prompt: You will be provided with a partial code base and an issue statement explaining a problem to resolve.
  <issue>
  CKV_OPENAPI_20 incorrectly flags API keys via HTTPS
  **Describe the issue**
  
  #5253 added CKV_OPENAPI_20 with the message "Ensure that API keys are not sent over cleartext", but the [check](https://github.com/bridgecrewio/checkov/blob/main/checkov/openapi/checks/resource/generic/ClearTextAPIKey.py) does not check the API's supported schemes.
  
  If the intent of this check is to prevent cleartext use of API keys, then if the root level [`schemes`](https://swagger.io/docs/specification/2-0/api-host-and-base-path/) key in OpenAPI 2.0 or [`servers`](https://swagger.io/docs/specification/api-host-and-base-path/) key in OpenAPI 3.0 specifies only `https` (2.0) or only `url`s which are HTTPS (3.0), this check should pass.
  
  **Examples**
  
  [fail2.json](https://github.com/bridgecrewio/checkov/blob/main/tests/openapi/checks/resource/generic/example_ClearTextAPIKey/fail2.json) and its YAML counterpart should fail, but if they specified `"schemes": ["https"]`, they should not.
  
  Ditto for the OpenAPI 3.0 version of this example.
  
  **Version (please complete the following information):**
  
  2.3.312
  
  **Additional context**
  
  It may be that the message is wrong and you actually intend to flag all use of API keys, but if that's the case, the message should convey that. I also would argue that header API keys should not be scrutinized the same way as query parameter API keys, since the risk of leaking the API key unintentionally is higher with the latter.
  
  </issue>
  <code>
  [start of checkov/openapi/checks/resource/generic/ClearTextAPIKey.py]
  1 from __future__ import annotations
  2 
  3 from typing import Any
  4 from checkov.common.models.enums import CheckResult, CheckCategories
  5 from checkov.common.checks.enums import BlockType
  6 from checkov.common.util.consts import LINE_FIELD_NAMES
  7 from checkov.openapi.checks.base_openapi_check import BaseOpenapiCheck
  8 
  9 
  10 class ClearTestAPIKey(BaseOpenapiCheck):
  11     def __init__(self) -> None:
  12         id = "CKV_OPENAPI_20"
  13         name = "Ensure that API keys are not sent over cleartext"
  14         categories = (CheckCategories.API_SECURITY,)
  15         supported_resources = ('paths',)
  16         super().__init__(name=name, id=id, categories=categories, supported_entities=supported_resources,
  17                          block_type=BlockType.DOCUMENT)
  18 
  19     def scan_entity_conf(self, conf: dict[str, Any], entity_type: str) -> tuple[CheckResult, dict[str, Any]]:  # type:ignore[override]  # return type is different than the base class
  20         components = conf.get("components")
  21         security_def = conf.get("securityDefinitions")
  22         if components and isinstance(components, dict):
  23             security_schemes = components.get("securitySchemes") or {}
  24         elif security_def:
  25             security_schemes = security_def
  26         else:
  27             return CheckResult.PASSED, conf
  28 
  29         paths = conf.get('paths')
  30         if not isinstance(paths, dict):
  31             return CheckResult.PASSED, security_schemes
  32 
  33         filtered_dict = {}
  34         if isinstance(security_schemes, dict):
  35             for name, scheme in security_schemes.items():
  36                 if isinstance(scheme, dict) and scheme.get('type') == "apiKey":
  37                     filtered_dict[name] = scheme
  38 
  39         if not filtered_dict:
  40             return CheckResult.PASSED, security_schemes
  41 
  42         for key, path in paths.items():
  43             if not path:
  44                 continue
  45             if key in LINE_FIELD_NAMES:
  46                 continue
  47             for value in path.values():
  48                 if not isinstance(value, dict):
  49                     continue
  50                 operation_security = value.get('security')
  51                 if operation_security and isinstance(operation_security, list):
  52                     for sec in operation_security[0]:
  53                         if sec in filtered_dict:
  54                             return CheckResult.FAILED, security_schemes
  55 
  56         return CheckResult.PASSED, conf
  57 
  58 
  59 check = ClearTestAPIKey()
  60
  [end of checkov/openapi/checks/resource/generic/ClearTextAPIKey.py]
  </code>
  
