How to document the enpoints with jwt authentication about huma HOT 2 CLOSED

@ross96D you would do something like this:

router := chi.NewMux()

// TODO: add JWT middleware if desired.

config := huma.DefaultConfig("My API", "1.0.0")
config.Components.SecuritySchemes = map[string]*huma.SecurityScheme{
	"bearer": {
		Type: "oauth2",
		Flows: &huma.OAuthFlows{
			AuthorizationCode: &huma.OAuthFlow{
				AuthorizationURL: "https://example.com/oauth/authorize",
				TokenURL:         "https://example.com/oauth/token",
				Scopes: map[string]string{
					"scope1": "Scope 1 description...",
					"scope2": "Scope 2 description...",
				},
			},
		},
	},
}

api := humachi.New(router, config)

huma.Register(api, huma.Operation{
	OperationID: "get-greeting",
	Summary:     "Get a greeting",
	Method:      http.MethodGet,
	Path:        "/greeting/{name}",
	Security: []map[string][]string{
		{"bearer": {"scope1"}},
	},
}, func(ctx context.Context, input *GreetingInput) (*GreetingOutput, error) {
	// TODO: operation implementation goes here
	// TODO: check scopes if desired & depending on middleware
	return nil, nil
})

Notes:

1. Huma doesn't check the JWT itself. You can use Huma to document it in the OpenAPI, and then use some other middleware (e.g. https://github.com/go-chi/jwtauth) for the validation if your API gateway doesn't handle the authn/authz.
2. First you define the security scheme with the auth information like the authorize/token URL. You can also define ClientCredentials there for machine-to-machine auth flows.
3. Next, whenever you register an operation you add the Security setting to map to the auth name and any scopes it needs (scopes can also be empty). If you don't need per-operation control over this you can also set the auth at the API config level in config.Security and it'll apply to all operations.

You can also check out https://rest.sh/#/openapi?id=autoconfiguration which is available in Huma as a convenience you can set via config.Extensions["x-cli-config"] = huma.AutoConfig{ /* ... */ }

I'll try and add this to the How-To section of the docs site ASAP 😄

from huma.

Thank you for your answer. I read the documentation and didn't see about this, maybe is worth it to add some explanation about it.

Also I want to mention that when implementing this i found that the base router on huma where the routes gets added is the router you pass at the beginning. So is not compatible with the chi.Group api as it has no ways to interact with the embedded created router.

I made a custom fix for this on the chi adapter but maybe is worth considering a way to easily do this in huma..

Great work, thank you 👍

from huma.