Skip to content

feat: API key and HTTP basic authentication support#24

Open
halotukozak wants to merge 26 commits intomasterfrom
feat/security-schemes
Open

feat: API key and HTTP basic authentication support#24
halotukozak wants to merge 26 commits intomasterfrom
feat/security-schemes

Conversation

@halotukozak
Copy link
Copy Markdown
Member

@halotukozak halotukozak commented Mar 23, 2026 •
edited
Loading

Summary

  • Add SecurityScheme sealed interface model (Bearer, ApiKey with header/query, Basic)
  • Extend SpecParser to extract securitySchemes from OpenAPI spec and resolve global security references
  • Dynamic applyAuth() generation in ApiClientBaseGenerator — conditional logic per scheme type
  • Security-aware constructor params in ClientGenerator — backward-compatible (token for single Bearer)
  • Wire spec files through JustworksSharedTypesTask for end-to-end security scheme generation
  • Lightweight SpecParser.parseSecuritySchemes() method for shared types task — avoids full spec re-parse

Test plan

  • SpecParserSecurityTest — 8 tests for scheme extraction (bearer, apiKey header/query, basic, filtering)
  • ApiClientBaseGeneratorTest — 24 tests including dynamic applyAuth for all scheme types
  • ClientGeneratorTest — 28 tests including security-aware constructors
  • JustworksPluginFunctionalTest — 2 functional tests for on-disk ApiClientBase with security
  • Backward compatibility: specs without security produce unchanged output

🤖 Generated with Claude Code

Copilot AI review requested due to automatic review settings March 23, 2026 10:42
Copilot AI reviewed Mar 23, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Adds first-class OpenAPI security scheme support (API key + HTTP Basic, alongside Bearer/backward-compat) to the parsing and codegen pipeline, and wires Gradle plugin shared-type generation to reflect spec-defined authentication.

Changes:

  • Introduces SecurityScheme / ApiKeyLocation in the core model and parses global securitySchemes + security usage from OpenAPI.
  • Generates auth-aware ApiClientBase.applyAuth() and security-aware client constructors (with backward-compat behavior for legacy Bearer-only usage).
  • Updates Gradle plugin to feed spec files into shared type generation; adds extensive unit + functional tests.

Reviewed changes

Copilot reviewed 13 out of 13 changed files in this pull request and generated 5 comments.

Show a summary per file
File Description
plugin/src/main/kotlin/com/avsystem/justworks/gradle/JustworksSharedTypesTask.kt Adds specFiles input and parses specs to drive shared ApiClientBase auth generation.
plugin/src/main/kotlin/com/avsystem/justworks/gradle/JustworksPlugin.kt Wires each spec into the shared types task for security scheme extraction.
plugin/src/functionalTest/kotlin/com/avsystem/justworks/gradle/JustworksPluginFunctionalTest.kt Functional coverage for security-aware vs backward-compatible ApiClientBase.
core/src/test/resources/security-schemes-spec.yaml Fixture spec covering Bearer/apiKey/header+query/basic.
core/src/test/kotlin/com/avsystem/justworks/core/parser/SpecParserSecurityTest.kt Unit tests for security scheme extraction/filtering.
core/src/test/kotlin/com/avsystem/justworks/core/gen/ClientGeneratorTest.kt Constructor generation tests for various security scheme sets.
core/src/test/kotlin/com/avsystem/justworks/core/gen/ApiClientBaseGeneratorTest.kt Tests for generated constructor params and applyAuth() body per scheme.
core/src/main/kotlin/com/avsystem/justworks/core/parser/SpecParser.kt Extracts referenced security schemes from components + global security requirements.
core/src/main/kotlin/com/avsystem/justworks/core/model/ApiSpec.kt Adds SecurityScheme model and ApiSpec.securitySchemes.
core/src/main/kotlin/com/avsystem/justworks/core/gen/Names.kt Adds BASE64_CLASS for Basic auth generation.
core/src/main/kotlin/com/avsystem/justworks/core/gen/CodeGenerator.kt Passes security schemes into shared-type generation.
core/src/main/kotlin/com/avsystem/justworks/core/gen/ClientGenerator.kt Generates security-aware constructors and super-calls.
core/src/main/kotlin/com/avsystem/justworks/core/gen/ApiClientBaseGenerator.kt Generates scheme-dependent auth params + dynamic applyAuth() implementation.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@halotukozak halotukozak mentioned this pull request Mar 23, 2026
Open
4 tasks
@github-actions
Copy link
Copy Markdown

github-actions bot commented Mar 24, 2026 •
edited
Loading

Coverage Report

Overall Project 96.14% -0.13% 🍏
Files changed 98.67% 🍏

File Coverage
Names.kt 100% 🍏
ArrowHelpers.kt 100% 🍏
ApiSpec.kt 100% 🍏
AuthParam.kt 100% 🍏
ApiClientBaseGenerator.kt 100% 🍏
ClientGenerator.kt 99.78% 🍏
Hierarchy.kt 99.08% 🍏
NameUtils.kt 97.95% -0.58% 🍏
SpecParser.kt 94.07% -0.47% 🍏
ApiResponseGenerator.kt 92.99% 🍏
Issue.kt 90% 🍏
CodeGenerator.kt 86.15% 🍏

