Management API: Override document-level security on AllowAnonymous endpoints

src/Umbraco.Cms.Api.Management/OpenApi/Transformers/BackOfficeSecurityRequirementsTransformer.cs

@@ -26,11 +26,20 @@
         OpenApiOperationTransformerContext context,
         CancellationToken cancellationToken)
     {
-        if (context.Description.ActionDescriptor is not ControllerActionDescriptor description ||
-            description.MethodInfo.GetCustomAttributes(true).Any(x => x is AllowAnonymousAttribute) ||
+        if (context.Description.ActionDescriptor is not ControllerActionDescriptor description)
+        {
+            return Task.CompletedTask;
+        }
+
+        if (description.MethodInfo.GetCustomAttributes(true).Any(x => x is AllowAnonymousAttribute) ||
             description.MethodInfo.DeclaringType?.GetCustomAttributes(true).Any(x => x is AllowAnonymousAttribute) ==
             true)
         {
+            // Explicitly clear security on anonymous operations so they override the document-level
+            // security requirement added below. Without this, OpenAPI consumers (including the
+            // generated backoffice SDK) treat these endpoints as authenticated and attach a Bearer
+            // token, which triggers a /token refresh before the user has logged in.
+            operation.Security = [];
             return Task.CompletedTask;
         }
 

tests/Umbraco.Tests.UnitTests/Umbraco.Cms.Api.Management/OpenApi/BackOfficeSecurityRequirementsTransformerTests.cs

@@ -1,4 +1,4 @@
 using System.Reflection;
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
@@ -109,7 +109,7 @@
     #region Operation Transformer Tests
 
     [Test]
-    public async Task TransformAsync_Operation_Skips_AllowAnonymous_Methods()
+    public async Task TransformAsync_Operation_Overrides_Security_For_AllowAnonymous_Methods()
     {
         // Arrange
         var operation = new OpenApiOperation();
@@ -134,13 +134,14 @@
         // Act
         await _transformer.TransformAsync(operation, context, CancellationToken.None);
 
-        // Assert - Should not add 401 response or security
+        // Assert - Should not add 401 response, and security must be an empty list to override document-level security
         Assert.IsFalse(operation.Responses?.ContainsKey(StatusCodes.Status401Unauthorized.ToString()) ?? false);
-        Assert.IsNull(operation.Security);
+        Assert.IsNotNull(operation.Security);
+        Assert.IsEmpty(operation.Security);
     }
 
     [Test]
-    public async Task TransformAsync_Operation_Skips_AllowAnonymous_Controllers()
+    public async Task TransformAsync_Operation_Overrides_Security_For_AllowAnonymous_Controllers()
     {
         // Arrange
         var operation = new OpenApiOperation();
@@ -165,9 +166,10 @@
         // Act
         await _transformer.TransformAsync(operation, context, CancellationToken.None);
 
-        // Assert - Should not add 401 response or security
+        // Assert - Should not add 401 response, and security must be an empty list to override document-level security
         Assert.IsFalse(operation.Responses?.ContainsKey(StatusCodes.Status401Unauthorized.ToString()) ?? false);
-        Assert.IsNull(operation.Security);
+        Assert.IsNotNull(operation.Security);
+        Assert.IsEmpty(operation.Security);
     }
 
     [Test]