
   - apq-numeric-missing-format
   - apq-numeric-well-defined-format
-  - apq-string-parameter-integrity
+  - apq-string-parameter-schema-integrity
   - apq-example-schema-types
   - apq-standard-response-schema
   - apq-allowed-http-verbs
@@ -54,11 +54,14 @@ functions:
   - apq-response-content-required
   - apq-tags-consistency
   - apq-forbidden-title-pattern
+  - apq-security-flows-allowed
+  - apq-oauth-url-pattern
+  - apq-security-types-allowed
 rules:
   apiq:OAR001:
     description: "For security reasons and as a REST best practice, the HTTPS protocol is mandatory."
     message: "OAR001: HTTPS protocol is mandatory."
-    documentationUrl: "https://github.com/apiaddicts/apquality-spectral/blob/main/docs/resources/OAR001.md"
+    documentationUrl: "https://github.com/apiaddicts/apiaddicts-style-guide-spectral/blob/main/docs/resources/OAR001.md"
     severity: "error"
     given: "$.servers[*].url"
     then:
@@ -68,7 +71,7 @@ rules:
   apiq:OAR002:
     description: "A wrong scope definition may cause problems to import the API definition into WSO2."
     message: "{{error}}"
-    documentationUrl: "https://github.com/apiaddicts/apquality-spectral/blob/main/docs/resources/OAR002.md"
+    documentationUrl: "https://github.com/apiaddicts/apiaddicts-style-guide-spectral/blob/main/docs/resources/OAR002.md"
     severity: "error"
     given: "$.x-wso2-security.apim.x-wso2-scopes"
     then:
@@ -76,7 +79,7 @@ rules:
   apiq:OAR003:
     description: "A description can help other developers to understand the correct use of the scope."
     message: "OAR003: Scope must define a 'description' attribute."
-    documentationUrl: "https://github.com/apiaddicts/apquality-spectral/blob/main/docs/resources/OAR003.md"
+    documentationUrl: "https://github.com/apiaddicts/apiaddicts-style-guide-spectral/blob/main/docs/resources/OAR003.md"
     severity: "error"
     given: "$.x-wso2-security.apim.x-wso2-scopes[*]"
     then:
@@ -86,7 +89,7 @@ rules:
   apiq:OAR004:
     description: "A role with forbidden characters may cause problems in some applications."
     message: "{{error}}"
-    documentationUrl: "https://github.com/apiaddicts/apquality-spectral/blob/main/docs/resources/OAR004.md"
+    documentationUrl: "https://github.com/apiaddicts/apiaddicts-style-guide-spectral/blob/main/docs/resources/OAR004.md"
     severity: "error"
     given: "$.x-wso2-security.apim.x-wso2-scopes[*].roles"
     then:
@@ -96,7 +99,7 @@ rules:
   apiq:OAR005:
     description: "A wrong scope may cause problems to import the API definition into WSO2 or allow all users to call the endpoint."
     message: "{{error}}"
-    documentationUrl: "https://github.com/apiaddicts/apquality-spectral/blob/main/docs/resources/OAR005.md"
+    documentationUrl: "https://github.com/apiaddicts/apiaddicts-style-guide-spectral/blob/main/docs/resources/OAR005.md"
     severity: "error"
     resolved: false
     given: "$"
@@ -106,7 +109,7 @@ rules:
     description: "Routes must define request media types supported by the API."
     message: "OAR006: Specify at least one Media Type in the content of the request body."
     severity: "error"
-    documentationUrl: "https://github.com/apiaddicts/apquality-spectral/blob/main/docs/resources/OAR006.md"
+    documentationUrl: "https://github.com/apiaddicts/apiaddicts-style-guide-spectral/blob/main/docs/resources/OAR006.md"
     given: "$.paths[*][post,put,patch]"
     then:
       - field: "requestBody"
@@ -116,7 +119,7 @@ rules:
   apiq:OAR007:
     description: "Routes must define response media types supported by the API"
     message: "OAR007: Specify at least one Media Type in the content of the response body."
