From 6997e395f59b70e71cbbb528ff87260a26b8d21f Mon Sep 17 00:00:00 2001
From: kriptoburak <kriptoburak@users.noreply.github.com>
Date: Thu, 2 Jul 2026 23:59:27 +0300
Subject: [PATCH] test: cover optional operation security

---
 .../oas3-operation-security-defined.test.ts   | 44 +++++++++++++++++++
 1 file changed, 44 insertions(+)

diff --git a/packages/rulesets/src/oas/__tests__/oas3-operation-security-defined.test.ts b/packages/rulesets/src/oas/__tests__/oas3-operation-security-defined.test.ts
index 2046871f7..d62ea278e 100644
--- a/packages/rulesets/src/oas/__tests__/oas3-operation-security-defined.test.ts
+++ b/packages/rulesets/src/oas/__tests__/oas3-operation-security-defined.test.ts
@@ -35,6 +35,50 @@ testRule('oas3-operation-security-defined', [
     errors: [],
   },
 
+  {
+    name: 'valid OpenAPI 3.1 operation with optional security alternatives',
+    document: {
+      openapi: '3.1.0',
+      components: {
+        securitySchemes: {
+          apiKey: {
+            type: 'apiKey',
+            name: 'x-api-key',
+            in: 'header',
+          },
+          oauthBearer: {
+            type: 'http',
+            scheme: 'bearer',
+          },
+        },
+      },
+      security: [
+        {
+          apiKey: [],
+        },
+        {
+          oauthBearer: [],
+        },
+      ],
+      paths: {
+        '/tweets/search': {
+          get: {
+            security: [
+              {
+                apiKey: [],
+              },
+              {
+                oauthBearer: [],
+              },
+              {},
+            ],
+          },
+        },
+      },
+    },
+    errors: [],
+  },
+
   {
     name: 'valid and invalid object',
     document: {