@pikku/openapi-parser 0.12.13 → 0.12.15

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @pikku/openapi-parser
 
+## 0.12.15
+
+### Patch Changes
+
+- 854c342: Fix workspace addon integration: exclude nested pikku projects from inspection (prevents "More than one CoreUserSession/CoreConfig found" when a workspace addon is linked), widen the generated addon service `call()` data param to `unknown` so schema-less function inputs compile, and add `@pikku/inspector` + `@standard-schema/spec` to the generated addon devDependencies so its `.pikku` gen files typecheck.
+
+## 0.12.14
+
+### Patch Changes
+
+- a10e88d: auth-config: new `extraHeaders` field — static headers baked into every generated request (the delegated login call and all proxied service calls), for upstreams that route on a header such as multi-tenant APIs resolving the tenant from `Origin`.
+
 ## 0.12.13
 
 ### Patch Changes

package/dist/auth-config.d.ts

@@ -39,6 +39,7 @@ export declare const AuthConfigSchema: z.ZodObject<{
         raw: "raw";
         bearer: "bearer";
     }>>;
+    extraHeaders: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
     delegated: z.ZodOptional<z.ZodObject<{
         loginPath: z.ZodString;
         loginMethod: z.ZodDefault<z.ZodString>;

package/dist/auth-config.js

@@ -38,6 +38,13 @@ export const AuthConfigSchema = z.object({
     headerName: z.string().optional(),
     /** 'raw' sends the bare token; 'bearer' prefixes it. Default: bearer for Authorization, raw for custom headers. */
     headerFormat: z.enum(['raw', 'bearer']).optional(),
+    /**
+     * Static headers sent on EVERY request — the delegated login call and all
+     * proxied API calls. Needed for upstreams that route on a header, e.g. a
+     * multi-tenant API that resolves the tenant from an `Origin` header and
+     * rejects requests without it.
+     */
+    extraHeaders: z.record(z.string(), z.string()).optional(),
     /** Present when end-users sign in with their existing upstream credentials (delegated login). */
     delegated: DelegatedLoginSchema.optional(),
 });

package/dist/codegen.js

@@ -839,7 +839,12 @@ function generateUpstreamAuthFile(vars, authConfig) {
     lines.push(`  credentials: ${pascalName}UpstreamCredentials,`);
     lines.push('  baseUrl: string');
     lines.push(`): Promise<${pascalName}UpstreamIdentity | null> => {`);
-    lines.push("  const headers: Record<string, string> = { 'Content-Type': 'application/json' }");
+    lines.push('  const headers: Record<string, string> = {');
+    lines.push("    'Content-Type': 'application/json',");
+    for (const [header, value] of Object.entries(authConfig.extraHeaders ?? {})) {
+        lines.push(`    ${JSON.stringify(header)}: ${JSON.stringify(value)},`);
+    }
+    lines.push('  }');
     lines.push('  const body: Record<string, string> = {}');
     if (delegated.credentials.includes('email')) {
         lines.push('  if (credentials.email) body.email = credentials.email');
@@ -1030,10 +1035,11 @@ function generateServiceFile(spec, opPairs, vars, flags) {
     lines.push('  async call<T>(');
     lines.push("    method: 'GET' | 'POST' | 'PUT' | 'DELETE' | 'PATCH',");
     lines.push('    path: string,');
-    lines.push('    data?: Record<string, unknown>');
+    lines.push('    data?: unknown');
     lines.push('  ): Promise<T> {');
+    lines.push('    const input = data as Record<string, unknown> | undefined');
     if (flags.camelCase) {
-        lines.push('    const rawData = data ? _toSnakeCase(data) : data');
+        lines.push('    const rawData = input ? _toSnakeCase(input) : input');
     }
     lines.push('    const route = ROUTES[`${method} ${path}`]');
     lines.push('    let endpoint = path');
@@ -1041,10 +1047,13 @@ function generateServiceFile(spec, opPairs, vars, flags) {
     lines.push('    const query: Record<string, string> = {}');
     lines.push('    const headers: Record<string, string> = {');
     lines.push("      'Content-Type': 'application/json',");
+    for (const [header, value] of Object.entries(flags.authConfig?.extraHeaders ?? {})) {
+        lines.push(`      ${JSON.stringify(header)}: ${JSON.stringify(value)},`);
+    }
     lines.push('    }');
     lines.push('');
     // When camelCase flag is on, use rawData (snake_case converted) for route matching
-    const dataVar = flags.camelCase ? 'rawData' : 'data';
+    const dataVar = flags.camelCase ? 'rawData' : 'input';
     lines.push(`    if (${dataVar} && route) {`);
     lines.push('      // Interpolate path params');
     lines.push('      for (const param of route.path) {');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pikku/openapi-parser",
-  "version": "0.12.13",
+  "version": "0.12.15",
   "description": "OpenAPI spec parser and code generator for Pikku",
   "author": "yasser.fadl@gmail.com",
   "license": "MIT",

