tina4-nodejs 3.13.132 → 3.13.134

package/packages/orm/src/seederTable.ts

@@ -0,0 +1,101 @@
+import { FakeData } from "./fakeData.js";
+import { adapterExecute, adapterColumns, adapterInsert } from "./database.js";
+import { Log } from "../../core/src/index.js";
+import type { DatabaseAdapter, FieldDefinition, FieldType } from "./types.js";
+import type { SeedOptions, SeedSummary } from "./seederTypes.js";
+
+function normaliseOptions(overrides?: Record<string, unknown>, opts?: SeedOptions):
+  Required<Pick<SeedOptions, "clear" | "strict">> & { overrides?: Record<string, unknown> } {
+  const merged = { ...(opts ?? {}) };
+  return {
+    overrides: merged.overrides ?? overrides,
+    clear: merged.clear ?? false,
+    strict: merged.strict ?? false,
+  };
+}
+
+/** Delete every row, logging but not hiding a clear failure. */
+export async function clearTable(db: DatabaseAdapter, tableName: string): Promise<void> {
+  try {
+    await adapterExecute(db, `DELETE FROM "${tableName}"`);
+  } catch (e) {
+    Log.warning(`Seeder: could not clear '${tableName}': ${(e as Error).message}`);
+  }
+}
+
+function sqlTypeToFieldType(sqlType: string): FieldType {
+  const type = (sqlType || "").toUpperCase();
+  if (type.includes("INT")) return "integer";
+  if (type.includes("BOOL")) return "boolean";
+  if (["REAL", "FLOA", "DOUB", "NUM", "DEC"].some((part) => type.includes(part))) return "number";
+  if (type.includes("DATE") || type.includes("TIME")) return "datetime";
+  if (type.includes("TEXT") || type.includes("CLOB")) return "text";
+  return "string";
+}
+
+/** Build generators from live table metadata for the explicit seedTable path. */
+export async function autoFieldMap(
+  db: DatabaseAdapter,
+  table: string,
+  fake: FakeData = new FakeData(),
+): Promise<Record<string, () => unknown>> {
+  const columns = await adapterColumns(db, table);
+  const fieldMap: Record<string, () => unknown> = {};
+  for (const column of columns) {
+    const name = column.name;
+    const sqlType = String(column.type ?? "").toUpperCase();
+    const generatedPk = column.primaryKey === true &&
+      (sqlType.includes("AUTO") || sqlType.includes("SERIAL") || sqlType.includes("IDENTITY") || name.toLowerCase() === "id");
+    if (generatedPk) continue;
+    fieldMap[name] = () => fake.forField({ type: sqlTypeToFieldType(sqlType) }, name, table);
+  }
+  return fieldMap;
+}
+
+/** Seed a table through the adapter insert path, counting or re-raising row failures. */
+export async function seedTable(
+  db: DatabaseAdapter,
+  tableName: string,
+  count = 10,
+  fieldMap?: Record<string, (() => unknown) | unknown>,
+  overrides?: Record<string, unknown>,
+  opts?: SeedOptions,
+): Promise<SeedSummary> {
+  if (opts?.seed !== undefined) {
+    throw new Error(
+      "seedTable() no longer accepts opts.seed: it has no generators of its own to seed " +
+      "(fieldMap callables are opaque). Build a seeded FakeData yourself and close over it " +
+      "in fieldMap, e.g. const fake = new FakeData(42); seedTable(db, table, count, " +
+      "{ name: () => fake.name() }).",
+    );
+  }
+  const { overrides: effectiveOverrides, clear, strict } = normaliseOptions(overrides, opts);
+  if (!fieldMap || Object.keys(fieldMap).length === 0) return { seeded: 0, failed: 0, errors: [] };
+  if (clear) await clearTable(db, tableName);
+
+  let seeded = 0;
+  let failed = 0;
+  const errors: Array<{ row: number; message: string }> = [];
+  for (let i = 0; i < count; i++) {
+    try {
+      const row: Record<string, unknown> = {};
+      for (const [column, generator] of Object.entries(fieldMap)) {
+        row[column] = typeof generator === "function" ? (generator as () => unknown)() : generator;
+      }
+      for (const [column, value] of Object.entries(effectiveOverrides ?? {})) row[column] = value;
+      await adapterInsert(db, tableName, row);
+      seeded++;
+    } catch (e) {
+      const message = (e as Error).message ?? String(e);
+      if (strict) {
+        Log.error(`Seeder: row ${i} failed seeding '${tableName}' (strict): ${message}`);
+        throw e;
+      }
+      failed++;
+      errors.push({ row: i, message });
+      Log.warning(`Seeder: row ${i} failed seeding '${tableName}', skipped: ${message}`);
+    }
+  }
+  Log.info(`Seeder: '${tableName}' — seeded ${seeded}, ${failed} failed`);
+  return { seeded, failed, errors };
+}

