Private endpoints remain hidden after authorizing

[adlmtl]

Using SERVE_PUBLIC=True as shown in the docs. After fetching a jwt token and authorizing in the swagger-ui the page does not reload, and I am still only able to see public endpoints.

I've also tried refreshing the page manually with persistAuthorization = True being set and still no luck.

However if i call the schema endpoint it does return my complete schema with all private endpoints if I am authorized, it just doesn't reflect this in the swagger-ui

SPECTACULAR_SETTINGS = {
        'SERVE_PUBLIC': False,

        "SWAGGER_UI_SETTINGS": {
            "persistAuthorization": True,
        },
    }

I'm using simpleJWT for auth.

[tfranzel]

hi @adlmtl, interesting! so that would basically mean that the JWT token is not sent by SwaggerUI when requesting the schema url.

that kind of makes sense somehow. the JWT token is used by SwaggerUI for building requests but it is no used by it's own bootstrapping. this all works automatically when cookie auth is used, but for JWT one must explicit set a header, which is why it fails here.

SwaggerUI would have to be modified so that the schema url is reloaded on auth and also that the authorization is reused for requesting the schema.

[adlmtl]

yasg behaves this way, so there's probably something that can be done. Any thoughts how I could progress? Thanks for responding so quickly!

[tfranzel]

ahh i see. yes, yasg has a more hands-on approach to SwaggerUI. they have a custom init logic and patches going on, whereas we currently use only plain upstream SwaggerUI. this may be the first time we reached the limit of upstream SwaggerUI.

the magic is here:
https://github.com/axnsan12/drf-yasg/blob/9ccf24c27ad46db4f566170553d49d687b6d21d6/src/drf_yasg/static/drf-yasg/swagger-ui-init.js#L162

we may have to patch SwaggerUI init logic for this. happy to look at proposals here as i'm lacking the time to tackle this atm.

[tfranzel]

please review and test #552

[tfranzel]

closing this issue for now. feel free to comment if anything is missing or not working and we will follow-up.