swagger-tools - npm Package Compare versions

Comparing version 0.9.14 to 0.9.15

middleware/helpers.js

@@ -83,3 +83,14 @@ /*
     if (paramType.toLowerCase() === 'file') {
-      val = req.files[parameter.name] ? req.files[parameter.name][0] : undefined;
+      if (_.isArray(req.files)) {
+        val = _.find(req.files, function (file) {
+          return file.fieldname === parameter.name;
+        });
+      } else {
+        val = req.files[parameter.name] ? req.files[parameter.name] : undefined;
+      }
+
+      // Swagger does not allow an array of files
+      if (_.isArray(val)) {
+        val = val[0];
+      }
     } else if (isModelParameter(version, parameter)) {
@@ -86,0 +97,0 @@ val = req.body;

middleware/swagger-metadata.js

@@ -66,16 +66,25 @@ /*
 var urlEncodedBodyParser = bp.urlencoded(bodyParserOptions);
-var bodyParser = function (req, res, callback) {
+var bodyParser = function (req, res, next) {
   if (_.isUndefined(req.body)) {
     urlEncodedBodyParser(req, res, function (err) {
       if (err) {
-        callback(err);
+        next(err);
       } else {
-        jsonBodyParser(req, res, callback);
+        jsonBodyParser(req, res, next);
       }
     });
   } else {
-    callback();
+    next();
   }
 };
-var multiPartParser = multer(multerOptions);
+var realMultiPartParser = multer(multerOptions);
+var makeMultiPartParser = function (parser) {
+  return function (req, res, next) {
+    if (_.isUndefined(req.files)) {
+      parser(req, res, next);
+    } else {
+      next();
+    }
+  };
+};
 
@@ -178,6 +187,6 @@ // Helper functions
     // If there are files, use multer#fields
-    parsers.push(multiPartParser.fields(multiPartFields));
+    parsers.push(makeMultiPartParser(realMultiPartParser.fields(multiPartFields)));
   } else if (contentType && contentType.split(';')[0] === 'multipart/form-data') {
     // If no files but multipart form, use empty multer#array for text fields
-    parsers.push(multiPartParser.array());
+    parsers.push(makeMultiPartParser(realMultiPartParser.array()));
   }
@@ -184,0 +193,0 @@

middleware/swagger-ui/lang/en.js

@@ -31,4 +31,6 @@ 'use strict';
     "can't parse JSON.  Raw result":"can't parse JSON.  Raw result",
+    "Example Value":"Example Value",
     "Model Schema":"Model Schema",
     "Model":"Model",
+    "Click to set as parameter value":"Click to set as parameter value",
     "apply":"apply",
@@ -43,2 +45,3 @@ "Username":"Username",
     "Response Content Type":"Response Content Type",
+    "Parameter content type:":"Parameter content type:",
     "fetching resource":"fetching resource",
@@ -45,0 +48,0 @@ "fetching resource list":"fetching resource list",

middleware/swagger-ui/lang/es.js

@@ -30,2 +30,3 @@ 'use strict';
     "can't parse JSON.  Raw result":"no puede parsear el JSON.  Resultado crudo",
+    "Example Value":"Valor de Ejemplo",
     "Model Schema":"Esquema del Modelo",
@@ -32,0 +33,0 @@ "Model":"Modelo",

middleware/swagger-ui/lang/ru.js

@@ -5,3 +5,3 @@ 'use strict';
 window.SwaggerTranslator.learn({
-    "Warning: Deprecated":"Ворнинг: Депрекейтед",
+    "Warning: Deprecated":"Предупреждение: Устарело",
     "Implementation Notes":"Заметки",
@@ -24,2 +24,3 @@ "Response Class":"Пример ответа",
     "Hide Response":"Спрятать ответ",
+    "Headers":"Заголовки",
     "Response Messages":"Что может прийти в ответ",
@@ -32,4 +33,6 @@ "Try it out!":"Попробовать!",
     "can't parse JSON.  Raw result":"Не удается распарсить ответ:",
+    "Example Value":"Пример",
     "Model Schema":"Структура",
     "Model":"Описание",
+    "Click to set as parameter value":"Нажмите, чтобы испльзовать в качестве значения параметра",
     "apply":"применить",
@@ -44,8 +47,9 @@ "Username":"Имя пользователя",
     "Response Content Type":"Content Type ответа",
+    "Parameter content type:":"Content Type параметра:",
     "fetching resource":"Получение ресурса",
     "fetching resource list":"Получение ресурсов",
-    "Explore":"Поехали",
+    "Explore":"Показать",
     "Show Swagger Petstore Example Apis":"Показать примеры АПИ",
-    "Can't read from server.  It may not have the appropriate access-control-origin settings.":"Не удается получить ответ от сервера. Возможно, какая-то лажа с настройками доступа",
-    "Please specify the protocol for":"Пожалуйста, укажите протогол для",
+    "Can't read from server. It may not have the appropriate access-control-origin settings.":"Не удается получить ответ от сервера. Возможно, проблема с настройками доступа",
+    "Please specify the protocol for":"Пожалуйста, укажите протокол для",
     "Can't read swagger JSON from":"Не получается прочитать swagger json из",
@@ -52,0 +56,0 @@ "Finished Loading Resource Information. Rendering Swagger UI":"Загрузка информации о ресурсах завершена. Рендерим",