package/packages/orm/src/seederTypes.ts

@@ -0,0 +1,14 @@
+/** Result of a seed run. */
+export interface SeedSummary {
+  seeded: number;
+  failed: number;
+  errors: Array<{ row: number; message: string }>;
+}
+
+/** Options shared by the table and ORM seed paths. */
+export interface SeedOptions {
+  overrides?: Record<string, unknown>;
+  clear?: boolean;
+  seed?: number;
+  strict?: boolean;
+}

package/packages/orm/src/validation.ts

@@ -5,6 +5,101 @@ export interface ValidationError {
   message: string;
 }
 
+function error(field: string, message: string): ValidationError {
+  return { field, message };
+}
+
+function validateString(
+  name: string,
+  value: string,
+  def: FieldDefinition,
+  pattern: RegExp | undefined,
+): ValidationError[] {
+  const errors: ValidationError[] = [];
+  if (def.minLength !== undefined && value.length < def.minLength) {
+    errors.push(error(name, `must be at least ${def.minLength} characters`));
+  }
+  if (def.maxLength !== undefined && value.length > def.maxLength) {
+    errors.push(error(name, `must be at most ${def.maxLength} characters`));
+  }
+  if (pattern && !pattern.test(value)) {
+    errors.push(error(name, "does not match the required format"));
+  }
+  return errors;
+}
+
+function validateNumber(name: string, value: unknown, def: FieldDefinition): ValidationError[] {
+  const num = typeof value === "string" ? Number(value) : value;
+  if (typeof num !== "number" || isNaN(num)) return [error(name, "must be a number")];
+
+  const errors: ValidationError[] = [];
+  if (def.type === "integer" && !Number.isInteger(num)) {
+    errors.push(error(name, "must be an integer"));
+  }
+  if (def.min !== undefined && num < def.min) {
+    errors.push(error(name, `must be at least ${def.min}`));
+  }
+  if (def.max !== undefined && num > def.max) {
+    errors.push(error(name, `must be at most ${def.max}`));
+  }
+  return errors;
+}
+
+function validateBoolean(name: string, value: unknown): ValidationError[] {
+  return typeof value === "boolean" || value === 0 || value === 1 || value === "true" || value === "false"
+    ? []
+    : [error(name, "must be a boolean")];
+}
+
+function validateDatetime(name: string, value: unknown): ValidationError[] {
+  return typeof value === "string" && isNaN(Date.parse(value))
+    ? [error(name, "must be a valid date/time")]
+    : [];
+}
+
+function validateJson(name: string, value: unknown): ValidationError[] {
+  return value !== null && typeof value !== "object" && typeof value !== "string"
+    ? [error(name, "must be a JSON object or array")]
+    : [];
+}
+
+function validateForeignKey(name: string, value: unknown): ValidationError[] {
+  const fkNum = typeof value === "string" ? Number(value) : value;
+  return typeof fkNum !== "number" || isNaN(fkNum) || !Number.isInteger(fkNum)
+    ? [error(name, "must be a valid foreign key (integer)")]
+    : [];
+}
+
+function validateField(
+  name: string,
+  value: unknown,
+  def: FieldDefinition,
+  pattern: RegExp | undefined,
+): ValidationError[] {
+  if (def.type === "string" || def.type === "text") {
+    return typeof value === "string"
+      ? validateString(name, value, def, pattern)
+      : [error(name, "must be a string")];
+  }
+
+  if (def.type === "integer" || def.type === "number" || def.type === "numeric") {
+    return validateNumber(name, value, def);
+  }
+
+  switch (def.type) {
+    case "boolean":
+      return validateBoolean(name, value);
+    case "datetime":
+      return validateDatetime(name, value);
+    case "json":
+      return validateJson(name, value);
+    case "foreignKey":
+      return validateForeignKey(name, value);
+    default:
+      return [];
+  }
+}
+
 export function validate(
   data: Record<string, unknown>,
   fields: Record<string, FieldDefinition>,
@@ -28,92 +123,14 @@ export function validate(
 
