added device authorization flow; added tests

Author: tatomyr

.changeset/spotty-bushes-win.md

@@ -0,0 +1,6 @@
+---
+"@redocly/openapi-core": minor
+"@redocly/cli": minor
+---
+
+Added basic support for **OpenAPI 3.2** specification.

CONTRIBUTING.md

@@ -18,9 +18,14 @@ Before submitting your contribution though, please make sure to take a moment an
 
 ## Issue reporting guidelines
 
-- Before opening a new issue, try to make sure the same problem or idea hasn't already been reported. You can do that on the [Issues page](https://github.com/Redocly/redocly-cli/issues) in the repository and using the filter `is:issue` combined with some keywords relevant to your idea or problem. It helps us notice that more people have the same issue or use-case, and reduces the chance of getting your issue marked as a duplicate. Plus, you can even find some workarounds for your issue in the comments of a previously reported one!
+- Before opening a new issue, try to make sure the same problem or idea hasn't already been reported.
+  You can do that on the [Issues page](https://github.com/Redocly/redocly-cli/issues) in the repository and using the filter `is:issue` combined with some keywords relevant to your idea or problem.
+  It helps us notice that more people have the same issue or use-case, and reduces the chance of getting your issue marked as a duplicate.
+  Plus, you can even find some workarounds for your issue in the comments of a previously reported one!
 
-- The best way to get your bug fixed is to provide a (reduced) test case. This means listing and explaining the steps we should take to try and hit the same problem you're having. It helps us understand in which conditions the issue appears, and gives us a better idea of what may be causing it.
+- The best way to get your bug fixed is to provide a (reduced) test case.
+  This means listing and explaining the steps we should take to try and hit the same problem you're having.
+  It helps us understand in which conditions the issue appears, and gives us a better idea of what may be causing it.
 
 - Abide by our [Code of Conduct](https://redocly.com/code-of-conduct/) in all your interactions on this repository, and show patience and respect to other community members.
 
@@ -33,8 +38,15 @@ Before submitting a pull request, please make sure the following is done:
 1. If you've fixed a bug or added code that should be tested, don't forget to add [tests](#tests)!
 1. Ensure the test suite passes (see the [Tests section](#tests) for more details).
 1. Format your code with prettier (`npm run prettier`).
-1. Each feat/fix PR should also contain a changeset (to create one, run `npx changeset`; if your changes are scoped to `packages/core` or `packages/respect-core` but also affect Redocly CLI behavior, please include the `@redocly/cli` package as well). Please describe what you've done in this PR using sentence case (you can refer to our [changelog](https://redocly.com/docs/cli/changelog/)). This produces a file in `.changeset` folder. Please commit this file along with your changes. If the PR doesn't need a changeset (for example, it is a small change, or updates only documentation), add the 'no changeset needed' label to the PR.
-1. When merging a PR, make sure to remove all redundant commit information (like intermediate commit descriptions). Please leave only the main commit description (plus co-authors if needed). If you think it makes sense to keep several commit descriptions, please rebase your PR instead of squashing it to preserve the commits. Please use the [Conventional Commits](https://www.conventionalcommits.org/en/v1.0.0/) format.
+1. Each feat/fix PR should also contain a changeset (to create one, run `npx changeset`;
+   if your changes are scoped to `packages/core` or `packages/respect-core` but also affect Redocly CLI behavior, please include the `@redocly/cli` package as well).
+   Please describe what you've done in this PR using sentence case (you can refer to our [changelog](https://redocly.com/docs/cli/changelog/)).
+   This produces a file in `.changeset` folder.
+   Please commit this file along with your changes. If the PR doesn't need a changeset (for example, it is a small change, or updates only documentation), add the 'no changeset needed' label to the PR.
+1. When merging a PR, make sure to remove all redundant commit information (like intermediate commit descriptions).
+   Please leave only the main commit description (plus co-authors if needed).
+   If you think it makes sense to keep several commit descriptions, please rebase your PR instead of squashing it to preserve the commits.
+   Please use the [Conventional Commits](https://www.conventionalcommits.org/en/v1.0.0/) format.
 
 ## Development setup
 
@@ -87,7 +99,8 @@ When contributing to Redocly CLI, it's important to follow these logging guideli
    logger.output(JSON.stringify(stats, null, 2));
    ```
 
-4. Avoid using `console.log`, `console.error`, or direct `process.stdout.write`/`process.stderr.write` calls. Always use the logger methods to ensure consistent output formatting and proper stream usage.
+4. Avoid using `console.log`, `console.error`, or direct `process.stdout.write`/`process.stderr.write` calls.
+   Always use the logger methods to ensure consistent output formatting and proper stream usage.
 