-    documentationUrl: "https://github.com/apiaddicts/apquality-spectral/blob/main/docs/resources/OAR007.md"
+    documentationUrl: "https://github.com/apiaddicts/apiaddicts-style-guide-spectral/blob/main/docs/resources/OAR007.md"
     severity: "error"
     given:
       - "$.paths[*][post,put,patch]"
@@ -128,7 +131,7 @@ rules:
   apiq:OAR008:
     description: "HTTP verbs not encouraged."
     message: "{{error}}"
-    documentationUrl: "https://github.com/apiaddicts/apquality-spectral/blob/main/docs/resources/OAR008.md"
+    documentationUrl: "https://github.com/apiaddicts/apiaddicts-style-guide-spectral/blob/main/docs/resources/OAR008.md"
     severity: error
     given: "$.paths[*]"
     then:
@@ -162,7 +165,7 @@ rules:
   apiq:OAR011:
     description: "URLs should follow the configured naming convention (default kebab-case): all literal path segments must comply."
     message: "{{error}}"
-    documentationUrl: "https://github.com/apiaddicts/apquality-spectral/blob/main/docs/resources/OAR011.md"
+    documentationUrl: "https://github.com/apiaddicts/apiaddicts-style-guide-spectral/blob/main/docs/resources/OAR011.md"
     severity: error
     given:
       - "$.paths[*]~"
@@ -174,7 +177,7 @@ rules:
   apiq:OAR012:
     description: "Path params, query params, object names and property names should follow the configured naming convention. You can configure snake_case (default), kebab-case, camelCase or UpperCamelCase"
     message: "OAR012: Path params, query params, object names and property names must follow the configured naming convention."
-    documentationUrl: "https://github.com/apiaddicts/apquality-spectral/blob/main/docs/resources/OAR012.md"
+    documentationUrl: "https://github.com/apiaddicts/apiaddicts-style-guide-spectral/blob/main/docs/resources/OAR012.md"
     severity: warn
     given:
       - "$.paths[*][*].parameters[?(@.in == 'path' || @.in == 'query')].name"
@@ -197,7 +200,7 @@ rules:
   apiq:OAR014:
     description: "Resources depth level should be below the non-suggested range."
     message: "{{error}}"
-    documentationUrl: "https://github.com/apiaddicts/apquality-spectral/blob/main/docs/resources/OAR014.md"
+    documentationUrl: "https://github.com/apiaddicts/apiaddicts-style-guide-spectral/blob/main/docs/resources/OAR014.md"
     severity: warn
     given: "$.paths.*~"
     then:
@@ -221,7 +224,7 @@ rules:
   apiq:OAR016:
     description: "Numeric types requires a valid format."
     message: "OAR016: Numeric types must use a valid format for their type."
-    documentationUrl: "https://github.com/apiaddicts/apquality-spectral/blob/main/docs/resources/OAR016.md"
+    documentationUrl: "https://github.com/apiaddicts/apiaddicts-style-guide-spectral/blob/main/docs/resources/OAR016.md"
     severity: error
     resolved: false
     given: "$..[?(@ && @.type)]"
@@ -230,7 +233,7 @@ rules:
   apiq:OAR017:
     description: "Resource path should alternate static and parametrized parts."
     message: "OAR017: Resource path should alternate static and parametrized parts"
-    documentationUrl: "https://github.com/apiaddicts/apquality-spectral/blob/main/docs/resources/OAR017.md"
+    documentationUrl: "https://github.com/apiaddicts/apiaddicts-style-guide-spectral/blob/main/docs/resources/OAR017.md"
     severity: error
     given: "$.paths.*~"
     then:
@@ -240,7 +243,7 @@ rules:
   apiq:OAR018:
     description: Operation not recommended for resource path depending on HTTP verb
     message: "OAR018: Operation not recommended for resource path: {{path}} ({{verb}})"
-    documentationUrl: "https://github.com/apiaddicts/apquality-spectral/blob/main/docs/resources/OAR018.md"
+    documentationUrl: "https://github.com/apiaddicts/apiaddicts-style-guide-spectral/blob/main/docs/resources/OAR018.md"
     severity: warn
     given: "$.paths"
     then:
@@ -322,7 +325,7 @@ rules:
   apiq:OAR022:
     description: "$orderby must be defined as a query parameter in the collection GET operations selected by the configured paths."
