Should be able to send access token

[strongloop]

Should be able to send access token

[bajtos]

To implement this change, we have to migrate to Swagger spec v1.2 (transition docs).

Then we can use authorizations sections to describe auth. See petstore for an example of swagger descriptors including authorizations.

This is my rough idea:

When app.isAuthEnabled is not true, authorizations should be always empty (or not present at all).

Otherwise, the top-level swagger descriptor should configure access-token-based authorization:

authorizations: {
  accessToken : {
      // Authorization is a name of the HTTP header
      type: 'Authorization',
      passAs : 'header'
    }
}

Now for every public method, we need to decide whether anonymous access is allowed. If it isn't, then the method swagger description should include authorizations: { accessToken: [] } (I am not sure about the exact value here).

[raymondfeng]

+1 to upgrade to Swagger 1.2 which will gives us a better api spec:

• authorization
• model schema
• content-type/accept
• error/status code

https://github.com/wordnik/swagger-core/wiki/1.2-transition

[PerfectedApp]

+1 to upgrade to Swagger 1.2