fix: Add 401 response for non-public pages

Signed-off-by: provokateurin <kate@provokateurin.de>

Author: provokateurin

generate-spec.php

@@ -465,7 +465,6 @@
 		$isIgnored = Helpers::classMethodHasAnnotationOrAttribute($methodFunction, 'IgnoreOpenAPI');
 		$isPasswordConfirmation = Helpers::classMethodHasAnnotationOrAttribute($methodFunction, 'PasswordConfirmationRequired');
 		$isExApp = Helpers::classMethodHasAnnotationOrAttribute($methodFunction, 'ExAppRequired');
-		$isCORS = Helpers::classMethodHasAnnotationOrAttribute($methodFunction, 'CORS');
 		$scopes = Helpers::getOpenAPIAttributeScopes($classMethod, $routeName);
 
 		if ($isIgnored) {
@@ -719,14 +718,14 @@
 						$mergedContentTypeResponses[$contentType] = [];
 					} else {
 						$schema = Helpers::cleanEmptyResponseArray($contentTypeResponses[0]->type->toArray());
-						$mergedContentTypeResponses[$contentType] = ['schema' => Helpers::wrapOCSResponse($route, $contentTypeResponses[0], $schema)];
+						$mergedContentTypeResponses[$contentType] = ['schema' => $route->isOCS && $contentTypeResponses[0]->isOCS() ? Helpers::wrapOCSResponse($schema) : $schema];
 					}
 				} else {
 					$mergedContentTypeResponses[$contentType] = [
 						'schema' => [
 							[$hasEmpty ? 'anyOf' : 'oneOf' => array_map(function (ControllerMethodResponse $response) use ($route): \stdClass|array {
 								$schema = Helpers::cleanEmptyResponseArray($response->type->toArray());
-								return Helpers::wrapOCSResponse($route, $response, $schema);
+								return $route->isOCS && $response->isOCS() ? Helpers::wrapOCSResponse($schema) : $schema;
 							}, $uniqueResponses)],
 						],
 					];
@@ -757,6 +756,27 @@
 		if ($route->isPublic) {
 			// Add empty authentication, meaning that it's optional. We can't know if there is a difference in behaviour for authenticated vs. unauthenticated access on public pages (e.g. capabilities)
 			$security[] = new stdClass();
+		} else {
+			$mergedResponses[401] ??= [
+				'description' => 'Current user is not logged in',
+				'content' => [
+					'application/json' => [
+						'schema' => $route->isOCS
+							? Helpers::wrapOCSResponse(new stdClass())
+							: [
+								'type' => 'object',
+								'required' => [
+									'message',
+								],
+								'properties' => [
+									'message' => [
+										'type' => 'string',
+									],
+								],
+							],
+					],
+				],
+			];
 		}
 		if (!$route->isCORS) {
 			// Bearer auth is not allowed on CORS routes

src/ControllerMethodResponse.php

@@ -19,4 +19,8 @@ public function __construct(
 		public ?array $headers = null,
 	) {
 	}
+
+	public function isOCS(): bool {
+		return $this->className === 'DataResponse' || (str_starts_with($this->className, 'OCS') && str_ends_with($this->className, 'Exception'));
+	}
 }

src/Helpers.php

@@ -110,34 +110,28 @@ public static function mergeSchemas(array $schemas): mixed {
 		return $result;
 	}
 
-	public static function wrapOCSResponse(Route $route, ControllerMethodResponse $response, array|stdClass $schema): array|stdClass {
-		if ($route->isOCS
-			&& ($response->className === 'DataResponse'
-				|| (str_starts_with($response->className, 'OCS') && str_ends_with($response->className, 'Exception')))) {
-			return [
-				'type' => 'object',
-				'required' => [
-					'ocs',
-				],
-				'properties' => [
-					'ocs' => [
-						'type' => 'object',
-						'required' => [
-							'meta',
-							'data',
-						],
-						'properties' => [
-							'meta' => [
-								'$ref' => '#/components/schemas/OCSMeta',
-							],
-							'data' => $schema,
+	public static function wrapOCSResponse(array|stdClass $schema): array|stdClass {
+		return [
+			'type' => 'object',
+			'required' => [
+				'ocs',
+			],
+			'properties' => [
+				'ocs' => [
+					'type' => 'object',
+					'required' => [
+						'meta',
+						'data',
+					],
+					'properties' => [
+						'meta' => [
+							'$ref' => '#/components/schemas/OCSMeta',
 						],
+						'data' => $schema,
 					],
 				],
-			];
-		}
-
-		return $schema;
+			],
+		];
 	}
 
 	public static function cleanEmptyResponseArray(array $schema): array|stdClass {