False Positive for OIDC scopes in oas3-operation-security-defined

[arosenb2]

Describe the bug
When using a security schema of type openIdConnect, scopes are being checked for being defined in the flows, but per the OpenAPI Specification, when using openIdConnect, flows is not a valid property (it should only be used with OAuth2). Therefore, the check for isScopeDefined is invalid for openIdConnect.

To Reproduce

1. Define an operation and apply a security schema of type openIdConnect.
2. Include a valid scope from the well-known OIDC configuration as part of the security schema reference in the operation.
3. Observe that oas3-operation-security-defined triggered, listing "the-scope-you-included" must be listed among scopes..

Expected behavior
Either OIDC provided scopes should be skipped as part of the isScopeDefined function when the security schema is of type openIdConnect. Additionally, checking for isScopeDefined could be considered a separate rule from oas3-operation-security-defined so it can be selectively ignored (suggested name: oas3-operationsecurity-scopes-defined).

Environment:

• Library version: 6.11.0

Additional context
OpenAPI Specification - Security Schema Object,
Reference code in the ruleset

[strowk]

Docs specifically say here :

Unlike OAuth 2.0, you do not need to list the available scopes in securitySchemes

I guess disabling it like this is the only option to avoid this for now:

extends: ["spectral:oas"]
overrides:
  - rules:
      # This rule is misfiring for OIDC
      # https://github.com/stoplightio/spectral/issues/2566
      oas3-operation-security-defined: "off"
    files:
      - "**/*.yaml"