     message: "{{error}}"
-    documentationUrl: "https://github.com/apiaddicts/apquality-spectral/blob/main/docs/resources/OAR022.md"
+    documentationUrl: "https://github.com/apiaddicts/apiaddicts-style-guide-spectral/blob/main/docs/resources/OAR022.md"
     severity: warn
     given: "$.paths"
     then:
@@ -350,7 +353,7 @@ rules:
   apiq:OAR025:
     description: "$limit must be defined as an integer query parameter in the collection GET operations selected by the configured paths."
     message: "{{error}}"
-    documentationUrl: "https://github.com/apiaddicts/apquality-spectral/blob/main/docs/resources/OAR025.md"
+    documentationUrl: "https://github.com/apiaddicts/apiaddicts-style-guide-spectral/blob/main/docs/resources/OAR025.md"
     severity: error
     given: "$.paths"
     then:
@@ -439,7 +442,7 @@ rules:
       functionOptions:
         notMatch: "^(Accept|Content-Type|Authorization)$"
   apiq:OAR034:
-    description: "GET collection responses must include a paging block that complies with the standard paging schema (required start, limit and links with self/previous/next; optional numPages and total as integers)."
+    description: "GET success JSON responses on collection paths must define an object schema with a paging block that complies with paging-schema (required start, limit and links with self/previous/next; optional numPages and total as integers)."
     message: "{{error}}"
     severity: error
     given: "$.paths[*].get.responses[*]"
@@ -447,6 +450,8 @@ rules:
       function: apq-paged-response-check
       functionOptions:
         paging-schema: '{"type":"object","properties":{"numPages":{"type":"integer"},"total":{"type":"integer"},"start":{"type":"integer"},"limit":{"type":"integer"},"links":{"type":"object","properties":{"next":{"type":"object","properties":{"href":{"type":"string"}}},"previous":{"type":"object","properties":{"href":{"type":"string"}}},"last":{"type":"object","properties":{"href":{"type":"string"}}},"self":{"type":"object","properties":{"href":{"type":"string"}}},"first":{"type":"object","properties":{"href":{"type":"string"}}}},"required":["self","previous","next"]}},"required":["start","limit","links"],"pagingPropertyName":"paging"}'
+        paths: "/status,/health,/ping,**/me"
+        pathValidationStrategy: "/exclude"
   apiq:OAR035:
     description: "Response code 401 must be defined for operations with security schemes defined."
     message: "{{error}}"
@@ -477,7 +482,7 @@ rules:
     then:
       function: apq-schema-format
   apiq:OAR038:
-    description: "The 201 response schema of a POST operation must have properties named 'data' or 'error' with at least one sub-property."
+    description: "The 201 response schema of a POST operation must only have the allowed top-level properties ('data' or 'error' by default), each with at least one sub-property, and every required one."
     message: "{{error}}"
     severity: error
     given: "$.paths.*.post.responses['201']"
@@ -485,10 +490,14 @@ rules:
       function: apq-valid-response-schema
       functionOptions:
         data-property: data
+        allowed-properties: ""
+        required-properties: ""
+        paths: "/me,/health,/ping,/status"
+        pathValidationStrategy: "/exclude"
   apiq:OAR039:
     description: "Response codes must be defined according to the standard depending on the HTTP verb and resource path."
     message: "{{error}}"
-    documentationUrl: https://github.com/apiaddicts/apquality-spectral/blob/main/docs/resources/OAR039.md
+    documentationUrl: https://github.com/apiaddicts/apiaddicts-style-guide-spectral/blob/main/docs/resources/OAR039.md
     severity: error
     given: "$.paths[*][*]"
     then:
@@ -533,7 +542,7 @@ rules:
   apiq:OAR041:
     description: "A WSO2 x-scope on an operation always requires an x-auth-type definition."
     message: "{{error}}"
-    documentationUrl: "https://github.com/apiaddicts/apquality-spectral/blob/main/docs/resources/OAR041.md"
+    documentationUrl: "https://github.com/apiaddicts/apiaddicts-style-guide-spectral/blob/main/docs/resources/OAR041.md"
     severity: "error"
     resolved: false
     given: "$"
@@ -553,7 +562,7 @@ rules:
   apiq:OAR043:
     description: "OpenAPI definition contains structural errors that would be detected by a strict parser or validator."
