fix: optional auth metadata

[jannyHou]

Description

static endpoint like the homepage in the shopping example doesn't have a controller, thus the metadata injected for the auth action should be optional.
Related to loopbackio/loopback4-example-shopping#26

Checklist

• npm test passes on your machine
• New tests added or existing tests modified to cover all changes
• Code conforms with the style guide
• API Documentation in code was updated
• Documentation in /docs/site was updated
• Affected artifact templates in packages/cli were updated
• Affected example projects in examples/* were updated

[bajtos]

static endpoint like the homepage in the shopping example doesn't have a controller, thus the metadata injected for the auth action should be optional.

How about handler-based routes? There is not controller name & method name for these routes too, but I think there should be a way how to invoke authentication for them.

const spec: OperationObject = { /*...*/ };
function greet(name: string) {
  return `hello ${name}`;
}

app.route('get', '/', spec, greet);

This is just something to consider, no need to fix this as part of this pull request.

The changes looks reasonable to me when I consider them as a quick fix, please add some tests for verification.

[bajtos]

Please add some tests for verification.

[raymondfeng]

@bajtos The security property of OpenAPI OperationObject can be potentially used to include such metadata. For non-controller routes, we probably should bind the operation spec in request context.

[bajtos]

@jannyHou based on the comments above, I think this pull request is going in the right direction. The remaining task is to add tests to verify the changes.

[b-admike]

besides one suggestion/comment, LGTM overall.

[b-admike]

Can we separate this test into two? i.e. one for class missing and the other class defined but method missing? or is that not useful?

[jannyHou]

@b-admike The method lives in the controller, so if the controller class is missing then the method will definitely be missing. Which means the only valid scenario is no controller class + no method.

What we could improve in the next PR is the scenario that Miroslav brings in his comment:

const spec: OperationObject = { /*...*/ };
function greet(name: string) {
  return `hello ${name}`;
}

app.route('get', '/', spec, greet);

And as Raymond said, the auth metadata could be included in the OpenAPI spec.