Allow missing security schemes

core/src/main/java/org/openapitools/openapidiff/core/compare/SecurityRequirementDiff.java

@@ -35,11 +35,22 @@ public static SecurityRequirement getCopy(LinkedHashMap<String, List<String>> ri
 
   private LinkedHashMap<String, List<String>> contains(
       SecurityRequirement right, String schemeRef) {
-    SecurityScheme leftSecurityScheme = leftComponents.getSecuritySchemes().get(schemeRef);
+    Map<String, SecurityScheme> leftSchemes =
+        leftComponents != null ? leftComponents.getSecuritySchemes() : null;
+    Map<String, SecurityScheme> rightSchemes =
+        rightComponents != null ? rightComponents.getSecuritySchemes() : null;
     LinkedHashMap<String, List<String>> found = new LinkedHashMap<>();
 
+    if (leftSchemes == null || rightSchemes == null) {
+      if (right.containsKey(schemeRef)) {
+        found.put(schemeRef, right.get(schemeRef));
+      }
+      return found;
+    }
+
+    SecurityScheme leftSecurityScheme = leftSchemes.get(schemeRef);
     for (Map.Entry<String, List<String>> entry : right.entrySet()) {
-      SecurityScheme rightSecurityScheme = rightComponents.getSecuritySchemes().get(entry.getKey());
+      SecurityScheme rightSecurityScheme = rightSchemes.get(entry.getKey());
       if (leftSecurityScheme.getType() == rightSecurityScheme.getType()) {
         switch (leftSecurityScheme.getType()) {
           case APIKEY:

core/src/main/java/org/openapitools/openapidiff/core/compare/SecurityRequirementsDiff.java

@@ -52,22 +52,20 @@ public boolean same(SecurityRequirement left, SecurityRequirement right) {
 
   private List<Pair<SecurityScheme.Type, SecurityScheme.In>> getListOfSecuritySchemes(
       Components components, SecurityRequirement securityRequirement) {
+    if (components == null) {
+      throw new IllegalArgumentException("Missing components definition.");
+    }
+    Map<String, SecurityScheme> securitySchemes = components.getSecuritySchemes();
+    if (securitySchemes == null) {
+      return new ArrayList<>();
+    }
     return securityRequirement.keySet().stream()
         .map(
             x -> {
-              if (components == null) {
-                throw new IllegalArgumentException("Missing securitySchemes component definition.");
-              }
-              Map<String, SecurityScheme> securitySchemes = components.getSecuritySchemes();
-              if (securitySchemes == null) {
-                throw new IllegalArgumentException("Missing securitySchemes component definition.");
-              }
-
               SecurityScheme result = securitySchemes.get(x);
               if (result == null) {
                 throw new IllegalArgumentException("Impossible to find security scheme: " + x);
               }
-
               return result;
             })
         .map(this::getPair)

core/src/main/java/org/openapitools/openapidiff/core/compare/SecuritySchemeDiff.java

@@ -6,6 +6,7 @@
 import io.swagger.v3.oas.models.security.SecurityScheme;
 import java.util.HashSet;
 import java.util.List;
+import java.util.Map;
 import java.util.Objects;
 import org.openapitools.openapidiff.core.model.ChangedSecurityScheme;
 import org.openapitools.openapidiff.core.model.ChangedSecuritySchemeScopes;
@@ -36,8 +37,15 @@ public DeferredChanged<ChangedSecurityScheme> diff(
       String rightSchemeRef,
       List<String> rightScopes,
       DiffContext context) {
-    SecurityScheme leftSecurityScheme = leftComponents.getSecuritySchemes().get(leftSchemeRef);
-    SecurityScheme rightSecurityScheme = rightComponents.getSecuritySchemes().get(rightSchemeRef);
+    Map<String, SecurityScheme> leftSchemes =
+        leftComponents != null ? leftComponents.getSecuritySchemes() : null;
+    Map<String, SecurityScheme> rightSchemes =
+        rightComponents != null ? rightComponents.getSecuritySchemes() : null;
+    if (leftSchemes == null || rightSchemes == null) {
+      return RealizedChanged.empty();
+    }
+    SecurityScheme leftSecurityScheme = leftSchemes.get(leftSchemeRef);
+    SecurityScheme rightSecurityScheme = rightSchemes.get(rightSchemeRef);
     DeferredChanged<ChangedSecurityScheme> changedSecuritySchemeOpt =
         cachedDiff(
             new HashSet<>(),

core/src/test/java/org/openapitools/openapidiff/core/SecurityDiffTest.java

@@ -2,6 +2,7 @@
 
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.openapitools.openapidiff.core.TestUtils.assertSpecUnchanged;
 
 import io.swagger.v3.oas.models.security.SecurityRequirement;
 import org.junit.jupiter.api.Test;
@@ -90,15 +91,13 @@ public void testWithUnknownSecurityScheme() {
     assertThrows(
         IllegalArgumentException.class,
         () -> OpenApiCompare.fromLocations(OPENAPI_DOC3, OPENAPI_DOC3));
-    assertThrows(
-        IllegalArgumentException.class,
-        () -> OpenApiCompare.fromLocations(OPENAPI_DOC4, OPENAPI_DOC4));
   }
 
   @Test
   public void testMissingSecurityDefinition() {
-    assertThrows(
-        IllegalArgumentException.class,
-        () -> OpenApiCompare.fromLocations(OPENAPI_DOC5, OPENAPI_DOC5));
+    // A missing securitySchemes map (DOC4) or an entirely empty components block (DOC5) is valid
+    // OpenAPI
+    assertSpecUnchanged(OPENAPI_DOC4, OPENAPI_DOC4);
+    assertSpecUnchanged(OPENAPI_DOC5, OPENAPI_DOC5);
   }
 }