From e978d86c866d96fd68d38001fe9fc412a4f208d2 Mon Sep 17 00:00:00 2001
From: "Zaiming (Stone) Shi" <zmstone@gmail.com>
Date: Mon, 3 Apr 2023 13:41:13 +0200
Subject: [PATCH 1/3] chore: add doc_lift for authorization.sources

doc_lift is to make the doc render application to lift
this field to the root level and force the field's doc
to refernec it instead of expanding the structs in a nested way
---
 apps/emqx_authz/src/emqx_authz.app.src    | 2 +-
 apps/emqx_authz/src/emqx_authz_schema.erl | 4 +++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/apps/emqx_authz/src/emqx_authz.app.src b/apps/emqx_authz/src/emqx_authz.app.src
index 943978519..2f8b26894 100644
--- a/apps/emqx_authz/src/emqx_authz.app.src
+++ b/apps/emqx_authz/src/emqx_authz.app.src
@@ -1,7 +1,7 @@
 %% -*- mode: erlang -*-
 {application, emqx_authz, [
     {description, "An OTP application"},
-    {vsn, "0.1.15"},
+    {vsn, "0.1.16"},
     {registered, []},
     {mod, {emqx_authz_app, []}},
     {applications, [
diff --git a/apps/emqx_authz/src/emqx_authz_schema.erl b/apps/emqx_authz/src/emqx_authz_schema.erl
index b15d4abd4..6630ed526 100644
--- a/apps/emqx_authz/src/emqx_authz_schema.erl
+++ b/apps/emqx_authz/src/emqx_authz_schema.erl
@@ -492,7 +492,9 @@ authz_fields() ->
                 ?ARRAY(?UNION(UnionMemberSelector)),
                 #{
                     default => [],
-                    desc => ?DESC(sources)
+                    desc => ?DESC(sources),
+                    %% doc_lift is force a root level reference instead of nesting sub-structs
+                    extra => #{doc_lift => true}
                 }
             )}
     ].

From 2d6ca69ffb2724463d4fd284a37521ce9f243515 Mon Sep 17 00:00:00 2001
From: "Zaiming (Stone) Shi" <zmstone@gmail.com>
Date: Mon, 3 Apr 2023 16:37:18 +0200
Subject: [PATCH 2/3] refactor: no support for listener level authentication
 for now

---
 apps/emqx/src/emqx_schema.erl                 | 4 +++-
 apps/emqx_gateway/src/emqx_gateway_schema.erl | 2 ++
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/apps/emqx/src/emqx_schema.erl b/apps/emqx/src/emqx_schema.erl
index 0f90677bd..6bfff38d3 100644
--- a/apps/emqx/src/emqx_schema.erl
+++ b/apps/emqx/src/emqx_schema.erl
@@ -1880,7 +1880,9 @@ mqtt_listener(Bind) ->
                         default => <<"3s">>
                     }
                 )},
-            {?EMQX_AUTHENTICATION_CONFIG_ROOT_NAME, authentication(listener)}
+            {?EMQX_AUTHENTICATION_CONFIG_ROOT_NAME, (authentication(listener))#{
+                importance => ?IMPORTANCE_HIDDEN
+            }}
         ].
 
 base_listener(Bind) ->
diff --git a/apps/emqx_gateway/src/emqx_gateway_schema.erl b/apps/emqx_gateway/src/emqx_gateway_schema.erl
index 741fb98ae..28c1e6f89 100644
--- a/apps/emqx_gateway/src/emqx_gateway_schema.erl
+++ b/apps/emqx_gateway/src/emqx_gateway_schema.erl
@@ -580,6 +580,8 @@ authentication_schema() ->
         #{
             required => {false, recursively},
             desc => ?DESC(gateway_common_authentication),
+            %% we do not expose this to the user for now
+            importance => ?IMPORTANCE_HIDDEN,
             examples => emqx_authn_api:authenticator_examples()
         }
     ).

From a4e27e56a855389f60d42076353b2f4516f83bed Mon Sep 17 00:00:00 2001
From: "Zaiming (Stone) Shi" <zmstone@gmail.com>
Date: Mon, 3 Apr 2023 16:52:49 +0200
Subject: [PATCH 3/3] docs: add change logs

---
 changes/ce/fix-10317.en.md | 1 +
 changes/ce/fix-10317.zh.md | 1 +
 2 files changed, 2 insertions(+)
 create mode 100644 changes/ce/fix-10317.en.md
 create mode 100644 changes/ce/fix-10317.zh.md

diff --git a/changes/ce/fix-10317.en.md b/changes/ce/fix-10317.en.md
new file mode 100644
index 000000000..7a83dcaca
--- /dev/null
+++ b/changes/ce/fix-10317.en.md
@@ -0,0 +1 @@
+Do not expose listener level authentications before extensive verification.
diff --git a/changes/ce/fix-10317.zh.md b/changes/ce/fix-10317.zh.md
new file mode 100644
index 000000000..69cf09901
--- /dev/null
+++ b/changes/ce/fix-10317.zh.md
@@ -0,0 +1 @@
+在大量验证完成前不暴露监听器级的认证功能。