How do I refer to external `securitySchema` object ?

[yuji38kwmt]

I want to split the following file.

openapi: "3.0.0"
info:
 version: 1.0.0
 title: Swagger Petstore
 license:
 name: MIT
servers:
 - url: http://petstore.swagger.io/v1
paths:
 /pets/{petId}:
 get:
 summary: Get Pet
 operationId: showPetById
 security:
 - Everyone: [] 
 tags:
 - animals
 parameters:
 - name: petId
 in: path
 required: true
 description: The id of the pet to retrieve
 schema:
 type: string
 responses:
 '200':
 description: Expected response to a valid request
 content:
 application/json:
 schema:
 $ref: "#/components/schemas/Pet"
components:
 securitySchemes:
 Everyone:
 description: everyone
 type: "apiKey"
 name: "Authorization"
 in: "header"
 schemas:
 Pet:
 required:
 - id
 - name
 properties:
 id:
 type: integer
 format: int64
 name:
 type: string
 tag:
 type: string

I write components object to external file.

petstore-parent.yaml

openapi: "3.0.0"
info:
 version: 1.0.0
 title: Swagger Petstore
 license:
 name: MIT
servers:
 - url: http://petstore.swagger.io/v1
paths:
 /pets/{petId}:
 get:
 summary: Get Pet
 operationId: showPetById
 security:
 - Everyone: [] 
 tags:
 - animals
 parameters:
 - name: petId
 in: path
 required: true
 description: The id of the pet to retrieve
 schema:
 type: string
 responses:
 '200':
 description: Expected response to a valid request
 content:
 application/json:
 schema:
 $ref: "./petstore-child.yaml#/components/schemas/Pet"

petstore-child.yaml

components:
 securitySchemes:
 Everyone:
 description: everyone
 type: "apiKey"
 name: "Authorization"
 in: "header"
 schemas:
 Pet:
 required:
 - id
 - name
 properties:
 id:
 type: integer
 format: int64
 name:
 type: string
 tag:
 type: string

But I do not know how I refer to external securitySchema object.

 get:
 summary: Get Pet
 operationId: showPetById
 security:
 - Everyone: [] 

How do I refer to external securitySchema object ?

[handrews]

Hmm... I think this boils down to a question of the scope of the SecuritySchemes section of the Components Object. Since the Security Requirement Object just uses the name from the Components Object instead of a $ref and a URI to it, there's a question of how a tool "knows" where to look for the Components Object. Presumably, it's only looking in the local file.

I'm not sure how this could be made to work for external files. In the schema example with the $ref, the value of $ref is a URI that tells how to find the external file, but there is nowhere to put such a thing in the Security Requirement Object.

@OAI/tsc is this something we should consider for OAS 3.1? Would it be possible to also allow a $ref somehow?

[handrews]

Consolidating under #3853 and closing