 ## Local source code usage
 
@@ -106,7 +119,8 @@ To test local changes as a package, you can use the following steps:
 1. Run `npm run pack:prepare` in the repository's root.
    This generates **redocly-cli.tgz**, **respect-core.tgz**, and **openapi-core.tgz** files.
 
-1. Copy those **.tgz** files to a destination folder and then run `npm install redocly-cli.tgz` there to install Redocly CLI. To install `openapi-core` do the same but with **openapi-core.tgz** file.
+1. Copy those **.tgz** files to a destination folder and then run `npm install redocly-cli.tgz` there to install Redocly CLI.
+   To install `openapi-core` do the same but with **openapi-core.tgz** file.
 
 ## Contribute documentation
 
@@ -239,7 +253,8 @@ const err = result.stderr ? result.stderr.toString() : '';
 return `${out}\n${err}`;
 ```
 
-This is intentional behavior to have consistent command outputs where NodeJS handles the output buffering. When writing tests, keep in mind that the order of stdout and stderr messages in the actual output might differ from what you see in the terminal, but the combined output will be consistent for snapshot testing.
+This is intentional behavior to have consistent command outputs where NodeJS handles the output buffering.
+When writing tests, keep in mind that the order of stdout and stderr messages in the actual output might differ from what you see in the terminal, but the combined output will be consistent for snapshot testing.
 
 ### Smoke tests
 

__tests__/check-config/wrong-config-type-extensions-in-assertions/snapshot.txt

@@ -1,6 +1,6 @@
 [1] redocly.yaml:10:13 at #/rules/rule~1metadata-lifecycle/subject/type
 
-`type` can be one of the following only: "any", "Root", "Tag", "TagList", "TagGroups", "TagGroup", "ExternalDocs", "Example", "ExamplesMap", "EnumDescriptions", "SecurityRequirement", "SecurityRequirementList", "Info", "Contact", "License", "Logo", "Paths", "PathItem", "Parameter", "ParameterItems", "ParameterList", "Operation", "Examples", "Header", "Responses", "Response", "Schema", "Xml", "SchemaProperties", "NamedSchemas", "NamedResponses", "NamedParameters", "NamedSecuritySchemes", "SecurityScheme", "XCodeSample", "XCodeSampleList", "XServerList", "XServer", "Server", "ServerList", "ServerVariable", "ServerVariablesMap", "Callback", "CallbacksMap", "RequestBody", "MediaTypesMap", "MediaType", "Encoding", "EncodingMap", "HeadersMap", "Link", "DiscriminatorMapping", "Discriminator", "Components", "LinksMap", "NamedExamples", "NamedRequestBodies", "NamedHeaders", "NamedLinks", "NamedCallbacks", "ImplicitFlow", "PasswordFlow", "ClientCredentials", "AuthorizationCode", "OAuth2Flows", "XUsePkce", "WebhooksMap", "XMetaData", "PatternProperties", "NamedPathItems", "DependentRequired", "HttpServerBinding", "HttpChannelBinding", "HttpMessageBinding", "HttpOperationBinding", "WsServerBinding", "WsChannelBinding", "WsMessageBinding", "WsOperationBinding", "KafkaServerBinding", "KafkaTopicConfiguration", "KafkaChannelBinding", "KafkaMessageBinding", "KafkaOperationBinding", "AnypointmqServerBinding", "AnypointmqChannelBinding", "AnypointmqMessageBinding", "AnypointmqOperationBinding", "AmqpServerBinding", "AmqpChannelBinding", "AmqpMessageBinding", "AmqpOperationBinding", "Amqp1ServerBinding", "Amqp1ChannelBinding", "Amqp1MessageBinding", "Amqp1OperationBinding", "MqttServerBindingLastWill", "MqttServerBinding", "MqttChannelBinding", "MqttMessageBinding", "MqttOperationBinding", "Mqtt5ServerBinding", "Mqtt5ChannelBinding", "Mqtt5MessageBinding", "Mqtt5OperationBinding", "NatsServerBinding", "NatsChannelBinding", "NatsMessageBinding", "NatsOperationBinding", "JmsServerBinding", "JmsChannelBinding", "JmsMessageBinding", "JmsOperationBinding", "SolaceServerBinding", "SolaceChannelBinding", "SolaceMessageBinding", "SolaceDestination", "SolaceOperationBinding", "StompServerBinding", "StompChannelBinding", "StompMessageBinding", "StompOperationBinding", "RedisServerBinding", "RedisChannelBinding", "RedisMessageBinding", "RedisOperationBinding", "MercureServerBinding", "MercureChannelBinding", "MercureMessageBinding", "MercureOperationBinding", "ServerBindings", "ChannelBindings", "MessageBindings", "OperationBindings", "ServerMap", "ChannelMap", "Channel", "ParametersMap", "MessageExample", "NamedMessages", "NamedMessageTraits", "NamedOperationTraits", "NamedCorrelationIds", "SecuritySchemeFlows", "Message", "OperationTrait", "OperationTraitList", "MessageTrait", "MessageTraitList", "MessageExampleList", "CorrelationId", "Dependencies", "OperationReply", "OperationReplyAddress", "NamedTags", "NamedExternalDocs", "NamedChannels", "NamedOperations", "NamedOperationReplies", "NamedOperationRelyAddresses", "SecuritySchemeList", "MessageList", "SourceDescriptions", "OpenAPISourceDescription", "ArazzoSourceDescription", "Parameters", "ReusableObject", "Workflows", "Workflow", "Steps", "Step", "Replacement", "ExtendedOperation", "ExtendedSecurityList", "ExtendedSecurity", "Outputs", "CriterionObject", "XPathCriterion", "JSONPathCriterion", "SuccessActionObject", "OnSuccessActionList", "FailureActionObject", "OnFailureActionList", "NamedInputs", "NamedSuccessActions", "NamedFailureActions", "Actions", "Action", "SpecExtension".
+`type` can be one of the following only: "any", "Root", "Tag", "TagList", "TagGroups", "TagGroup", "ExternalDocs", "Example", "ExamplesMap", "EnumDescriptions", "SecurityRequirement", "SecurityRequirementList", "Info", "Contact", "License", "Logo", "Paths", "PathItem", "Parameter", "ParameterItems", "ParameterList", "Operation", "Examples", "Header", "Responses", "Response", "Schema", "Xml", "SchemaProperties", "NamedSchemas", "NamedResponses", "NamedParameters", "NamedSecuritySchemes", "SecurityScheme", "XCodeSample", "XCodeSampleList", "XServerList", "XServer", "Server", "ServerList", "ServerVariable", "ServerVariablesMap", "Callback", "CallbacksMap", "RequestBody", "MediaTypesMap", "MediaType", "Encoding", "EncodingMap", "HeadersMap", "Link", "DiscriminatorMapping", "Discriminator", "Components", "LinksMap", "NamedExamples", "NamedRequestBodies", "NamedHeaders", "NamedLinks", "NamedCallbacks", "ImplicitFlow", "PasswordFlow", "ClientCredentials", "AuthorizationCode", "OAuth2Flows", "XUsePkce", "WebhooksMap", "XMetaData", "PatternProperties", "NamedPathItems", "DependentRequired", "DeviceAuthorization", "HttpServerBinding", "HttpChannelBinding", "HttpMessageBinding", "HttpOperationBinding", "WsServerBinding", "WsChannelBinding", "WsMessageBinding", "WsOperationBinding", "KafkaServerBinding", "KafkaTopicConfiguration", "KafkaChannelBinding", "KafkaMessageBinding", "KafkaOperationBinding", "AnypointmqServerBinding", "AnypointmqChannelBinding", "AnypointmqMessageBinding", "AnypointmqOperationBinding", "AmqpServerBinding", "AmqpChannelBinding", "AmqpMessageBinding", "AmqpOperationBinding", "Amqp1ServerBinding", "Amqp1ChannelBinding", "Amqp1MessageBinding", "Amqp1OperationBinding", "MqttServerBindingLastWill", "MqttServerBinding", "MqttChannelBinding", "MqttMessageBinding", "MqttOperationBinding", "Mqtt5ServerBinding", "Mqtt5ChannelBinding", "Mqtt5MessageBinding", "Mqtt5OperationBinding", "NatsServerBinding", "NatsChannelBinding", "NatsMessageBinding", "NatsOperationBinding", "JmsServerBinding", "JmsChannelBinding", "JmsMessageBinding", "JmsOperationBinding", "SolaceServerBinding", "SolaceChannelBinding", "SolaceMessageBinding", "SolaceDestination", "SolaceOperationBinding", "StompServerBinding", "StompChannelBinding", "StompMessageBinding", "StompOperationBinding", "RedisServerBinding", "RedisChannelBinding", "RedisMessageBinding", "RedisOperationBinding", "MercureServerBinding", "MercureChannelBinding", "MercureMessageBinding", "MercureOperationBinding", "ServerBindings", "ChannelBindings", "MessageBindings", "OperationBindings", "ServerMap", "ChannelMap", "Channel", "ParametersMap", "MessageExample", "NamedMessages", "NamedMessageTraits", "NamedOperationTraits", "NamedCorrelationIds", "SecuritySchemeFlows", "Message", "OperationTrait", "OperationTraitList", "MessageTrait", "MessageTraitList", "MessageExampleList", "CorrelationId", "Dependencies", "OperationReply", "OperationReplyAddress", "NamedTags", "NamedExternalDocs", "NamedChannels", "NamedOperations", "NamedOperationReplies", "NamedOperationRelyAddresses", "SecuritySchemeList", "MessageList", "SourceDescriptions", "OpenAPISourceDescription", "ArazzoSourceDescription", "Parameters", "ReusableObject", "Workflows", "Workflow", "Steps", "Step", "Replacement", "ExtendedOperation", "ExtendedSecurityList", "ExtendedSecurity", "Outputs", "CriterionObject", "XPathCriterion", "JSONPathCriterion", "SuccessActionObject", "OnSuccessActionList", "FailureActionObject", "OnFailureActionList", "NamedInputs", "NamedSuccessActions", "NamedFailureActions", "Actions", "Action", "SpecExtension".
 