     // Required check (skip on update if field not provided)
     if (def.required && !isUpdate && (value === undefined || value === null || value === "")) {
-      errors.push({ field: name, message: "is required" });
+      errors.push(error(name, "is required"));
       continue;
     }
 
     // Skip further validation if value not provided
     if (value === undefined || value === null) continue;
 
-    // Type checks
-    switch (def.type) {
-      case "string":
-      case "text":
-        if (typeof value !== "string") {
-          errors.push({ field: name, message: "must be a string" });
-        } else {
-          if (def.minLength !== undefined && value.length < def.minLength) {
-            errors.push({ field: name, message: `must be at least ${def.minLength} characters` });
-          }
-          if (def.maxLength !== undefined && value.length > def.maxLength) {
-            errors.push({ field: name, message: `must be at most ${def.maxLength} characters` });
-          }
-          const regex = compiledPatterns.get(name);
-          if (regex && !regex.test(value)) {
-            // Feature 19 (VALID-TWO-MESSAGES): one canonical wording per rule
-            // across BOTH validators. The request Validator says "does not match
-            // the required format"; the ORM validator must say the same so a
-            // client keying on the message matches either surface.
-            errors.push({ field: name, message: `does not match the required format` });
-          }
-        }
-        break;
-
-      case "integer":
-      case "number":
-      case "numeric": {
-        const num = typeof value === "string" ? Number(value) : value;
-        if (typeof num !== "number" || isNaN(num)) {
-          errors.push({ field: name, message: "must be a number" });
-        } else {
-          if (def.type === "integer" && !Number.isInteger(num)) {
-            errors.push({ field: name, message: "must be an integer" });
-          }
-          if (def.min !== undefined && num < def.min) {
-            errors.push({ field: name, message: `must be at least ${def.min}` });
-          }
-          if (def.max !== undefined && num > def.max) {
-            errors.push({ field: name, message: `must be at most ${def.max}` });
-          }
-        }
-        break;
-      }
-
-      case "boolean":
-        if (typeof value !== "boolean" && value !== 0 && value !== 1 && value !== "true" && value !== "false") {
-          errors.push({ field: name, message: "must be a boolean" });
-        }
-        break;
-
-      case "datetime":
-        if (typeof value === "string" && isNaN(Date.parse(value))) {
-          errors.push({ field: name, message: "must be a valid date/time" });
-        }
-        break;
-
-      case "json":
-        // A JSON column holds an object/array (or a pre-serialised JSON
-        // string); reject a bare scalar. A value that can't be JSON-encoded
-        // (a circular reference, a BigInt) fails loud at save time.
-        if (value !== null && typeof value !== "object" && typeof value !== "string") {
-          errors.push({ field: name, message: "must be a JSON object or array" });
-        }
-        break;
-
-      case "foreignKey": {
-        // Outlier D: previously there was no foreignKey case, so ANY value
-        // passed validation silently. A foreign key references another model's
-        // primary key — by default an auto-increment integer — so validate it
-        // as an integer (a numeric string like "12" is coerced and accepted).
-        // This catches the common bug of assigning a whole object / array /
-        // non-numeric string to an *_id column before it reaches the driver.
-        const fkNum = typeof value === "string" ? Number(value) : value;
-        if (typeof fkNum !== "number" || isNaN(fkNum) || !Number.isInteger(fkNum)) {
-          errors.push({ field: name, message: "must be a valid foreign key (integer)" });
-        }
-        break;
-      }
-    }
+    errors.push(...validateField(name, value, def, compiledPatterns.get(name)));
   }
 
   return errors;

