add tests for security schemes prefixed with x- and X-

[rpmccarter]

Creates test cases for #54 . Test case passes for X-, but fails for x-. Not confident enough to contribute a fix, so any help fixing these test cases would be greatly appreciated.

Hopefully adding this will prevent regressions in the future!

[daveshanley]

Hi, I have looked into this today again as I was looking through the backlog.

This use case cannot be supported. X- is a valid header prefix, but x- is not and cannot be. Any field that begins with x- is considered an extension.

https://spec.openapis.org/oas/latest.html#specificationExtensions

I can't make this work, it would mean that extensions are not supported for SecurityScheme objects, which would violate the spec. When in fact using any non-extension field with a prefix of lowercase x- is actually a violation of the spec.

Thanks.

[rpmccarter]

Hey, thanks for the reply! This isn't a huge deal for me any more, but just wanted to respond to your comment - feel free to take it or leave it!

Extensions aren't allowed just anywhere in an OpenAPI document. The OpenAPI Spec v3.1.0 explicitly states exactly which fields may be extended with Specification Extensions. If you refer to the link you sent and search the page for "This object MAY be extended with Specification Extensions", you'll see 27 objects that can be extended. If you take a look at the entry for the Components Object, you'll see that the Components Object itself can be extended, but the securitySchemes field is just a map from strings to Security Scheme Objects. While the Security Scheme Object itself can be extended with Specification Extensions, nowhere in the spec does it state that the securitySchemes map can be extended.

Just below the table of fixed fields for the Components Object, you'll also see the following:

All the fixed fields declared above are objects that MUST use keys that match the regular expression: ^[a-zA-Z0-9\.\-_]+$.

This seems to suggest that x-foo-bar is a perfectly valid key for the securitySchemes object.