  8 | rule/metadata-lifecycle:
  9 |   subject:

__tests__/commands.test.ts

@@ -398,6 +398,7 @@ describe('E2E', () => {
         'references-in-parameters',
         'ignore-decorators',
         'multi-references-to-one-file',
+        'oas3.2',
       ];
 
       test.each(testDirNames)('test: %s', async (dir) => {

__tests__/join/oas3.2/bar.yaml

@@ -0,0 +1,41 @@
+openapi: 3.2.0
+info:
+  title: Test2
+  version: v2
+tags:
+  - name: successfully
+  - name: books
+    summary: Books & Literature
+    description: Book catalog and recommendations
+    parent: products
+    kind: nav
+    wrong: fail!
+paths:
+  /products:
+    additionalOperations:
+      test:
+        summary: Additional op test
+        wrong: Should catch wrong fields in additionalOperations!
+    query:
+      summary: Advanced product search
+      wrong: Should catch wrong fields in the QUERY method!
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                filter:
+                  type: object
+                sort:
+                  type: array
+                  items:
+                    type: string
+components:
+  securitySchemes:
+    api_key:
+      type: apiKey
+      in: header
+      name: X-API-Key
+      deprecated: true

__tests__/join/oas3.2/foo.yaml

@@ -0,0 +1,105 @@
+openapi: 3.2.0
+info:
+  title: Test
+  version: v1
+security: []
+servers:
+  - name: Should allow name
+    url: http://localhost
+    wrong: Should catch wrong fields in servers!
+$self: Should pass
+tags:
+  - name: cds
+    summary: Music CDs
+    description: Music CD catalog and reviews
+    parent: products
+    kind: nav
+
+  - name: giftcards
+    summary: Gift Cards
+    description: Digital and physical gift cards
+    parent: products
+    kind: nav
+
+  - name: digital-delivery
+    summary: Digital Delivery
+    description: Instantly delivered digital products
+    kind: badge
+
+paths:
+  /products:
+    get:
+      tags:
+        - giftcards
+        - digital-delivery
+      summary: List available gift cards
+      responses:
+        '200':
+          description: Search results
+  /stream:
+    get:
+      summary: Stream
+      responses:
+        200:
+          description: Stream of updates
+          content:
+            text/event-stream:
+              itemSchema: # Should allow itemSchema
+                type: object
+                properties:
+                  id: { type: string }
+                  data: { type: object }
+  /thing:
+    get:
+      summary: a sample api
+      responses:
+        '200':
+          description: OK
+          content:
+            multipart/mixed:
+              itemSchema: # Should allow itemSchema
+                $comment: A single data image from the device
+              itemEncoding: # Should allow itemEncoding
+                contentType: image/jpg
+  /querystring:
+    parameters:
+      - in: querystring
+        name: querystring_test
+        content:
+          application/x-www-form-urlencoded:
+            schema:
+              type: object
+              properties:
+                foo:
+                  type: string
+                bar:
+                  type: boolean
+            examples:
+              spacesAndPluses:
+                description: Note handling of spaces and "+" per media type.
+                dataValue:
+                  foo: a + b
+                  bar: true
+                serializedValue: foo=a+%2B+b&bar=true
+        examples:
+          spacesAndPluses:
+            description: |
+              Note that no additional percent encoding is done, as this
+              media type is URI query string-ready by definition.
+            dataValue:
+              foo: a + b
+              bar: true
+            serializedValue: foo=a+%2B+b&bar=true
+components:
+  securitySchemes:
+    petstore_auth:
+      type: oauth2
+      deprecated: true # Should allow deprecation
+      oauth2MetadataUrl: http://localhost # Should be allowed
+      flows:
+        implicit:
+          authorizationUrl: https://example.org/api/oauth/dialog
+          wrong: Should catch wrong prop in oauth2 flows!
+          scopes:
+            write:pets: modify pets in your account
+            read:pets: read your pets