From dda0cc635e9586bf8db49f40b56bbb82d28cd04e Mon Sep 17 00:00:00 2001
From: "Nolann B." <100787331+nolannbiron@users.noreply.github.com>
Date: Thu, 13 Feb 2025 16:44:06 +0100
Subject: [PATCH] Flatten OpenAPI security object (#2818)

---
 .changeset/mighty-cheetahs-jog.md              |  5 +++++
 .../react-openapi/src/fetchOpenAPIOperation.ts | 18 +++++++++++++++++-
 2 files changed, 22 insertions(+), 1 deletion(-)
 create mode 100644 .changeset/mighty-cheetahs-jog.md

diff --git a/.changeset/mighty-cheetahs-jog.md b/.changeset/mighty-cheetahs-jog.md
new file mode 100644
index 000000000..3d4d01c5c
--- /dev/null
+++ b/.changeset/mighty-cheetahs-jog.md
@@ -0,0 +1,5 @@
+---
+'@gitbook/react-openapi': patch
+---
+
+Flatten OpenAPI security object
diff --git a/packages/react-openapi/src/fetchOpenAPIOperation.ts b/packages/react-openapi/src/fetchOpenAPIOperation.ts
index 6ecc4df42..e5a30ee33 100644
--- a/packages/react-openapi/src/fetchOpenAPIOperation.ts
+++ b/packages/react-openapi/src/fetchOpenAPIOperation.ts
@@ -64,7 +64,7 @@ export async function fetchOpenAPIOperation(
     }
 
     const servers = 'servers' in schema ? (schema.servers ?? []) : [];
-    const security = operation.security ?? schema.security ?? [];
+    const security = flattenSecurities(operation.security ?? schema.security ?? []);
 
     // Resolve securities
     const securities: OpenAPIOperationData['securities'] = [];
@@ -179,3 +179,19 @@ function getOperationByPathAndMethod(
     }
     return pathObject[normalizedMethod];
 }
+
+/**
+ * Flatten security objects in case they are nested.
+ * @example [{bearerAuth:[], basicAuth:[]}] => [{ bearerAuth: [] }, { basicAuth: [] }]
+ */
+function flattenSecurities(security: OpenAPIV3.SecurityRequirementObject[]) {
+    if (!Array.isArray(security) || security.length === 0) {
+        return [];
+    }
+
+    return security.flatMap((securityObject) => {
+        return Object.entries(securityObject).map(([authType, config]) => ({
+            [authType]: config,
+        }));
+    });
+}