  I need you to solve this issue by generating a single patch file that I can apply directly to this repository using git apply. Please respond with a single patch file in the following format.
  <patch>
  diff --git a/file.py b/file.py
  --- a/file.py
  +++ b/file.py
  @@ -1,27 +1,35 @@
   def euclidean(a, b):
  -    while b:
  -        a, b = b, a % b
  -    return a
  +    if b == 0:
  +        return a
  +    return euclidean(b, a % b)
   
   
   def bresenham(x0, y0, x1, y1):
       points = []
       dx = abs(x1 - x0)
       dy = abs(y1 - y0)
  -    sx = 1 if x0 < x1 else -1
  -    sy = 1 if y0 < y1 else -1
  -    err = dx - dy
  +    x, y = x0, y0
  +    sx = -1 if x0 > x1 else 1
  +    sy = -1 if y0 > y1 else 1
   
  -    while True:
  -        points.append((x0, y0))
  -        if x0 == x1 and y0 == y1:
  -            break
  -        e2 = 2 * err
  -        if e2 > -dy:
  -            err -= dy
  -            x0 += sx
  -        if e2 < dx:
  -            err += dx
  -            y0 += sy
  +    if dx > dy:
  +        err = dx / 2.0
  +        while x != x1:
  +            points.append((x, y))
  +            err -= dy
  +            if err < 0:
  +                y += sy
  +                err += dx
  +            x += sx
  +    else:
  +        err = dy / 2.0
  +        while y != y1:
  +            points.append((x, y))
  +            err -= dx
  +            if err < 0:
  +                x += sx
  +                err += dy
  +            y += sy
  +
  +    points.append((x, y))
       return points
  
  </patch>
golden_diff: diff --git a/checkov/openapi/checks/resource/generic/ClearTextAPIKey.py b/checkov/openapi/checks/resource/generic/ClearTextAPIKey.py
  --- a/checkov/openapi/checks/resource/generic/ClearTextAPIKey.py
  +++ b/checkov/openapi/checks/resource/generic/ClearTextAPIKey.py
  @@ -17,6 +17,16 @@
                            block_type=BlockType.DOCUMENT)
   
       def scan_entity_conf(self, conf: dict[str, Any], entity_type: str) -> tuple[CheckResult, dict[str, Any]]:  # type:ignore[override]  # return type is different than the base class
  +        schemes = conf.get("schemes")
  +        if schemes and isinstance(schemes, list):
  +            if "http" not in schemes and "wp" not in schemes:
  +                return CheckResult.PASSED, conf
  +
  +        servers = conf.get("servers")
  +        if servers and isinstance(servers, list):
  +            if not any(server['url'].startswith('http://') for server in servers):
  +                return CheckResult.PASSED, conf
  +
           components = conf.get("components")
           security_def = conf.get("securityDefinitions")
           if components and isinstance(components, dict):
  