package/packages/swagger/dist/index.js

@@ -80,12 +80,46 @@ function sanitizeSecurity(reqs, schemes) {
   });
 }
 function generate(routes, models = []) {
+  const schemes = resolveSecuritySchemes();
+  const spec = {
+    openapi: resolveOpenApiVersion(),
+    info: buildInfo(),
+    servers: resolveServers(),
+    paths: {},
+    components: {
+      schemas: {},
+      // Configurable security schemes (v3.13.42): bearerFormat via env, optional
+      // apiKey scheme, plus any programmatically-registered schemes (which may
+      // override bearerAuth — e.g. an oauth2 scheme with scopes).
+      securitySchemes: schemes
+    }
+  };
+  const tableToSchema = /* @__PURE__ */ new Map();
+  buildComponentSchemas(models, spec, tableToSchema);
+  const ctx = {
+    models,
+    tableToSchema,
+    schemes,
+    // Default scheme secured routes use when no explicit meta.security is set.
+    defaultScheme: process.env.TINA4_SWAGGER_DEFAULT_SCHEME ?? "bearerAuth",
+    // Path filters (comma-separated raw-path prefixes).
+    includePrefixes: csv(process.env.TINA4_SWAGGER_INCLUDE),
+    excludePrefixes: csv(process.env.TINA4_SWAGGER_EXCLUDE),
+    // Reusable custom schemas referenced by routes via meta.requestSchema/responseSchemas.
+    refSchemas: /* @__PURE__ */ new Set(),
+    usedTags: [],
+    seenIds: /* @__PURE__ */ new Set()
+  };
+  for (const route of routes) {
+    buildOperation(route, spec, ctx);
+  }
+  buildRefSchemas(spec, ctx.refSchemas);
+  buildTags(spec, ctx.usedTags);
+  return spec;
+}
+function buildInfo() {
   const info = {
     title: process.env.TINA4_SWAGGER_TITLE ?? "Tina4 API",
-    // The app's version, defaulting to 1.0.0 — NOT the framework's (Node shipped
-    // 0.0.1). description defaults to the empty string, not a canned sentence.
-    // Both are the settled cross-framework defaults (parity with the Python
-    // master); TINA4_SWAGGER_VERSION / _DESCRIPTION still override.
     version: process.env.TINA4_SWAGGER_VERSION ?? "1.0.0",
     description: process.env.TINA4_SWAGGER_DESCRIPTION ?? ""
   };
@@ -102,135 +136,134 @@ function generate(routes, models = []) {
     const [name, url] = licenseRaw.split("|").map((s) => s.trim());
     info.license = url ? { name, url } : { name };
   }
-  const schemes = resolveSecuritySchemes();
-  const spec = {
-    openapi: resolveOpenApiVersion(),
-    info,
-    servers: resolveServers(),
-    paths: {},
-    components: {
-      schemas: {},
-      // Configurable security schemes (v3.13.42): bearerFormat via env, optional
-      // apiKey scheme, plus any programmatically-registered schemes (which may
-      // override bearerAuth — e.g. an oauth2 scheme with scopes).
-      securitySchemes: schemes
-    }
-  };
-  const defaultScheme = process.env.TINA4_SWAGGER_DEFAULT_SCHEME ?? "bearerAuth";
-  const includePrefixes = csv(process.env.TINA4_SWAGGER_INCLUDE);
-  const excludePrefixes = csv(process.env.TINA4_SWAGGER_EXCLUDE);
-  const refSchemas = /* @__PURE__ */ new Set();
-  const tableToSchema = /* @__PURE__ */ new Map();
+  return info;
+}
+function buildComponentSchemas(models, spec, tableToSchema) {
   for (const model of models) {
     const schemaKey = schemaNameForModel(model);
     tableToSchema.set(model.tableName, schemaKey);
     spec.components.schemas[schemaKey] = modelToSchema(model);
   }
-  const usedTags = [];
-  const seenIds = /* @__PURE__ */ new Set();
-  for (const route of routes) {
-    if (!isIncludedPath(route.pattern, includePrefixes, excludePrefixes)) continue;
-    const openApiPath = patternToOpenAPI(route.pattern);
-    const method = route.method.toLowerCase();
-    if (!spec.paths[openApiPath]) {
-      spec.paths[openApiPath] = {};
+}
+function buildOperation(route, spec, ctx) {
+  if (!isIncludedPath(route.pattern, ctx.includePrefixes, ctx.excludePrefixes)) return;
+  const openApiPath = patternToOpenAPI(route.pattern);
+  const method = route.method.toLowerCase();
+  if (!spec.paths[openApiPath]) {
+    spec.paths[openApiPath] = {};
+  }
+  const tags = route.meta?.tags ?? inferTags(route.pattern);
+  for (const t of tags) {
+    if (!ctx.usedTags.includes(t)) ctx.usedTags.push(t);
+  }
+  const operation = {
+    operationId: uniqueOperationId(method, openApiPath, ctx.seenIds),
+    summary: route.meta?.summary ?? `${route.method} ${route.pattern}`,
+    tags,
+    responses: route.meta?.responses ?? {
+      "200": { description: "Successful response" }
     }
-    const tags = route.meta?.tags ?? inferTags(route.pattern);
-    for (const t of tags) {
-      if (!usedTags.includes(t)) usedTags.push(t);