middleware/swagger-ui/lib/swagger-oauth.js

@@ -6,6 +6,6 @@ var appName;
 var realm;
-var oauth2KeyName;
 var redirect_uri;
 var clientSecret;
 var scopeSeparator;
+var additionalQueryStringParams;
 
@@ -22,3 +22,2 @@ function handleLogin() {
       if(auth.type === 'oauth2' && auth.scopes) {
-        oauth2KeyName = key;
         var scope;
@@ -35,3 +34,3 @@ if(Array.isArray(auth.scopes)) {
           for(scope in auth.scopes) {
-            scopes.push({scope: scope, description: auth.scopes[scope]});
+            scopes.push({scope: scope, description: auth.scopes[scope], OAuthSchemeKey: key});
           }
@@ -66,8 +65,12 @@ }
 
+  //TODO: only display applicable scopes (will need to pass them into handleLogin)
   popup = popupDialog.find('ul.api-popup-scopes').empty();
   for (i = 0; i < scopes.length; i ++) {
     scope = scopes[i];
-    str = '<li><input type="checkbox" id="scope_' + i + '" scope="' + scope.scope + '"/>' + '<label for="scope_' + i + '">' + scope.scope;
+    str = '<li><input type="checkbox" id="scope_' + i + '" scope="' + scope.scope + '"' +'" oauthtype="' + scope.OAuthSchemeKey +'"/>' + '<label for="scope_' + i + '">' + scope.scope ;
     if (scope.description) {
-      str += '<br/><span class="api-scope-desc">' + scope.description + '</span>';
+      if ($.map(auths, function(n, i) { return i; }).length > 1) //if we have more than one scheme, display schemes
+	    str += '<br/><span class="api-scope-desc">' + scope.description + ' ('+ scope.OAuthSchemeKey+')' +'</span>';
+	  else
+	    str += '<br/><span class="api-scope-desc">' + scope.description + '</span>';
     }
@@ -110,5 +113,21 @@ str += '</label></li>';
     var url = null;
-
-    for (var key in authSchemes) {
-      if (authSchemes.hasOwnProperty(key)) {
+    var scopes = []
+    var o = popup.find('input:checked'); 
+    var OAuthSchemeKeys = [];
+    var state;
+    for(k =0; k < o.length; k++) {
+      var scope = $(o[k]).attr('scope');
+      if (scopes.indexOf(scope) === -1)
+        scopes.push(scope);
+      var OAuthSchemeKey = $(o[k]).attr('oauthtype');      
+      if (OAuthSchemeKeys.indexOf(OAuthSchemeKey) === -1)
+          OAuthSchemeKeys.push(OAuthSchemeKey);
+    }
+    
+    //TODO: merge not replace if scheme is different from any existing 
+    //(needs to be aware of schemes to do so correctly)
+    window.enabledScopes=scopes;    
+    
+    for (var key in authSchemes) { 
+      if (authSchemes.hasOwnProperty(key) && OAuthSchemeKeys.indexOf(key) != -1) { //only look at keys that match this scope.
         var flow = authSchemes[key].flow;
@@ -121,3 +140,10 @@
           window.swaggerUi.tokenUrl = (flow === 'accessCode' ? dets.tokenUrl : null);
+          state = key;
         }
+        else if(authSchemes[key].type === 'oauth2' && flow && (flow === 'application')) {
+            var dets = authSchemes[key];
+            window.swaggerUi.tokenName = dets.tokenName || 'access_token';
+            clientCredentialsFlow(scopes, dets.tokenUrl, key);
+            return;
+        }        
         else if(authSchemes[key].grantTypes) {
@@ -143,17 +169,3 @@ // 1.2 support
     }
-    var scopes = []
-    var o = $('.api-popup-scopes').find('input:checked');
 
-    for(k =0; k < o.length; k++) {
-      var scope = $(o[k]).attr('scope');
-
-      if (scopes.indexOf(scope) === -1)
-        scopes.push(scope);
-    }
-
-    // Implicit auth recommends a state parameter.
-    var state = Math.random ();
-
-    window.enabledScopes=scopes;
-
     redirect_uri = redirectUrl;
@@ -166,2 +178,5 @@
     url += '&state=' + encodeURIComponent(state);
+    for (var key in additionalQueryStringParams) {
+        url += '&' + key + '=' + encodeURIComponent(additionalQueryStringParams[key]);
+    }
 