package/src/auth-config.ts

@@ -41,6 +41,13 @@ export const AuthConfigSchema = z.object({
   headerName: z.string().optional(),
   /** 'raw' sends the bare token; 'bearer' prefixes it. Default: bearer for Authorization, raw for custom headers. */
   headerFormat: z.enum(['raw', 'bearer']).optional(),
+  /**
+   * Static headers sent on EVERY request — the delegated login call and all
+   * proxied API calls. Needed for upstreams that route on a header, e.g. a
+   * multi-tenant API that resolves the tenant from an `Origin` header and
+   * rejects requests without it.
+   */
+  extraHeaders: z.record(z.string(), z.string()).optional(),
   /** Present when end-users sign in with their existing upstream credentials (delegated login). */
   delegated: DelegatedLoginSchema.optional(),
 })

package/src/codegen.test.ts

@@ -932,6 +932,29 @@ describe('auth config', () => {
     )
   })
 
+  test('extraHeaders are baked into the service and the upstream-auth login', () => {
+    const spec = makeSpec({ operations: [makeOp()] })
+    const files = generateAddonFromOpenAPI(spec, makeVars(), {
+      oauth: false,
+      secret: false,
+      credential: 'bearer',
+      authConfig: {
+        ...delegatedConfig,
+        extraHeaders: { Origin: 'https://tenant.example.com' },
+      },
+    })
+    const service = files['src/test-api-api.service.ts']
+    assert.ok(
+      service.includes('"Origin": "https://tenant.example.com",'),
+      'service headers init should carry the static header'
+    )
+    const authFile = files['src/test-api-upstream-auth.ts']
+    assert.ok(
+      authFile.includes('"Origin": "https://tenant.example.com",'),
+      'login fetch should carry the static header'
+    )
+  })
+
   test('no delegated config → no upstream-auth file', () => {
     const spec = makeSpec({ operations: [makeOp()] })
     const files = generateAddonFromOpenAPI(spec, makeVars(), {

package/src/codegen.ts

@@ -1132,9 +1132,12 @@ function generateUpstreamAuthFile(
   lines.push(`  credentials: ${pascalName}UpstreamCredentials,`)
   lines.push('  baseUrl: string')
   lines.push(`): Promise<${pascalName}UpstreamIdentity | null> => {`)
-  lines.push(
-    "  const headers: Record<string, string> = { 'Content-Type': 'application/json' }"
-  )
+  lines.push('  const headers: Record<string, string> = {')
+  lines.push("    'Content-Type': 'application/json',")
+  for (const [header, value] of Object.entries(authConfig.extraHeaders ?? {})) {
+    lines.push(`    ${JSON.stringify(header)}: ${JSON.stringify(value)},`)
+  }
+  lines.push('  }')
   lines.push('  const body: Record<string, string> = {}')
   if (delegated.credentials.includes('email')) {
     lines.push('  if (credentials.email) body.email = credentials.email')
@@ -1394,10 +1397,13 @@ function generateServiceFile(
   lines.push('  async call<T>(')
   lines.push("    method: 'GET' | 'POST' | 'PUT' | 'DELETE' | 'PATCH',")
   lines.push('    path: string,')
-  lines.push('    data?: Record<string, unknown>')
+  lines.push('    data?: unknown')
   lines.push('  ): Promise<T> {')
+  lines.push(
+    '    const input = data as Record<string, unknown> | undefined'
+  )
   if (flags.camelCase) {
-    lines.push('    const rawData = data ? _toSnakeCase(data) : data')
+    lines.push('    const rawData = input ? _toSnakeCase(input) : input')
   }
   lines.push('    const route = ROUTES[`${method} ${path}`]')
   lines.push('    let endpoint = path')
@@ -1405,10 +1411,15 @@ function generateServiceFile(
   lines.push('    const query: Record<string, string> = {}')
   lines.push('    const headers: Record<string, string> = {')
   lines.push("      'Content-Type': 'application/json',")
+  for (const [header, value] of Object.entries(
+    flags.authConfig?.extraHeaders ?? {}
+  )) {
+    lines.push(`      ${JSON.stringify(header)}: ${JSON.stringify(value)},`)
+  }
   lines.push('    }')
   lines.push('')
   // When camelCase flag is on, use rawData (snake_case converted) for route matching
-  const dataVar = flags.camelCase ? 'rawData' : 'data'
+  const dataVar = flags.camelCase ? 'rawData' : 'input'
   lines.push(`    if (${dataVar} && route) {`)
   lines.push('      // Interpolate path params')
   lines.push('      for (const param of route.path) {')