+  };
+  if (route.meta?.description) operation.description = route.meta.description;
+  if (route.meta?.deprecated) operation.deprecated = true;
+  const parameters = operationParameters(route, method, ctx.models);
+  if (parameters.length > 0) operation.parameters = parameters;
+  operationRequestBody(route, method, operation, ctx);
+  operationResponseSchemas(route, operation, ctx.refSchemas);
+  operationSecurity(route, method, operation, ctx.schemes, ctx.defaultScheme);
+  spec.paths[openApiPath][method] = operation;
+}
+function operationParameters(route, method, models) {
+  let parameters = [];
+  const pathParams = extractPathParams(route.pattern);
+  if (pathParams.length > 0) {
+    parameters = pathParams.map(({ name, schema }) => ({
+      name,
+      in: "path",
+      required: true,
+      schema
+    }));
+  }
+  if (method === "get" && !route.pattern.includes("[id]") && !route.pattern.includes("[...")) {
+    const modelName = inferModelFromPath(route.pattern);
+    if (modelName && models.some((m) => m.tableName === modelName)) {
+      parameters = [
+        ...parameters,
+        { name: "page", in: "query", schema: { type: "integer", default: 1 } },
+        { name: "limit", in: "query", schema: { type: "integer", default: 20 } },
+        { name: "sort", in: "query", schema: { type: "string" }, description: "Sort fields (prefix with - for descending)" }
+      ];
     }
-    const operation = {
-      operationId: uniqueOperationId(method, openApiPath, seenIds),
-      summary: route.meta?.summary ?? `${route.method} ${route.pattern}`,
-      tags,
-      responses: route.meta?.responses ?? {
-        "200": { description: "Successful response" }
-      }
+  }
+  return parameters;
+}
+function mediaWithExample(schema, example) {
+  const media = { schema };
+  if (example !== void 0) media.example = example;
+  return media;
+}
+function operationRequestBody(route, method, operation, ctx) {
+  const reqSchemaRef = parseRequestSchema(route.meta?.requestSchema);
+  if (reqSchemaRef && (method === "post" || method === "put" || method === "patch")) {
+    ctx.refSchemas.add(reqSchemaRef.name);
+    const media = mediaWithExample({ $ref: `#/components/schemas/${reqSchemaRef.name}` }, route.meta?.example);
+    operation.requestBody = {
+      content: { [reqSchemaRef.contentType]: media }
     };
-    if (route.meta?.description) operation.description = route.meta.description;
-    if (route.meta?.deprecated) operation.deprecated = true;
-    const pathParams = extractPathParams(route.pattern);
-    if (pathParams.length > 0) {
-      operation.parameters = pathParams.map(({ name, schema }) => ({
-        name,
-        in: "path",
-        required: true,
-        schema
-      }));
-    }
-    if (method === "get" && !route.pattern.includes("[id]") && !route.pattern.includes("[...")) {
-      const modelName = inferModelFromPath(route.pattern);
-      if (modelName && models.some((m) => m.tableName === modelName)) {
-        operation.parameters = [
-          ...operation.parameters ?? [],
-          { name: "page", in: "query", schema: { type: "integer", default: 1 } },
-          { name: "limit", in: "query", schema: { type: "integer", default: 20 } },
-          { name: "sort", in: "query", schema: { type: "string" }, description: "Sort fields (prefix with - for descending)" }
-        ];
-      }
-    }
-    const reqSchemaRef = parseRequestSchema(route.meta?.requestSchema);
-    if (reqSchemaRef && (method === "post" || method === "put" || method === "patch")) {
-      refSchemas.add(reqSchemaRef.name);
-      const media = {
-        schema: { $ref: `#/components/schemas/${reqSchemaRef.name}` }
-      };
-      if (route.meta?.example !== void 0) media.example = route.meta.example;
+  } else if (method === "post" || method === "put") {
+    const modelName = inferModelFromPath(route.pattern);
+    const schemaKey = modelName ? ctx.tableToSchema.get(modelName) : void 0;
+    if (schemaKey) {
+      const sref = `#/components/schemas/${schemaKey}`;
       operation.requestBody = {
-        content: { [reqSchemaRef.contentType]: media }
+        required: true,
+        content: { "application/json": mediaWithExample({ $ref: sref }, route.meta?.example) }
       };
-    } else if (method === "post" || method === "put") {
-      const modelName = inferModelFromPath(route.pattern);
-      const schemaKey = modelName ? tableToSchema.get(modelName) : void 0;
-      if (schemaKey) {
-        const sref = `#/components/schemas/${schemaKey}`;
-        const media = { schema: { $ref: sref } };