@@ -198,5 +213,6 @@ window.open(url);
   clientId = (o.clientId||errors.push('missing client id'));
-  clientSecret = (o.clientSecret||errors.push('missing client secret'));
+  clientSecret = (o.clientSecret||null);
   realm = (o.realm||errors.push('missing realm'));
   scopeSeparator = (o.scopeSeparator||' ');
+  additionalQueryStringParams = (o.additionalQueryStringParams||{});
 
@@ -208,3 +224,3 @@ if(errors.length > 0){
 
-  $('pre code').each(function(i, e) {hljs.highlightBlock(e)});
+  //$('pre code').each(function(i, e) {hljs.highlightBlock(e)});
   $('.api-ic').unbind();
@@ -221,10 +237,39 @@ $('.api-ic').click(function(s) {
 
+function clientCredentialsFlow(scopes, tokenUrl, OAuthSchemeKey) {
+    var params = {
+      'client_id': clientId,
+      'client_secret': clientSecret,
+      'scope': scopes.join(' '),
+      'grant_type': 'client_credentials'
+    }
+    $.ajax(
+    {
+      url : tokenUrl,
+      type: "POST",
+      data: params,
+      success:function(data, textStatus, jqXHR)
+      {
+        onOAuthComplete(data,OAuthSchemeKey);
+      },
+      error: function(jqXHR, textStatus, errorThrown)
+      {
+        onOAuthComplete("");
+      }
+    });
+    
+  }
+
 window.processOAuthCode = function processOAuthCode(data) {
+  var OAuthSchemeKey = data.state;
   var params = {
     'client_id': clientId,
-    'client_secret': clientSecret,
     'code': data.code,
     'grant_type': 'authorization_code',
     'redirect_uri': redirect_uri
+  };
+
+  if (clientSecret) {
+    params.client_secret = clientSecret;
   }
+
   $.ajax(
@@ -237,3 +282,3 @@ {
     {
-      onOAuthComplete(data);
+      onOAuthComplete(data, OAuthSchemeKey);
     },
@@ -245,5 +290,5 @@ error: function(jqXHR, textStatus, errorThrown)
   });
-}
+};
 
-window.onOAuthComplete = function onOAuthComplete(token) {
+window.onOAuthComplete = function onOAuthComplete(token,OAuthSchemeKey) {
   if(token) {
@@ -258,7 +303,10 @@ if(token.error) {
     else {
-      var b = token[window.swaggerUi.tokenName];
+      var b = token[window.swaggerUi.tokenName];      
+      if (!OAuthSchemeKey){
+          OAuthSchemeKey = token.state;
+      }
       if(b){
         // if all roles are satisfied
         var o = null;
-        $.each($('.auth .api-ic .api_information_panel'), function(k, v) {
+        $.each($('.auth .api-ic .api_information_panel'), function(k, v) { 
           var children = v;
@@ -300,6 +348,6 @@ if(children && children.childNodes) {
         });
-        window.swaggerUi.api.clientAuthorizations.add(oauth2KeyName, new SwaggerClient.ApiKeyAuthorization('Authorization', 'Bearer ' + b, 'header'));
+        window.swaggerUi.api.clientAuthorizations.add(OAuthSchemeKey, new SwaggerClient.ApiKeyAuthorization('Authorization', 'Bearer ' + b, 'header'));
       }
     }
   }
-}
+};

package.json

 {
   "name": "swagger-tools",
-  "version": "0.9.14",
+  "version": "0.9.15",
   "description": "Various tools for using and integrating with Swagger.",
@@ -5,0 +5,0 @@ "main": "index.js",

New alerts

Uses eval

Supply chain risk

Package uses eval() which is a dangerous function. This prevents the code from running in certain environments and increases the risk that the code may contain exploits or malicious behavior.

Found 1 instance in 1 package

Minified code

Quality

This package contains minified code. This may be harmless in some cases where minified code is included in packaged libraries, however packages on npm should not minify code.

Found 1 instance in 1 package

Fixed alerts

Uses eval

Supply chain risk

Package uses eval() which is a dangerous function. This prevents the code from running in certain environments and increases the risk that the code may contain exploits or malicious behavior.

Found 1 instance in 1 package

High entropy strings

Supply chain risk

Contains high entropy strings. This could be a sign of encrypted data, leaked secrets or obfuscated code.

Found 1 instance in 1 package

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

Improved metrics

Number of low supply chain risk alerts

8

decreased by-11.11%

Worsened metrics

Total package byte prevSize

3664065

decreased by-2.15%

Number of package files

73

decreased by-2.67%

Lines of code

42255

decreased by-6.61%

Number of low quality alerts

4

increased by33.33%

No dependency changes