     message: "{{error}}"
-    documentationUrl: "https://github.com/apiaddicts/apquality-spectral/blob/main/docs/resources/OAR043.md"
+    documentationUrl: "https://github.com/apiaddicts/apiaddicts-style-guide-spectral/blob/main/docs/resources/OAR043.md"
     severity: error
     given:
       - $.paths.*.*.parameters.*.in
@@ -602,7 +611,7 @@ rules:
     - "$.paths[*].patch"
     - "$.paths[*].delete"
     then:
-      function: schema              
+      function: schema
       functionOptions:
         schema:
           type: object
@@ -621,7 +630,7 @@ rules:
   apiq:OAR048:
     description: APIs must define at most one body parameter.
     message: "OAR048: An operation can have at most one body parameter"
-    documentationUrl: "https://github.com/apiaddicts/apquality-spectral/blob/main/docs/resources/OAR048.md"
+    documentationUrl: "https://github.com/apiaddicts/apiaddicts-style-guide-spectral/blob/main/docs/resources/OAR048.md"
     severity: error
     given: "$.paths[*][*]"
     then:
@@ -657,7 +666,7 @@ rules:
   apiq:OAR052:
     description: "Numeric schema types must define a format."
     message: "OAR052: Numeric types requires a format"
-    documentationUrl: "https://github.com/apiaddicts/apquality-spectral/blob/main/docs/resources/OAR052.md"
+    documentationUrl: "https://github.com/apiaddicts/apiaddicts-style-guide-spectral/blob/main/docs/resources/OAR052.md"
     severity: warn
     resolved: false
     given: "$..[?(@ && @.type)]"
@@ -666,7 +675,7 @@ rules:
   apiq:OAR053:
     description: "Response headers for API observability and tracing must be defined (excluding 204 responses and health endpoints)."
     message: "OAR053: Response must include mandatory headers and exclude forbidden headers."
-    documentationUrl: "https://github.com/apiaddicts/apquality-spectral/blob/main/docs/resources/OAR053.md"
+    documentationUrl: "https://github.com/apiaddicts/apiaddicts-style-guide-spectral/blob/main/docs/resources/OAR053.md"
     severity: error
     given: "$.paths[*][*].responses[*]"
     then:
@@ -843,8 +852,8 @@ rules:
     then:
       function: apq-numeric-parameter-integrity
   apiq:OAR075:
-    description: "String parameters should have minLength, maxLength, pattern (regular expression), or enum restriction."
-    message: "OAR075: String parameters should have minLength, maxLength, pattern, or enum restriction."
+    description: "String parameter schemas should have minLength, maxLength, pattern (regular expression), or enum restriction."
+    message: "OAR075: String parameter schemas should have minLength, maxLength, pattern, or enum restriction."
     severity: error
     resolved: false
     given:
@@ -857,13 +866,13 @@ rules:
       - "$.components.parameters[*]"
       - "$.parameters[*]"
     then:
-      function: apq-string-parameter-integrity
+      function: apq-string-parameter-schema-integrity
       functionOptions:
         parameter_integrity: "minLength,maxLength,pattern,enum"
   apiq:OAR076:
     description: "Schema should use well-defined type and format."
     message: "OAR076: Schema should use well-defined type and format."
-    documentationUrl: "https://github.com/apiaddicts/apquality-spectral/blob/main/docs/resources/OAR076.md"
+    documentationUrl: "https://github.com/apiaddicts/apiaddicts-style-guide-spectral/blob/main/docs/resources/OAR076.md"
     severity: error
     resolved: false
     given: "$..[?(@ && @.type)]"
@@ -884,7 +893,7 @@ rules:
   apiq:OAR078:
     description: "All API methods must have security defined."
     message: "OAR078: Operation must have security defined."
-    documentationUrl: "https://github.com/apiaddicts/apquality-spectral/blob/main/docs/resources/OAR078.md"
+    documentationUrl: "https://github.com/apiaddicts/apiaddicts-style-guide-spectral/blob/main/docs/resources/OAR078.md"
     severity: error
     given: "$"
     then:
@@ -892,7 +901,7 @@ rules:
   apiq:OAR079:
     description: "Operations with path parameters should include a 404 Not Found response."
     message: "OAR079: Path parameter present, but missing 404 Not Found response."