@halotukozak @claude
feat(core): add security scheme extraction and auth-aware code genera…
2cd275d 
…tion

Parse security schemes (Bearer, Basic, ApiKey) from OpenAPI specs and
generate auth-aware ApiClientBase with corresponding constructor parameters
and header/query injection. Wire spec files into JustworksSharedTypesTask
for security scheme extraction.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@halotukozak halotukozak force-pushed the feat/security-schemes branch from 0c0cb14 to 2cd275d Compare March 25, 2026 11:39
@halotukozak
Merge remote-tracking branch 'origin/master' into feat/security-schemes
b89c553 
# Conflicts:
#	core/src/main/kotlin/com/avsystem/justworks/core/gen/ClientGenerator.kt
#	core/src/main/kotlin/com/avsystem/justworks/core/gen/CodeGenerator.kt
#	core/src/main/kotlin/com/avsystem/justworks/core/gen/shared/ApiClientBaseGenerator.kt
#	core/src/test/kotlin/com/avsystem/justworks/core/gen/ApiClientBaseGeneratorTest.kt
#	core/src/test/kotlin/com/avsystem/justworks/core/gen/ClientGeneratorTest.kt
@halotukozak halotukozak requested a review from Copilot April 2, 2026 11:24
@halotukozak halotukozak self-assigned this Apr 2, 2026
Copilot AI reviewed Apr 2, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 17 out of 17 changed files in this pull request and generated 6 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

halotukozak and others added 6 commits April 2, 2026 13:47
@halotukozak
refactor: streamline property handling in ApiClientBaseGenerator an…
3a28795 
…d replace `warn` with `accumulate`

- Replace mutable property list with direct property creation in `classBuilder`.
- Remove redundant `warn` function and centralize warning handling using `accumulate`.
- Update context receiver parameter names in `ArrowHelpers` for clarity.
- Enforce non-null checks and ensure consistent warning accumulation in `SpecParser`.
@halotukozak
refactor: simplify constructor migration and update context receiver …
46cd5b8 
…syntax

- Move `primaryConstructor` invocation back to `classBuilder`.
- Adjust context receiver parameter syntax for improved consistency and readability.
- Ensure `securitySchemes` are deduplicated by name in `CodeGenerator`.
@halotukozak
refactor: remove redundant test case and add validation for conflicti…
b496517 
…ng security schemes

- Delete unused `no securitySchemes` test in `ClientGeneratorTest`.
- Add warning for conflicting security scheme types in `JustworksSharedTypesTask`.
@halotukozak
refactor(core, test): enhance security scheme handling and simplify k…
9273462 
…ey utilities
@halotukozak @claude
refactor: extract shared parsing logic and add lightweight security s…
7170e61 
…cheme extraction

Deduplicate SpecParser by extracting loadOpenApi() and parseSpec() helpers.
Add parseSecuritySchemes() for lightweight extraction without full schema
resolution. Make ParseResult generic to support both ApiSpec and
List<SecurityScheme> results. Update JustworksSharedTypesTask to use the
lightweight method, avoiding double full-parse of spec files.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@halotukozak @claude
Merge remote-tracking branch 'origin/master' into feat/security-schemes
cc2a256 
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@halotukozak halotukozak requested a review from mzielu April 2, 2026 16:07
@halotukozak halotukozak added this to the 0.0.2 milestone Apr 2, 2026
@halotukozak halotukozak requested review from MattK97 and removed request for mzielu April 7, 2026 12:20
@halotukozak
Merge branch 'master' into feat/security-schemes
d4ced5a 
# Conflicts:
#	core/src/main/kotlin/com/avsystem/justworks/core/gen/client/ClientGenerator.kt
@halotukozak
Merge branch 'master' into feat/security-schemes
4b76891 
# Conflicts:
#	core/src/main/kotlin/com/avsystem/justworks/core/gen/client/ClientGenerator.kt
@halotukozak
fmt
d385809
@halotukozak
feat(core): add support for OpenAPI security schemes in API client ge…
d19d1ce 
…neration

- Generate authentication handling for security schemes (Bearer, Basic, API Key).
- Document security scheme support and configuration in README.
- Refactor `ApiResponseGenerator` to include security scheme logic.
- Update tests to validate security scheme handling.
MattK97
MattK97 requested changes Apr 9, 2026
View reviewed changes
@halotukozak
refactor(core): rename accumulate to accumulateAndReturnNull in `…
6aa147f 
…ArrowHelpers` and update `SpecParser` usage
@halotukozak
refactor(core): extract AuthParam sealed interface and refactor aut…
22e4223 
…h parameter generation

