From 76e00ba2ed09d76ddb05d613cc525d07e6f8ace9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sebasti=C3=A1n=20Ram=C3=ADrez?= <tiangolo@gmail.com>
Date: Fri, 31 Oct 2025 19:28:05 +0100
Subject: [PATCH] =?UTF-8?q?=E2=9C=85=20Test=20security=20scheme=20at=20the?=
 =?UTF-8?q?=20top=20level=20of=20an=20app?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 ...st_top_level_security_scheme_in_openapi.py | 60 +++++++++++++++++++
 1 file changed, 60 insertions(+)
 create mode 100644 tests/test_top_level_security_scheme_in_openapi.py

diff --git a/tests/test_top_level_security_scheme_in_openapi.py b/tests/test_top_level_security_scheme_in_openapi.py
new file mode 100644
index 000000000..e2de31af5
--- /dev/null
+++ b/tests/test_top_level_security_scheme_in_openapi.py
@@ -0,0 +1,60 @@
+# Test security scheme at the top level, including OpenAPI
+# Ref: https://github.com/fastapi/fastapi/discussions/14263
+# Ref: https://github.com/fastapi/fastapi/issues/14271
+from fastapi import Depends, FastAPI
+from fastapi.security import HTTPBearer
+from fastapi.testclient import TestClient
+from inline_snapshot import snapshot
+
+app = FastAPI()
+
+bearer_scheme = HTTPBearer()
+
+
+@app.get("/", dependencies=[Depends(bearer_scheme)])
+async def get_root():
+    return {"message": "Hello, World!"}
+
+
+client = TestClient(app)
+
+
+def test_get_root():
+    response = client.get("/", headers={"Authorization": "Bearer token"})
+    assert response.status_code == 200, response.text
+    assert response.json() == {"message": "Hello, World!"}
+
+
+def test_get_root_no_token():
+    response = client.get("/")
+    assert response.status_code == 403, response.text
+    assert response.json() == {"detail": "Not authenticated"}
+
+
+def test_openapi_schema():
+    response = client.get("/openapi.json")
+    assert response.status_code == 200, response.text
+    assert response.json() == snapshot(
+        {
+            "openapi": "3.1.0",
+            "info": {"title": "FastAPI", "version": "0.1.0"},
+            "paths": {
+                "/": {
+                    "get": {
+                        "summary": "Get Root",
+                        "operationId": "get_root__get",
+                        "responses": {
+                            "200": {
+                                "description": "Successful Response",
+                                "content": {"application/json": {"schema": {}}},
+                            }
+                        },
+                        "security": [{"HTTPBearer": []}],
+                    }
+                }
+            },
+            "components": {
+                "securitySchemes": {"HTTPBearer": {"type": "http", "scheme": "bearer"}}
+            },
+        }
+    )