OAuth2 Password Flow is broken in Swagger UI 3.x

[frol]

I use http://petstore.swagger.io/ with this config http://flask-restplus-example-server.herokuapp.com/api/v1/swagger.json.

First of all, there is no scopes selection, which seems to be the source of the following bug. If I just enter the credentials, I get the following traceback:

swagger-ui-bundle.js:51 Uncaught TypeError: t.map is not a function
    at c (http://petstore.swagger.io/js/swagger-ui-bundle.js:71:30290)
    at http://petstore.swagger.io/js/swagger-ui-bundle.js:71:30534
    at Array.reduce (native)
    at l (http://petstore.swagger.io/js/swagger-ui-bundle.js:71:30362)
    at Object.p [as mergeInQueryOrForm] (http://petstore.swagger.io/js/swagger-ui-bundle.js:71:31273)
    at Object.fetch (http://petstore.swagger.io/js/swagger-ui-bundle.js:71:31444)
    at http://petstore.swagger.io/js/swagger-ui-bundle.js:81:5588
    at Object.dispatch (http://petstore.swagger.io/js/swagger-ui-bundle.js:41:3805)
    at dispatch (<anonymous>:2:1507)
    at Object.authorizePassword (http://petstore.swagger.io/js/swagger-ui-bundle.js:34:2323)

/cc @webron @bodnia @MugeSo @hkulekci @HugoMario @vpandey-rms @wimpers @bundabrg @danballance (I am sorry for the possible spam, but you were interested in the #2397, so I figured I would let you know about the issue).

[webron]

@bodnia - can you take a look at this? I believe we fixed it in an alternative build, but maybe the fix didn't get here as well.

@Minasokoni - if you try to load the provided spec, the global Authorize button does not appear (guessing it's related to #2750) and the Authorize button for individual operations does not open (at least in FF). I've checked in 3.0.1 and it wasn't an issue.

[sgdesmet]

application flow is broken as well, authorize button does not appear.

[bodnia]

@sgdesmet there is no support for application flow in swagger-ui.

[sgdesmet]

@bodnia Is this new for swagger-ui 3.x? It seems supported on 2.2.10

[bodnia]

@sgdesmet application flow wasn't supported in 2.x version, we can only display it but no authorization can be performed with it

[bodnia]

@frol the error is caused by tokenUrl in securityDefinitions:

"tokenUrl": "/auth/oauth2/token"

As far as it has relative path fetch cannot call it. Following works ok:

"securityDefinitions": {
    "oauth2_password": {
      "flow": "password",
      "scopes": {
        "auth:read": "Provide access to auth details",
        "auth:write": "Provide write access to auth details",
        "teams:read": "Provide access to team details",
        "teams:write": "Provide write access to team details",
        "users:read": "Provide access to user details",
        "users:write": "Provide write access to user details"
      },
      "tokenUrl": "http://flask-restplus-example-server.herokuapp.com/auth/oauth2/token",
      "type": "oauth2"
    }
  }

Display and send scopes as query parameter is merged to latest master.

[frol]

@bodnia Oh, my! I am so sorry for the trouble! (It would be great to have a nicer error message there...)