OpenApi by Skrypt · Pull Request #19016 · OrchardCMS/OrchardCore

Skrypt · 2026-03-17T04:09:59Z

Summary

Introduces the OrchardCore.OpenApi module, providing OpenAPI specification generation and three interactive API documentation UIs for Orchard Core.

Swagger UI (/swagger) — Interactive API explorer with "Try it out" support
ReDoc (/redoc) — Read-only API reference documentation
Scalar (/scalar/v1) — Modern API reference with built-in HTTP client

Each UI can be individually enabled/disabled from the admin settings page (Settings > OpenApi). All endpoints are protected by the ApiViewContent permission (granted to Administrators by default) — unauthenticated users are redirected to /admin, unauthorized users receive 403.

Authentication

The module supports two authentication modes for the "Try it out" / "Send" buttons:

Cookie authentication (default) — Works out of the box. If you're logged into the admin, API calls from the UIs automatically include your session cookie. No configuration needed.
OAuth2 Authorization Code + PKCE — Configurable from the settings page. Adds an "Authorize" button to Swagger UI and Scalar. The OAuth2 endpoints can point to the local OpenID Connect server, a different tenant, or an external provider.

What's included

Component	Description
`Startup.cs`	Registers OpenAPI spec generation (ASP.NET Core + Swashbuckle), conditionally enables UIs, adds auth middleware
`OpenApiSettings`	Site-level settings: UI toggles + OAuth2 configuration (Authorization URL, Token URL, Client ID, Scopes)
`OpenApiSettingsDisplayDriver`	Admin settings page driver
`OpenApiPermissions`	`ApiViewContent` permission
`ProblemDetailsApiControllerExtensions`	Extension methods for standardized RFC 9457 error responses (`ApiBadRequestProblem`, `ApiNotFoundProblem`, `ApiValidationProblem`, etc.)
`OrchardCore.OpenApi.nswag`	NSwag configuration for generating TypeScript (Axios) and C# (HttpClient) clients from the live spec
Documentation	Full docs at `src/docs/reference/modules/OpenApi/README.md`

New dependencies

Microsoft.AspNetCore.OpenApi 10.0.5
Scalar.AspNetCore 2.0.0
Swashbuckle.AspNetCore.SwaggerGen / SwaggerUI / ReDoc 10.1.4

TODO:

Generate NSwag files with all modules that provides an API endpoint enabled. It is currently generated against the "TheBlog" recipe only.

This is a work in progress. Pushing a PR to share.

# Conflicts: # Directory.Packages.props # OrchardCore.sln # src/OrchardCore.Build/TargetFrameworks.props

Refactor all Cypress functional tests in a 1:1 migration to Playwright.

The CI runners have Yarn 1.x globally but the project uses Yarn 4.9.4 via packageManager field. Adding corepack enable ensures the correct Yarn version is used. Also removes unnecessary cd into subdirectory for functional_all_db.yml since yarn workspace commands run from root.

* Initial plan * Refactor Playwright functional tests from TypeScript to C# - Remove TypeScript Playwright test project (test/OrchardCore.Tests.Playwright) - Create C# Playwright test project at test/OrchardCore.Tests.Functional - Add xUnit v3 test classes mirroring all original TS tests - Add helper classes for auth, tenants, configuration, lifecycle, etc. - Update all CI workflows to use dotnet test instead of yarn/npm - Update OrchardCore.slnx, Directory.Packages.props, AGENTS.md - Revert root package.json (remove Playwright workspace/scripts) Co-authored-by: Skrypt <3228637+Skrypt@users.noreply.github.com> * Fix code review feedback: use base-32 encoding and static members Co-authored-by: Skrypt <3228637+Skrypt@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: Skrypt <3228637+Skrypt@users.noreply.github.com>

… TypeScript → C# migration (#18992) * Initial plan * Fix CI workflows by removing obsolete Node.js setup step Co-authored-by: Skrypt <3228637+Skrypt@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: Skrypt <3228637+Skrypt@users.noreply.github.com>

….csproj Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

…18994) * Initial plan * Fix: only delete migrations recipe if it was copied by us in this run Co-authored-by: Skrypt <3228637+Skrypt@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: Skrypt <3228637+Skrypt@users.noreply.github.com>

* Initial plan * Refactor CMS tests to use CmsTestBase, eliminating duplicate tenant setup logic Co-authored-by: Skrypt <3228637+Skrypt@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: Skrypt <3228637+Skrypt@users.noreply.github.com>

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* Initial plan * Fix BrowserContext leak in CreatePageAsync by closing context when page closes Co-authored-by: Skrypt <3228637+Skrypt@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: Skrypt <3228637+Skrypt@users.noreply.github.com>

…stion merge (#18997) * Initial plan * Fix CS1513 syntax error in TenantHelper.cs - malformed review suggestion merge Co-authored-by: Skrypt <3228637+Skrypt@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: Skrypt <3228637+Skrypt@users.noreply.github.com>

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

* Initial plan * fix: address review comments - HttpClient timeout and external site setup detection Co-authored-by: Skrypt <3228637+Skrypt@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: Skrypt <3228637+Skrypt@users.noreply.github.com>

Add an AllowAnonymousSchemaAccess setting (default: true) that controls whether the JSON schema endpoints (/swagger/v1/swagger.json, /openapi/v1.json) can be accessed without authentication. When disabled, these endpoints require the ApiManage permission, returning 401 for unauthenticated and 403 for unauthorized requests. This allows administrators to temporarily expose the schema for code generators like NSwag and lock it down otherwise.