- Move `AuthParam` logic to a dedicated file.
- Simplify `buildAuthConstructorParams` and authentication handling in `ApiClientBaseGenerator`.
@halotukozak
refactor(core): remove security scheme handling in shared types gener…
4b9c7ab 
…ation and client base generator

- Update `ApiClientBaseGenerator` to remove explicit dependencies on `SecurityScheme`.
- Simplify `JustworksSharedTypesTask` by removing security schemes extraction.
- Streamline `CodeGenerator` and `ClientGenerator` to simplify API client construction and shared type generation.
- Update tests to match new design.
halotukozak and others added 7 commits April 9, 2026 15:41
@halotukozak @claude
refactor(core): move specTitle out of SecurityScheme model and saniti…
64e8a3f 
…ze identifier generation

specTitle is a generation concern, not a property of the scheme itself.
Move it to ClientGenerator where the spec context is available, keeping
SecurityScheme a pure domain model. Also strip non-alphanumeric chars in
toPascalCase so free-text titles like "Payments API (v2)" produce valid
Kotlin identifiers.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@halotukozak @claude
fix: update README for per-client auth, remove dead code, add sanitiz…
f1e7668 
…ation tests

- Update security schemes docs to reflect specTitle scoping and
  per-client applyAuth() override (not in ApiClientBase)
- Remove unused SpecParser.parseSecuritySchemes() method
- Add toPascalCase tests for special character stripping
- Cache paramNames() call in query scheme loop

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@halotukozak @claude
fix: review fixes — UTF-8 Basic auth encoding, applyAuth tests, accum…
4c9e621 
…ulate helper

- Explicit Charsets.UTF_8 in generated Basic auth toByteArray() per RFC 7617
- Add applyAuth body assertions for all 4 scheme types in ClientGeneratorTest
- Add accumulate() Unit helper for side-effect-only warning accumulation
- Pre-compute paramNames() once in buildApplyAuth instead of per-loop

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@halotukozak
refactor(core): replace paramNames with toAuthParam for security …
13900da 
…scheme handling in `ClientGenerator`

- Introduce `AuthParam` sealed interface to represent auth parameters.
- Update `ClientGenerator` to use `toAuthParam`, simplifying authentication handling.
- Refactor header and query parameter generation to leverage `AuthParam` types instead of raw strings.
@halotukozak
refactor(core): streamline toAuthParam usage and refactor `ClientGe…
f454fa0 
…nerator` security scheme handling

- Separate `toAuthParam` methods for each security scheme type, improving readability.
- Refactor header and query param logic to directly use security schemes without intermediate mappings.
- Rename `schemaModelsScope` to `memoScope` for clarity in `Hierarchy` logic.
@halotukozak
fmt
55ddfb0
@halotukozak
refactor(core): update AuthParam constructors for consistent token …
dea811b 
…naming and formatting

- Rename `Bearer` suffix to `Token` for improved clarity.
- Simplify `ApiKey` constructor by removing redundant suffix.
@halotukozak halotukozak requested a review from Copilot April 9, 2026 14:57
Copilot AI reviewed Apr 9, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 30 out of 30 changed files in this pull request and generated 15 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@halotukozak halotukozak changed the base branch from master to feat/typed-error-responses April 9, 2026 15:23
@halotukozak halotukozak changed the base branch from feat/typed-error-responses to master April 9, 2026 15:23
@halotukozak halotukozak requested a review from MattK97 April 9, 2026 15:24
@halotukozak
refactor(core): update ApiClientBase and ClientGenerator to suppo…
51ce217 
…rt global token param and Bearer auth inheritance

- Add `token` lambda as a constructor parameter in `ApiClientBase`.
- Update `applyAuth` to include Bearer token logic in `ApiClientBase`.
- Simplify client-specific `applyAuth` for single Bearer scheme to rely on base class.
- Refactor `ClientGenerator` to handle token inheritance for shared authentication logic.
@halotukozak
refactor(core): remove global token inheritance and update `applyAuth…
7b1db83 
…` for per-client auth logic

- Remove `token` lambda from `ApiClientBase` constructor and its associated Bearer auth handling.
- Refactor `applyAuth` to be a no-op in `ApiClientBase`, leaving auth implementation to per-client overrides.
- Update `ClientGenerator` to support per-client authentication setup.
- Modify tests to align with the new per-client authentication model.
@halotukozak
test(core): add tests for unsupported and undefined security schemes
abc18e7 
- Add handling for warnings regarding undefined schemes and unsupported types (Digest and OAuth2).
- Expand `SpecParserSecurityTest` with new test cases for excluded and unreferenced schemes.
- Update `security-schemes-spec.yaml` to include new scheme entries for testing.
@halotukozak
fmt
6616d6f
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot Copilot left review comments

@MattK97 MattK97 Awaiting requested review from MattK97

Requested changes must be addressed to merge this pull request.

Assignees

@halotukozak halotukozak

Labels

None yet

Projects

None yet

Milestone

0.0.2

Development

Successfully merging this pull request may close these issues.

3 participants

@halotukozak @MattK97