-    documentationUrl: "https://github.com/apiaddicts/apquality-spectral/blob/main/docs/resources/OAR079.md"
+    documentationUrl: "https://github.com/apiaddicts/apiaddicts-style-guide-spectral/blob/main/docs/resources/OAR079.md"
     severity: "warn"
     given: "$.paths[*][get,post,put,patch,delete]"
     then:
@@ -1010,7 +1019,7 @@ rules:
   apiq:OAR091:
     description: "Parameters must contain only $ref references."
     message: "OAR091: Parameters must contain only $ref references."
-    documentationUrl: "https://github.com/apiaddicts/apquality-spectral/blob/main/docs/resources/OAR091.md"
+    documentationUrl: "https://github.com/apiaddicts/apiaddicts-style-guide-spectral/blob/main/docs/resources/OAR091.md"
     severity: error
     resolved: false
     given: "$.paths[*][get,post,put,patch,delete].parameters[*]"
@@ -1176,7 +1185,7 @@ rules:
   apiq:OAR113:
     description: "Field or extension must be at the assigned location"
     message: "OAR113: Field or extension x-custom-example must be at the assigned location"
-    documentationUrl: "https://github.com/apiaddicts/apquality-spectral/blob/main/docs/resources/OAR113.md"
+    documentationUrl: "https://github.com/apiaddicts/apiaddicts-style-guide-spectral/blob/main/docs/resources/OAR113.md"
     severity: warn
     given: "$"
     then:
@@ -1187,7 +1196,7 @@ rules:
   apiq:OAR114:
     description: "Response headers for API security and key management must be defined (excluding 204 responses)."
     message: "OAR114: Response must include mandatory headers and exclude forbidden headers."
-    documentationUrl: "https://github.com/apiaddicts/apquality-spectral/blob/main/docs/resources/OAR114.md"
+    documentationUrl: "https://github.com/apiaddicts/apiaddicts-style-guide-spectral/blob/main/docs/resources/OAR114.md"
     severity: "error"
     given: "$.paths[*][*].responses[*]"
     then:
@@ -1200,7 +1209,7 @@ rules:
   apiq:OAR115:
     description: "All fields listed in the required array must be defined in the schema properties."
     message: "OAR115: All fields in the required array must be defined in schema properties."
-    documentationUrl: "https://github.com/apiaddicts/apquality-spectral/blob/main/docs/resources/OAR115.md"
+    documentationUrl: "https://github.com/apiaddicts/apiaddicts-style-guide-spectral/blob/main/docs/resources/OAR115.md"
     severity: warn
     resolved: false
     given: "$..[?(@ && @.required)]"
@@ -1209,7 +1218,7 @@ rules:
   apiq:OAR116:
     description: "Every API path must match the configured regular expression."
     message: "{{error}}"
-    documentationUrl: "https://github.com/apiaddicts/apquality-spectral/blob/main/docs/resources/OAR116.md"
+    documentationUrl: "https://github.com/apiaddicts/apiaddicts-style-guide-spectral/blob/main/docs/resources/OAR116.md"
     severity: error
     given: "$.paths.*~"
     then:
@@ -1219,10 +1228,60 @@ rules:
   apiq:OAR117:
     description: "The API title must not match the configured forbidden regular expression."
     message: "{{error}}"
-    documentationUrl: "https://github.com/apiaddicts/apquality-spectral/blob/main/docs/resources/OAR117.md"
+    documentationUrl: "https://github.com/apiaddicts/apiaddicts-style-guide-spectral/blob/main/docs/resources/OAR117.md"
     severity: error
     given: "$.info.title"
     then:
       function: apq-forbidden-title-pattern
       functionOptions:
-        forbidden-pattern: "(?!)"
+        forbidden-pattern: "(?!)"
+  apiq:OAR118:
+    description: "OAuth2 security schemes must only declare the flows allowed by the organization (authorizationCode and clientCredentials by default)."
+    message: "{{error}}"
+    documentationUrl: "https://github.com/apiaddicts/apquality-spectral/blob/main/docs/resources/OAR118.md"
+    severity: error
+    given: "$"
+    then:
+      function: apq-security-flows-allowed
+      functionOptions:
+        allowed-flows: "authorizationCode,clientCredentials"
+        paths: "/me,/health,/ping,/status"
+        pathValidationStrategy: "/exclude"
+  apiq:OAR119:
+    description: "The authorizationUrl of every OAuth2 flow must match the pattern allowed by the organization (an HTTPS URL on a domain ending in /authorize by default)."