Skrypt · 2026-03-21T15:23:14Z

@sebastienros Done, I moved them to features. The UI now only shows which UI is enabled.
Also, I added a checkbox to temporarly enable anonymous users to be able to fetch the OpenApi schemas.
That's mainly because it is easier than adding auth configurations in NSwag Studio to fetch the schema.
Also, less dangerous than what we did historically most of time by allowing these schema to anonymous users.

Replace references to removed EnableSwaggerUI/ReDocUI/ScalarUI checkboxes with feature enablement via FeatureHelper. Tests now enable the individual sub-features (SwaggerUI, ReDocUI, ScalarUI) instead of toggling settings checkboxes, and assert against the new AllowAnonymousSchemaAccess element on the settings page.

Add explicit endpoint names (operationId) to all API controllers and minimal API endpoints using [EndpointName] and .WithName() respectively. This prevents NSwag from generating ambiguous method names like ContentGET2Async by giving each operation a unique, descriptive identifier. All names are prefixed with "Api" to avoid collisions with existing admin route names. Also adds an OpenApi generation recipe to the OpenApi module that enables all features exposing API endpoints.

github-actions · 2026-03-28T07:05:45Z

This pull request has merge conflicts. Please resolve those before requesting a review.

github-actions · 2026-03-29T22:17:09Z

This pull request has merge conflicts. Please resolve those before requesting a review.

github-actions · 2026-04-07T21:21:20Z

This pull request has merge conflicts. Please resolve those before requesting a review.

Skrypt and others added 30 commits July 18, 2025 02:58

OpenApi

d4d7f6a

This is a work in progress. Pushing a PR to share.

Add nswag config and generated clients

a21668e

Move to proper folders

14de477

Fix build + add interface generation

0c9993e

Merge branch 'main' into skrypt/openapi

2efd60b

# Conflicts: # Directory.Packages.props # OrchardCore.sln # src/OrchardCore.Build/TargetFrameworks.props

Fix build

adca1ba

Playwright migration from Cypress

6548572

Refactor all Cypress functional tests in a 1:1 migration to Playwright.

remove failing doc

2e1697f

Do not dotnet build twice

4280046

cache playwright browsers and fix tests

79fe299

fix tests

701b76b

fix playwright cache usage on CI

ebdd5c0

Cleanup / docs / .slnx / .csproj

f096a46

fix csproj

4d54acf

update yarn.lock

811821b

Fix missing --project on command

890c1a8

Add Playwright cache CI step

c9c3f47

Update test/OrchardCore.Tests.Functional/OrchardCore.Tests.Functional…

eeb4807

….csproj Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Update test/OrchardCore.Tests.Functional/Helpers/TenantHelper.cs

a106026

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Update test/OrchardCore.Tests.Functional/Helpers/TenantHelper.cs

b18d0e5

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Merge branch 'main' into skrypt/playwright

1057243

Potential fix for pull request finding

14c2daf

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Skrypt added 5 commits March 21, 2026 11:30

Make schema endpoint URLs clickable in OpenApi settings page

7bba1d9

yarn build to fix CI build

95bfa21

Make openapi-settings tenant aware

63b88c6

Skrypt added don't merge and removed don't merge labels Mar 23, 2026

github-actions bot added the merge conflict label Mar 28, 2026

Merge branch 'main' into skrypt/openapi

ca794f1

github-actions bot removed the merge conflict label Mar 28, 2026

Skrypt added 6 commits March 28, 2026 03:38

Fixes after merging main

f3cb9e2

update assets

9d07d59

fix feature selector

7773066

localize openapi-settings vue app

60229b9

fix translations

3195583

fix func tests

884e0f4

github-actions bot added the merge conflict label Mar 29, 2026

Merge branch 'main' into skrypt/openapi

8ca07fd

github-actions bot removed the merge conflict label Mar 31, 2026

This was referenced Apr 1, 2026

Monthly community metrics report for 2026-03-01..2026-03-31 #19096

Open

Monthly community metrics report for 2026-03-01..2026-03-31 marwenbs99/CMS_CORE#11

Open

Skrypt added 3 commits April 2, 2026 00:41

reorder deps

9a3cbfe

Merge branch 'main' into skrypt/openapi

0a24e0d

reorder deps

37183dc

github-actions bot added the merge conflict label Apr 7, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

OpenApi#19016

OpenApi#19016
Skrypt wants to merge 65 commits intomainfrom
skrypt/openapi

Skrypt commented Mar 17, 2026 •

edited

Loading

Uh oh!

Skrypt commented Mar 21, 2026 •

edited

Loading

Uh oh!

github-actions bot commented Mar 28, 2026

Uh oh!

github-actions bot commented Mar 29, 2026

Uh oh!

github-actions bot commented Apr 7, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Conversation

Skrypt commented Mar 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Authentication

What's included

New dependencies

Uh oh!

Skrypt commented Mar 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Mar 28, 2026

Uh oh!

github-actions bot commented Mar 29, 2026

Uh oh!

github-actions bot commented Apr 7, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Skrypt commented Mar 17, 2026 •

edited

Loading

Skrypt commented Mar 21, 2026 •

edited

Loading