@pikku/openapi-parser 0.12.13 → 0.12.14

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @pikku/openapi-parser
 
+## 0.12.14
+
+### Patch Changes
+
+- a10e88d: auth-config: new `extraHeaders` field — static headers baked into every generated request (the delegated login call and all proxied service calls), for upstreams that route on a header such as multi-tenant APIs resolving the tenant from `Origin`.
+
 ## 0.12.13
 
 ### Patch Changes

package/dist/auth-config.d.ts

@@ -39,6 +39,7 @@ export declare const AuthConfigSchema: z.ZodObject<{
         raw: "raw";
         bearer: "bearer";
     }>>;
+    extraHeaders: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
     delegated: z.ZodOptional<z.ZodObject<{
         loginPath: z.ZodString;
         loginMethod: z.ZodDefault<z.ZodString>;

package/dist/auth-config.js

@@ -38,6 +38,13 @@ export const AuthConfigSchema = z.object({
     headerName: z.string().optional(),
     /** 'raw' sends the bare token; 'bearer' prefixes it. Default: bearer for Authorization, raw for custom headers. */
     headerFormat: z.enum(['raw', 'bearer']).optional(),
+    /**
+     * Static headers sent on EVERY request — the delegated login call and all
+     * proxied API calls. Needed for upstreams that route on a header, e.g. a
+     * multi-tenant API that resolves the tenant from an `Origin` header and
+     * rejects requests without it.
+     */
+    extraHeaders: z.record(z.string(), z.string()).optional(),
     /** Present when end-users sign in with their existing upstream credentials (delegated login). */
     delegated: DelegatedLoginSchema.optional(),
 });

package/dist/codegen.js

@@ -839,7 +839,12 @@ function generateUpstreamAuthFile(vars, authConfig) {
     lines.push(`  credentials: ${pascalName}UpstreamCredentials,`);
     lines.push('  baseUrl: string');
     lines.push(`): Promise<${pascalName}UpstreamIdentity | null> => {`);
-    lines.push("  const headers: Record<string, string> = { 'Content-Type': 'application/json' }");
+    lines.push('  const headers: Record<string, string> = {');
+    lines.push("    'Content-Type': 'application/json',");
+    for (const [header, value] of Object.entries(authConfig.extraHeaders ?? {})) {
+        lines.push(`    ${JSON.stringify(header)}: ${JSON.stringify(value)},`);
+    }
+    lines.push('  }');
     lines.push('  const body: Record<string, string> = {}');
     if (delegated.credentials.includes('email')) {
         lines.push('  if (credentials.email) body.email = credentials.email');
@@ -1041,6 +1046,9 @@ function generateServiceFile(spec, opPairs, vars, flags) {
     lines.push('    const query: Record<string, string> = {}');
     lines.push('    const headers: Record<string, string> = {');
     lines.push("      'Content-Type': 'application/json',");
+    for (const [header, value] of Object.entries(flags.authConfig?.extraHeaders ?? {})) {
+        lines.push(`      ${JSON.stringify(header)}: ${JSON.stringify(value)},`);
+    }
     lines.push('    }');
     lines.push('');
     // When camelCase flag is on, use rawData (snake_case converted) for route matching

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pikku/openapi-parser",
-  "version": "0.12.13",
+  "version": "0.12.14",
   "description": "OpenAPI spec parser and code generator for Pikku",
   "author": "yasser.fadl@gmail.com",
   "license": "MIT",

package/src/auth-config.ts

@@ -41,6 +41,13 @@ export const AuthConfigSchema = z.object({
   headerName: z.string().optional(),
   /** 'raw' sends the bare token; 'bearer' prefixes it. Default: bearer for Authorization, raw for custom headers. */
   headerFormat: z.enum(['raw', 'bearer']).optional(),
+  /**
+   * Static headers sent on EVERY request — the delegated login call and all
+   * proxied API calls. Needed for upstreams that route on a header, e.g. a
+   * multi-tenant API that resolves the tenant from an `Origin` header and
+   * rejects requests without it.
+   */
+  extraHeaders: z.record(z.string(), z.string()).optional(),
   /** Present when end-users sign in with their existing upstream credentials (delegated login). */
   delegated: DelegatedLoginSchema.optional(),
 })

package/src/codegen.test.ts

@@ -932,6 +932,29 @@ describe('auth config', () => {
     )
   })
 
+  test('extraHeaders are baked into the service and the upstream-auth login', () => {
+    const spec = makeSpec({ operations: [makeOp()] })
+    const files = generateAddonFromOpenAPI(spec, makeVars(), {
+      oauth: false,
+      secret: false,
+      credential: 'bearer',
+      authConfig: {
+        ...delegatedConfig,
+        extraHeaders: { Origin: 'https://tenant.example.com' },
+      },
+    })
+    const service = files['src/test-api-api.service.ts']
+    assert.ok(
+      service.includes('"Origin": "https://tenant.example.com",'),
+      'service headers init should carry the static header'
+    )
+    const authFile = files['src/test-api-upstream-auth.ts']
+    assert.ok(
+      authFile.includes('"Origin": "https://tenant.example.com",'),
+      'login fetch should carry the static header'
+    )
+  })
+
   test('no delegated config → no upstream-auth file', () => {
     const spec = makeSpec({ operations: [makeOp()] })
     const files = generateAddonFromOpenAPI(spec, makeVars(), {

package/src/codegen.ts

@@ -1132,9 +1132,12 @@ function generateUpstreamAuthFile(
   lines.push(`  credentials: ${pascalName}UpstreamCredentials,`)
   lines.push('  baseUrl: string')
   lines.push(`): Promise<${pascalName}UpstreamIdentity | null> => {`)
-  lines.push(
-    "  const headers: Record<string, string> = { 'Content-Type': 'application/json' }"
-  )
+  lines.push('  const headers: Record<string, string> = {')
+  lines.push("    'Content-Type': 'application/json',")
+  for (const [header, value] of Object.entries(authConfig.extraHeaders ?? {})) {
+    lines.push(`    ${JSON.stringify(header)}: ${JSON.stringify(value)},`)
+  }
+  lines.push('  }')
   lines.push('  const body: Record<string, string> = {}')
   if (delegated.credentials.includes('email')) {
     lines.push('  if (credentials.email) body.email = credentials.email')
@@ -1405,6 +1408,11 @@ function generateServiceFile(
   lines.push('    const query: Record<string, string> = {}')
   lines.push('    const headers: Record<string, string> = {')
   lines.push("      'Content-Type': 'application/json',")
+  for (const [header, value] of Object.entries(
+    flags.authConfig?.extraHeaders ?? {}
+  )) {
+    lines.push(`      ${JSON.stringify(header)}: ${JSON.stringify(value)},`)
+  }
   lines.push('    }')
   lines.push('')
   // When camelCase flag is on, use rawData (snake_case converted) for route matching