+    message: "{{error}}"
+    documentationUrl: "https://github.com/apiaddicts/apquality-spectral/blob/main/docs/resources/OAR119.md"
+    severity: error
+    given: "$"
+    then:
+      function: apq-oauth-url-pattern
+      functionOptions:
+        field: authorizationUrl
+        pattern: '^https://[A-Za-z0-9-]+(\.[A-Za-z0-9-]+)+(:[0-9]+)?(/[^/?#]+)*/authorize$'
+        paths: "/me,/health,/ping,/status"
+        pathValidationStrategy: "/exclude"
+  apiq:OAR120:
+    description: "The tokenUrl of every OAuth2 flow must match the pattern allowed by the organization (an HTTPS URL on a domain ending in /token by default)."
+    message: "{{error}}"
+    documentationUrl: "https://github.com/apiaddicts/apquality-spectral/blob/main/docs/resources/OAR120.md"
+    severity: error
+    given: "$"
+    then:
+      function: apq-oauth-url-pattern
+      functionOptions:
+        field: tokenUrl
+        pattern: '^https://[A-Za-z0-9-]+(\.[A-Za-z0-9-]+)+(:[0-9]+)?(/[^/?#]+)*/token$'
+        paths: "/me,/health,/ping,/status"
+        pathValidationStrategy: "/exclude"
+  apiq:OAR121:
+    description: "Security schemes must only use the types allowed by the organization (oauth2 and HTTP bearer by default)."
+    message: "{{error}}"
+    documentationUrl: "https://github.com/apiaddicts/apquality-spectral/blob/main/docs/resources/OAR121.md"
+    severity: error
+    given: "$"
+    then:
+      function: apq-security-types-allowed
+      functionOptions:
+        allowed-security-types: "oauth2,bearer"
+        paths: "/me,/health,/ping,/status"
+        pathValidationStrategy: "/exclude"

package/functions/apq-oauth-url-pattern.js

@@ -0,0 +1,205 @@
+const { pathsIncludeExclude } = require('./paths-include-exclude.js');
+
+const DEFAULT_PATTERNS = {
+  authorizationUrl: '^https://[A-Za-z0-9-]+(\\.[A-Za-z0-9-]+)+(:[0-9]+)?(/[^/?#]+)*/authorize$',
+  tokenUrl: '^https://[A-Za-z0-9-]+(\\.[A-Za-z0-9-]+)+(:[0-9]+)?(/[^/?#]+)*/token$',
+};
+const DEFAULT_PATHS = '/me,/health,/ping,/status';
+const INLINE_FLAGS_REGEX = /^\(\?([a-zA-Z]+)\)/;
+const SUPPORTED_INLINE_FLAGS = 'imsu';
+
+const VERBS_V2 = ['get', 'put', 'post', 'delete', 'options', 'head', 'patch'];
+const VERBS_V3 = VERBS_V2.concat(['trace']);
+const VERBS_V32 = VERBS_V3.concat(['query']);
+
+const isObject = (value) => value !== null && typeof value === 'object' && !Array.isArray(value);
+const has = (obj, key) => Object.prototype.hasOwnProperty.call(obj, key);
+
+const documentVersion = (root) => {
+  if (has(root, 'swagger')) return 'v2';
+  if (!has(root, 'openapi')) return null;
+  const openapi = String(root.openapi).trim();
+  if (openapi.startsWith('3.2')) return 'v32';
+  if (openapi.startsWith('3.1')) return 'v31';
+  return 'v3';
+};
+
+const buildRegex = (raw) => {
+  if (typeof raw !== 'string' || raw.trim() === '') return null;
+  const text = raw.trim();
+  let source = text;
+  let flags = '';
+  const inline = INLINE_FLAGS_REGEX.exec(source);
+  if (inline) {
+    const requested = inline[1].toLowerCase();
+    if ([...requested].every((flag) => SUPPORTED_INLINE_FLAGS.includes(flag))) {
+      flags = [...new Set(requested)].join('');
+      source = source.slice(inline[0].length);
+    }
+  }
+  if (source === '') return null;
+  try {
+    return { regex: new RegExp(source, flags), text };
+  } catch (err) {
+    return null;
+  }
+};
+
+const pointerTarget = (root, ref) => {
+  let fragment;
+  try {
+    fragment = decodeURIComponent(ref.slice(1));
+  } catch (err) {
+    return undefined;
+  }
+  if (!fragment.startsWith('/')) return undefined;
+  const segments = fragment.slice(1).split('/').map((segment) => segment.replace(/~1/g, '/').replace(/~0/g, '~'));
+  let value = root;