-        if (route.meta?.example !== void 0) media.example = route.meta.example;
-        operation.requestBody = {
-          required: true,
-          content: { "application/json": media }
-        };
-        if (route.meta?.responses === void 0) {
-          operation.responses = {
-            "200": { description: "Successful response", content: { "application/json": { schema: { $ref: sref } } } }
-          };
-        }
-      } else if (route.meta?.example !== void 0) {
-        operation.requestBody = {
-          content: { "application/json": { schema: inferSchema(route.meta.example), example: route.meta.example } }
+      if (route.meta?.responses === void 0) {
+        operation.responses = {
+          "200": { description: "Successful response", content: { "application/json": { schema: { $ref: sref } } } }
         };
       }
+    } else if (route.meta?.example !== void 0) {
+      operation.requestBody = {
+        content: { "application/json": { schema: inferSchema(route.meta.example), example: route.meta.example } }
+      };
     }
-    const respSchemas = parseResponseSchemas(route.meta?.responseSchemas);
-    if (respSchemas.length > 0) {
-      const responses = operation.responses;
-      for (const { status, name, isList } of respSchemas) {
-        refSchemas.add(name);
-        const sref = `#/components/schemas/${name}`;
-        const schema = isList ? { type: "array", items: { $ref: sref } } : { $ref: sref };
-        responses[status] = {
-          description: status.startsWith("2") ? "Successful response" : "Response",
-          content: { "application/json": { schema } }
-        };
-      }
+  }
+}
+function operationResponseSchemas(route, operation, refSchemas) {
+  const respSchemas = parseResponseSchemas(route.meta?.responseSchemas);
+  if (respSchemas.length > 0) {
+    const responses = operation.responses;
+    for (const { status, name, isList } of respSchemas) {
+      refSchemas.add(name);
+      const sref = `#/components/schemas/${name}`;
+      const schema = isList ? { type: "array", items: { $ref: sref } } : { $ref: sref };
+      responses[status] = {
+        description: status.startsWith("2") ? "Successful response" : "Response",
+        content: { "application/json": { schema } }
+      };
     }
-    const hasExplicitSecurity = route.meta?.security !== void 0 || route.meta?.scopes !== void 0 && route.meta.scopes.length > 0;
-    if (hasExplicitSecurity) {
-      const normalized = normalizeSecurity(route.meta?.security, route.meta?.scopes);
-      operation.security = normalized.length > 0 ? sanitizeSecurity(normalized, schemes) : [];
-      if (normalized.length > 0) {
-        const responses = operation.responses;
-        if (!responses["401"]) responses["401"] = { description: "Unauthorized" };
-      }
-    } else if (routeRequiresAuth(route, method)) {
-      const requirements = [{ [defaultScheme]: [] }];
-      if (defaultScheme === "bearerAuth" && schemes.ssoSession) requirements.push({ ssoSession: [] });
-      operation.security = sanitizeSecurity(requirements, schemes);
+  }
+}
+function operationSecurity(route, method, operation, schemes, defaultScheme) {
+  const hasExplicitSecurity = route.meta?.security !== void 0 || route.meta?.scopes !== void 0 && route.meta.scopes.length > 0;
+  if (hasExplicitSecurity) {
+    const normalized = normalizeSecurity(route.meta?.security, route.meta?.scopes);
+    operation.security = normalized.length > 0 ? sanitizeSecurity(normalized, schemes) : [];
+    if (normalized.length > 0) {
       const responses = operation.responses;
       if (!responses["401"]) responses["401"] = { description: "Unauthorized" };
     }
-    spec.paths[openApiPath][method] = operation;
+  } else if (routeRequiresAuth(route, method)) {
+    const requirements = [{ [defaultScheme]: [] }];
+    if (defaultScheme === "bearerAuth" && schemes.ssoSession) requirements.push({ ssoSession: [] });
+    operation.security = sanitizeSecurity(requirements, schemes);
+    const responses = operation.responses;
+    if (!responses["401"]) responses["401"] = { description: "Unauthorized" };
   }
+}
+function buildRefSchemas(spec, refSchemas) {
   if (refSchemas.size > 0) {
     const schemas = spec.components.schemas;
     for (const name of refSchemas) {
@@ -239,10 +272,11 @@ function generate(routes, models = []) {
       }
     }
   }
+}
+function buildTags(spec, usedTags) {
   if (usedTags.length > 0) {
     spec.tags = usedTags.map((name) => ({ name }));
   }
-  return spec;
 }
 function routeRequiresAuth(route, method) {
   if (route.noAuth) return false;