From d7e8417b3ea84331f83ac8ce475a263077d881c5 Mon Sep 17 00:00:00 2001
From: kriptoburak <kriptoburak@users.noreply.github.com>
Date: Fri, 3 Jul 2026 00:04:15 +0300
Subject: [PATCH] test: cover optional security alternatives

---
 .../data/v3.0/security_override.yaml          |  7 ++++
 .../data/v3.1/security_override.yaml          |  9 ++++-
 .../unmarshalling/test_security_override.py   | 40 +++++++++++++++----
 3 files changed, 47 insertions(+), 9 deletions(-)

diff --git a/tests/integration/data/v3.0/security_override.yaml b/tests/integration/data/v3.0/security_override.yaml
index 8d096ffc..a64cd3f7 100644
--- a/tests/integration/data/v3.0/security_override.yaml
+++ b/tests/integration/data/v3.0/security_override.yaml
@@ -30,6 +30,13 @@ paths:
       responses:
         default:
           description: Remove security.
+    patch:
+      security:
+        - api_key: []
+        - {}
+      responses:
+        default:
+          description: Optional security.
 components:
   securitySchemes:
     api_key:
diff --git a/tests/integration/data/v3.1/security_override.yaml b/tests/integration/data/v3.1/security_override.yaml
index 9d6bec96..f6cdd162 100644
--- a/tests/integration/data/v3.1/security_override.yaml
+++ b/tests/integration/data/v3.1/security_override.yaml
@@ -30,6 +30,13 @@ paths:
       responses:
         default:
           description: Remove security.
+    patch:
+      security:
+        - api_key: []
+        - {}
+      responses:
+        default:
+          description: Optional security.
 components:
   securitySchemes:
     api_key:
@@ -38,4 +45,4 @@ components:
       in: query
     petstore_auth:
       type: http
-      scheme: basic
\ No newline at end of file
+      scheme: basic
diff --git a/tests/integration/unmarshalling/test_security_override.py b/tests/integration/unmarshalling/test_security_override.py
index 8e549d6a..fc7b7f9b 100644
--- a/tests/integration/unmarshalling/test_security_override.py
+++ b/tests/integration/unmarshalling/test_security_override.py
@@ -6,18 +6,23 @@
 from openapi_core.testing import MockRequest
 from openapi_core.unmarshalling.request.unmarshallers import (
     V30RequestUnmarshaller,
+    V31RequestUnmarshaller,
 )
 from openapi_core.validation.request.exceptions import SecurityValidationError
 
 
-@pytest.fixture(scope="class")
-def schema_path(schema_path_factory):
-    return schema_path_factory.from_file("data/v3.0/security_override.yaml")
-
-
-@pytest.fixture(scope="class")
-def request_unmarshaller(schema_path):
-    return V30RequestUnmarshaller(schema_path)
+@pytest.fixture(
+    scope="class",
+    params=[
+        ("data/v3.0/security_override.yaml", V30RequestUnmarshaller),
+        ("data/v3.1/security_override.yaml", V31RequestUnmarshaller),
+    ],
+    ids=["openapi-3.0", "openapi-3.1"],
+)
+def request_unmarshaller(schema_path_factory, request):
+    schema_file, unmarshaller_cls = request.param
+    schema_path = schema_path_factory.from_file(schema_file)
+    return unmarshaller_cls(schema_path)
 
 
 class TestSecurityOverride:
@@ -85,3 +90,22 @@ def test_remove(self, request_unmarshaller):
 
         assert not result.errors
         assert result.security == {}
+
+    def test_optional_without_security(self, request_unmarshaller):
+        request = MockRequest(self.host_url, "patch", "/resource/one")
+
+        result = request_unmarshaller.unmarshal(request)
+
+        assert not result.errors
+        assert result.security == {}
+
+    def test_optional_with_security(self, request_unmarshaller):
+        args = {"api_key": self.api_key}
+        request = MockRequest(self.host_url, "patch", "/resource/one", args=args)
+
+        result = request_unmarshaller.unmarshal(request)
+
+        assert not result.errors
+        assert result.security == {
+            "api_key": self.api_key,
+        }