+  for (const segment of segments) {
+    if (!isObject(value) || !has(value, segment)) return undefined;
+    value = value[segment];
+  }
+  return isObject(value) ? { value, segments } : undefined;
+};
+
+const collectOperations = (root, version) => {
+  const verbs = version === 'v32' ? VERBS_V32 : (version === 'v2' ? VERBS_V2 : VERBS_V3);
+  const operations = [];
+  const visitPathItem = (pathItem, pathKey, ancestors) => {
+    if (!isObject(pathItem) || ancestors.has(pathItem)) return;
+    const chain = new Set(ancestors).add(pathItem);
+    const ops = verbs.filter((verb) => has(pathItem, verb)).map((verb) => pathItem[verb]);
+    if (version === 'v32' && isObject(pathItem.additionalOperations)) ops.push(...Object.values(pathItem.additionalOperations));
+    ops.filter(isObject).forEach((op) => {
+      operations.push({ op, pathKey });
+      if (version === 'v2' || !isObject(op.callbacks)) return;
+      Object.values(op.callbacks).filter(isObject).forEach((callback) => {
+        Object.keys(callback)
+          .filter((expression) => !expression.startsWith('x-'))
+          .forEach((expression) => visitPathItem(callback[expression], pathKey, chain));
+      });
+    });
+  };
+  if (isObject(root.paths)) {
+    Object.keys(root.paths)
+      .filter((pathKey) => pathKey.startsWith('/'))
+      .forEach((pathKey) => visitPathItem(root.paths[pathKey], pathKey, new Set()));
+  }
+  if ((version === 'v31' || version === 'v32') && isObject(root.webhooks)) {
+    Object.values(root.webhooks).forEach((pathItem) => visitPathItem(pathItem, null, new Set()));
+  }
+  return operations;
+};
+
+const definitionsBase = (version) => (version === 'v2' ? ['securityDefinitions'] : ['components', 'securitySchemes']);
+
+const lookup = (root, segments) => segments.reduce((value, segment) => (isObject(value) ? value[segment] : undefined), root);
+
+/**
+ * @param {object} root - The resolved document (given: "$")
+ * @param {object} options
+ * @param {string} options.field - "authorizationUrl" or "tokenUrl", the URL of the OAuth2 flows that is checked
+ * @param {string} options.pattern - regular expression the URL must match (unanchored, an optional leading "(?i)" style
+ *   group sets the i, m, s and u flags); blank or invalid falls back to "https://host.domain/.../authorize" for
+ *   authorizationUrl and "https://host.domain/.../token" for tokenUrl
+ * @param {string|string[]} options.paths - comma-separated path patterns matched segment by segment; "*" matches one segment
+ *   and "**" zero or more (default "/me,/health,/ping,/status")
+ * @param {string} options.pathValidationStrategy - "/exclude" (default) skips the security schemes applied only to matching
+ *   paths, "/include" only evaluates the security schemes applied to them; webhooks have no path, so they are only evaluated
+ *   with "/exclude", and callbacks follow the path of their operation
+ * @param {import('@stoplight/spectral-core').RulesetFunctionContext} context
+ * @returns {Array<{message: string, path: Array<string>}>} one result per URL that does not match, on the URL itself
+ */
+module.exports = (root, options, context) => {
+  if (!isObject(root)) return [];
+  const version = documentVersion(root);
+  if (version === null) return [];
+
+  const opts = options || {};
+  const field = opts.field;
+  if (!has(DEFAULT_PATTERNS, field)) return [];
+  const matcher = buildRegex(opts.pattern) || buildRegex(DEFAULT_PATTERNS[field]);
+  const { include, isEvaluatedPath } = pathsIncludeExclude(opts, DEFAULT_PATHS);
+
+  const base = definitionsBase(version);
+  const definitions = lookup(root, base);
+  const rawDefinitions = lookup(context.document && context.document.data, base);