verification_info: {"golden_diff": "diff --git a/checkov/openapi/checks/resource/generic/ClearTextAPIKey.py b/checkov/openapi/checks/resource/generic/ClearTextAPIKey.py\n--- a/checkov/openapi/checks/resource/generic/ClearTextAPIKey.py\n+++ b/checkov/openapi/checks/resource/generic/ClearTextAPIKey.py\n@@ -17,6 +17,16 @@\n                          block_type=BlockType.DOCUMENT)\n \n     def scan_entity_conf(self, conf: dict[str, Any], entity_type: str) -> tuple[CheckResult, dict[str, Any]]:  # type:ignore[override]  # return type is different than the base class\n+        schemes = conf.get(\"schemes\")\n+        if schemes and isinstance(schemes, list):\n+            if \"http\" not in schemes and \"wp\" not in schemes:\n+                return CheckResult.PASSED, conf\n+\n+        servers = conf.get(\"servers\")\n+        if servers and isinstance(servers, list):\n+            if not any(server['url'].startswith('http://') for server in servers):\n+                return CheckResult.PASSED, conf\n+\n         components = conf.get(\"components\")\n         security_def = conf.get(\"securityDefinitions\")\n         if components and isinstance(components, dict):\n", "issue": "CKV_OPENAPI_20 incorrectly flags API keys via HTTPS\n**Describe the issue**\r\n\r\n#5253 added CKV_OPENAPI_20 with the message \"Ensure that API keys are not sent over cleartext\", but the [check](https://github.com/bridgecrewio/checkov/blob/main/checkov/openapi/checks/resource/generic/ClearTextAPIKey.py) does not check the API's supported schemes.\r\n\r\nIf the intent of this check is to prevent cleartext use of API keys, then if the root level [`schemes`](https://swagger.io/docs/specification/2-0/api-host-and-base-path/) key in OpenAPI 2.0 or [`servers`](https://swagger.io/docs/specification/api-host-and-base-path/) key in OpenAPI 3.0 specifies only `https` (2.0) or only `url`s which are HTTPS (3.0), this check should pass.\r\n\r\n**Examples**\r\n\r\n[fail2.json](https://github.com/bridgecrewio/checkov/blob/main/tests/openapi/checks/resource/generic/example_ClearTextAPIKey/fail2.json) and its YAML counterpart should fail, but if they specified `\"schemes\": [\"https\"]`, they should not.\r\n\r\nDitto for the OpenAPI 3.0 version of this example.\r\n\r\n**Version (please complete the following information):**\r\n\r\n2.3.312\r\n\r\n**Additional context**\r\n\r\nIt may be that the message is wrong and you actually intend to flag all use of API keys, but if that's the case, the message should convey that. I also would argue that header API keys should not be scrutinized the same way as query parameter API keys, since the risk of leaking the API key unintentionally is higher with the latter.\n", "before_files": [{"content": "from __future__ import annotations\n\nfrom typing import Any\nfrom checkov.common.models.enums import CheckResult, CheckCategories\nfrom checkov.common.checks.enums import BlockType\nfrom checkov.common.util.consts import LINE_FIELD_NAMES\nfrom checkov.openapi.checks.base_openapi_check import BaseOpenapiCheck\n\n\nclass ClearTestAPIKey(BaseOpenapiCheck):\n    def __init__(self) -> None:\n        id = \"CKV_OPENAPI_20\"\n        name = \"Ensure that API keys are not sent over cleartext\"\n        categories = (CheckCategories.API_SECURITY,)\n        supported_resources = ('paths',)\n        super().__init__(name=name, id=id, categories=categories, supported_entities=supported_resources,\n                         block_type=BlockType.DOCUMENT)\n\n    def scan_entity_conf(self, conf: dict[str, Any], entity_type: str) -> tuple[CheckResult, dict[str, Any]]:  # type:ignore[override]  # return type is different than the base class\n        components = conf.get(\"components\")\n        security_def = conf.get(\"securityDefinitions\")\n        if components and isinstance(components, dict):\n            security_schemes = components.get(\"securitySchemes\") or {}\n        elif security_def:\n            security_schemes = security_def\n        else:\n            return CheckResult.PASSED, conf\n\n        paths = conf.get('paths')\n        if not isinstance(paths, dict):\n            return CheckResult.PASSED, security_schemes\n\n        filtered_dict = {}\n        if isinstance(security_schemes, dict):\n            for name, scheme in security_schemes.items():\n                if isinstance(scheme, dict) and scheme.get('type') == \"apiKey\":\n                    filtered_dict[name] = scheme\n\n        if not filtered_dict:\n            return CheckResult.PASSED, security_schemes\n\n        for key, path in paths.items():\n            if not path:\n                continue\n            if key in LINE_FIELD_NAMES:\n                continue\n            for value in path.values():\n                if not isinstance(value, dict):\n                    continue\n                operation_security = value.get('security')\n                if operation_security and isinstance(operation_security, list):\n                    for sec in operation_security[0]:\n                        if sec in filtered_dict:\n                            return CheckResult.FAILED, security_schemes\n\n        return CheckResult.PASSED, conf\n\n\ncheck = ClearTestAPIKey()\n", "path": "checkov/openapi/checks/resource/generic/ClearTextAPIKey.py"}]}