ASP.NET Core OpenApi 10.0.5升级后，如何迁移BearerSecuritySchemeTransformer？

问题背景 #

基于早年编写的ASP.NET Core Web API开发新接口，因.NET 9起Swagger被OpenApi及Scalar等技术替代，故安装了最新版Microsoft.AspNetCore.OpenApi 10.0.5。但原代码依赖Microsoft.OpenApi.Models，升级后出现编译错误。

原代码示例：

using Microsoft.AspNetCore.OpenApi;
using Microsoft.OpenApi.Models;

internal sealed class BearerSecuritySchemeTransformer(
    Microsoft.AspNetCore.Authentication.IAuthenticationSchemeProvider authenticationSchemeProvider
) : IOpenApiDocumentTransformer
{
    public async Task TransformAsync(
        OpenApiDocument document,
        OpenApiDocumentTransformerContext context,
        CancellationToken cancellationToken)
    {
        var authenticationSchemes = await authenticationSchemeProvider.GetAllSchemesAsync();

        if (authenticationSchemes.Any(authScheme => authScheme.Name == "Bearer"))
        {
            document.Components ??= new OpenApiComponents();

            var securitySchemeId = "Bearer";

            document.Components.SecuritySchemes.Add(securitySchemeId, new OpenApiSecurityScheme
            {
                Type = SecuritySchemeType.Http,
                Scheme = "bearer",
                In = ParameterLocation.Header,
                BearerFormat = "Json Web Token"
            });

            document.SecurityRequirements.Add(new OpenApiSecurityRequirement
            {
                [new OpenApiSecurityScheme
                {
                    Reference = new OpenApiReference
                    {
                        Id = securitySchemeId,
                        Type = ReferenceType.SecurityScheme
                    }
                }] = Array.Empty<string>()
            });
        }
    }
}

升级至10.0.5后出现的编译错误：

• 命名空间'Microsoft.OpenApi'中不存在类型或命名空间名称'Models'（是否缺少程序集引用？）
• 'OpenApiDocument'不包含'document'的定义，也找不到接受类型为'OpenApiDocument'的第一个参数的可访问扩展方法'document'
• 'OpenApiSecurityScheme'不包含'Reference'的定义

适配后的实现代码 #

在.NET 10的Microsoft.AspNetCore.OpenApi中，相关类型的命名空间和API结构有调整，以下是正确的实现：

using Microsoft.AspNetCore.OpenApi;
using Microsoft.AspNetCore.OpenApi.Models;
using Microsoft.AspNetCore.Authentication;

internal sealed class BearerSecuritySchemeTransformer(IAuthenticationSchemeProvider authenticationSchemeProvider)
    : IOpenApiDocumentTransformer
{
    public async Task TransformAsync(OpenApiDocument document, OpenApiDocumentTransformerContext context, CancellationToken cancellationToken)
    {
        var authenticationSchemes = await authenticationSchemeProvider.GetAllSchemesAsync();

        if (authenticationSchemes.Any(authScheme => authScheme.Name == "Bearer"))
        {
            document.Components ??= new OpenApiComponents();

            var securitySchemeId = "Bearer";

            // 注册Bearer安全方案到OpenApi组件
            document.Components.SecuritySchemes.Add(securitySchemeId, new OpenApiSecurityScheme
            {
                Type = OpenApiSecuritySchemeType.Http,
                Scheme = "bearer",
                In = OpenApiParameterLocation.Header,
                BearerFormat = "Json Web Token"
            });

            // 添加全局安全要求
            document.SecurityRequirements.Add(new OpenApiSecurityRequirement
            {
                {
                    new OpenApiSecuritySchemeReference { Id = securitySchemeId },
                    Array.Empty<string>()
                }
            });
        }
    }
}

关键变化说明 #

1. 命名空间迁移：原Microsoft.OpenApi.Models下的所有OpenApi模型类型，现已统一移至Microsoft.AspNetCore.OpenApi.Models命名空间，需更新using指令。
2. 枚举类型重命名：
   • 原SecuritySchemeType替换为OpenApiSecuritySchemeType
   • 原ParameterLocation替换为OpenApiParameterLocation
3. 引用对象简化：原OpenApiReference被更具体的OpenApiSecuritySchemeReference替代，直接通过Id关联已注册的安全方案即可，无需指定类型。
4. 安全要求构造优化：安全要求的字典键直接使用OpenApiSecuritySchemeReference实例，替代原嵌套OpenApiSecurityScheme的冗余写法。

内容的提问来源于stack exchange，提问作者user3742300