+  const schemes = new Map();
+  if (isObject(definitions)) {
+    Object.keys(definitions).forEach((name) => {
+      const scheme = definitions[name];
+      if (!isObject(scheme)) return;
+      const rawEntry = isObject(rawDefinitions) ? rawDefinitions[name] : undefined;
+      const direct = isObject(rawEntry) && !has(rawEntry, '$ref');
+      const known = schemes.get(scheme);
+      if (!known || (!known.direct && direct)) schemes.set(scheme, { name, path: [...base, name], direct });
+    });
+  }
+
+  const schemeFor = (key) => {
+    if (isObject(definitions) && has(definitions, key)) return isObject(definitions[key]) ? definitions[key] : undefined;
+    if (version !== 'v32') return undefined;
+    const self = typeof root.$self === 'string' ? root.$self.trim() : '';
+    const fragment = self !== '' && key.startsWith(`${self}#`) ? key.slice(self.length) : key;
+    if (!fragment.startsWith('#')) return undefined;
+    const target = pointerTarget(root, fragment);
+    if (!target) return undefined;
+    if (!schemes.has(target.value)) {
+      schemes.set(target.value, { name: target.segments[target.segments.length - 1], path: target.segments, direct: true });
+    }
+    return target.value;
+  };
+
+  const usage = new Map();
+  const rootSecurity = Array.isArray(root.security) ? root.security : [];
+  collectOperations(root, version).forEach(({ op, pathKey }) => {
+    const security = Array.isArray(op.security) ? op.security : rootSecurity;
+    const inScope = pathKey === null ? !include : isEvaluatedPath(pathKey);
+    security.filter(isObject).forEach((requirement) => {
+      Object.keys(requirement).forEach((key) => {
+        const scheme = schemeFor(key);
+        if (scheme) usage.set(scheme, usage.get(scheme) === true || inScope);
+      });
+    });
+  });
+
+  const inventory = context.documentInventory;
+  const isLocatable = (path) => {
+    const item = inventory.findAssociatedItemForPath(path, true);
+    if (!item || !item.document) return true;
+    return item.document.getRangeForJsonPath(item.path, false) !== undefined;
+  };
+  const locatable = (path) => {
+    if (!inventory || typeof inventory.findAssociatedItemForPath !== 'function') return path;
+    for (let length = path.length; length > 0; length -= 1) {
+      if (isLocatable(path.slice(0, length))) return path.slice(0, length);
+    }
+    return path;
+  };
+
+  const ruleCode = context.rule && context.rule.name ? context.rule.name.split(':').pop() : (field === 'tokenUrl' ? 'OAR120' : 'OAR119');
+  const results = [];
+  const check = (url, flow, name, path) => {
+    if (typeof url !== 'string' || matcher.regex.test(url)) return;
+    const flowText = typeof flow === 'string' && flow.trim() !== '' ? ` of flow '${flow}'` : '';
+    results.push({
+      message: `${ruleCode}: ${field} '${url}'${flowText} in security scheme '${name}' does not match the allowed pattern: ${matcher.text}`,
+      path: locatable(path),
+    });
+  };
+
+  schemes.forEach((entry, scheme) => {
+    if (usage.has(scheme) ? !usage.get(scheme) : include) return;
+    if (typeof scheme.type !== 'string' || scheme.type.trim().toLowerCase() !== 'oauth2') return;
+    if (version === 'v2') {
+      if (has(scheme, field)) check(scheme[field], scheme.flow, entry.name, [...entry.path, field]);
+      return;
+    }
+    if (!isObject(scheme.flows)) return;
+    Object.keys(scheme.flows)
+      .filter((flow) => !flow.startsWith('x-') && flow.trim() !== '' && isObject(scheme.flows[flow]) && has(scheme.flows[flow], field))
+      .forEach((flow) => check(scheme.flows[flow][field], flow, entry.name, [...entry.path, 'flows', flow, field]));
+  });
+
+  return results;
+};