@voxgig/sdkgen 4.19.0 → 4.20.0

package/project/.sdk/src/cmp/go/PrepareAuth_go.ts

@@ -0,0 +1,322 @@
+
+import {
+  Content,
+  File,
+  Folder,
+  cmp,
+  goModule,
+  isHttpBasicAuth,
+  resolveAuthIn,
+  resolveAuthName,
+  resolveAuthPrefix,
+} from '@voxgig/sdkgen'
+
+
+import {
+  KIT,
+  getModelPath,
+} from '@voxgig/apidef'
+
+
+// WHERE THE CREDENTIAL GOES IS A FACT ABOUT THE API, so it is generated
+// rather than templated. This is the go peer of PrepareAuth_ts; read that
+// one first, it carries the full account of the defect.
+//
+// This was a static file at `tm/go/utility/prepare_auth.go` that hardcoded
+//
+//   const headerAuth = "authorization"
+//
+// apidef has always resolved the scheme's `in` and `name` into
+// `main.kit.info.security` — joplin's says `in: "query", name: "token"` —
+// and generation dropped both, so the SDK sent a header the API does not
+// read and never sent the query parameter it does.
+//
+// A template cannot fix this, because the three placements need three
+// different bodies and a template has to pick one. A component emits the
+// branch this API actually uses and nothing else — no dead query code in a
+// bearer-token SDK, and no runtime `if` on a value fixed at generation
+// time. Go makes that stricter than most targets: an unused local is a
+// COMPILE ERROR, so a file that resolved `authPrefix` and then dropped it
+// for a query placement would not build at all.
+const PrepareAuth = cmp(async function PrepareAuth(props: any) {
+  const { target } = props
+  const { model } = props.ctx$
+
+  // The generated source cannot use the `GOMODULE` / `github.com/voxgig/struct`
+  // placeholders: those are rewritten by Main's `Copy({from:'tm/go'})`, and
+  // this file never travels through that Copy. The real import paths go in
+  // here, the same way EntityTypes_go resolves them.
+  const gomodule = goModule(model, target.name)
+
+  const active = isAuthActive_go(model)
+  const where = resolveAuthIn(model)
+  const name = resolveAuthName(model)
+  const prefix = resolveAuthPrefix(model)
+  const basic = isHttpBasicAuth(model)
+
+  // FOLDER NESTING. Main_go opens NO folder around this call: go's layout is
+  // flat at the target root (core/, utility/, feature/, entity/, test/), the
+  // template this replaces lived at `tm/go/utility/prepare_auth.go`, and
+  // `Copy({from:'tm/go'})` lands it at `<root>/utility/`. So the `utility`
+  // folder is opened HERE, exactly as EntityTypes_go opens `entity`.
+  //
+  // The call site matters as much: Config is inside `Folder({name:'core'})`,
+  // and putting PrepareAuth beside it would write `core/utility/prepare_auth.go`
+  // — a second `package utility` nobody imports, while the registrar keeps
+  // calling whatever `utility/` still holds. Main_go calls this at ROOT level.
+  Folder({ name: 'utility' }, () => {
+    File({ name: 'prepare_auth.' + target.ext }, () => {
+      Content(render({ gomodule, active, where, name, prefix, basic }))
+    })
+  })
+})
+
+
+type AuthSpec = {
+  gomodule: string
+  active: boolean
+  where: string
+  name: string
+  prefix: string
+  basic: boolean
+}
+
+
+function render(spec: AuthSpec): string {
+
+  // NO AUTH AT ALL. A public API's SDK gets a prepareAuth that is honest
+  // about it rather than one that deletes a header nobody set. `vs` is left
+  // out of the imports deliberately — go rejects an unused import.
+  if (!spec.active) {
+    return `package utility
+
+import (
+	"${spec.gomodule}/core"
+)
+
+// This API declares no authentication, so there is no credential to place.
+// The function stays in the pipeline because makeSpec calls it
+// unconditionally.
+func prepareAuthUtil(ctx *core.Context) (*core.Spec, error) {
+	spec := ctx.Spec
+	if spec == nil {
+		return nil, ctx.MakeError("auth_no_spec",
+			"Expected context spec property to be defined.")
+	}
+
+	return spec, nil
+}
+`
+  }
+
+  // HTTP Basic is header-only by definition: the scheme is
+  // `Authorization: Basic base64(user:pass)`. It cannot be expressed as a
+  // query parameter or a cookie, so the branch is emitted only where it can
+  // mean something — and base64 is imported only then.
+  const withBasic = spec.basic && 'header' === spec.where
+
+  const head = `package utility
+
+import (
+${withBasic ? `	"encoding/base64"
+
+` : ''}	vs "${spec.gomodule}/utility/struct"
+
+	"${spec.gomodule}/core"
+)
+
+const credName = "${gostr(credLiteral(spec.where, spec.name))}"
+${'cookie' === spec.where ? `const cookieHeader = "cookie"
+` : ''}const optionApikey = "apikey"
+${withBasic ? `const optionSecret = "secret"
+` : ''}const notFound = "__NOTFOUND__"
+
+func prepareAuthUtil(ctx *core.Context) (*core.Spec, error) {
+	spec := ctx.Spec
+	if spec == nil {
+		return nil, ctx.MakeError("auth_no_spec",
+			"Expected context spec property to be defined.")
+	}
+
+	${bagName(spec.where)} := spec.${bagField(spec.where)}
+	options := ctx.Client.OptionsMap()
+
+	// Public APIs that need no auth omit the options.auth block entirely.
+	if options["auth"] == nil {
+		${clear(spec.where)}
+		return spec, nil
+	}
+
+	apikey := vs.GetProp(options, optionApikey, notFound)
+
+	skip := false
+	if apikey == nil {
+		skip = true
+	} else if apikeyStr, ok := apikey.(string); ok &&
+		(apikeyStr == notFound || apikeyStr == "") {
+		skip = true
+	}
+`
+
+  const basicBlock = !withBasic ? '' : `
+	// True HTTP Basic Auth needs TWO credentials, base64-joined - a single
+	// token in the header (the branch below) can never authenticate against
+	// an API that actually checks \`Authorization: Basic base64(user:pass)\`.
+	if basicAuth, _ := vs.GetPath(options, []any{"auth", "basic"}).(bool); basicAuth {
+		secret := vs.GetProp(options, optionSecret, notFound)
+
+		noSecret := false
+		if secret == nil {
+			noSecret = true
+		} else if secretStr, ok := secret.(string); ok &&
+			(secretStr == notFound || secretStr == "") {
+			noSecret = true
+		}
+
+		if skip || noSecret {
+			${clear(spec.where)}
+		} else {
+			apikeyVal, _ := apikey.(string)
+			secretVal, _ := secret.(string)
+			b64 := base64.StdEncoding.EncodeToString([]byte(apikeyVal + ":" + secretVal))
+
+			basicPrefix := ""
+			if ap := vs.GetPath(options, []any{"auth", "prefix"}); ap != nil {
+				basicPrefix, _ = ap.(string)
+			}
+			// Empty prefix (raw apiKey credential) must not add a leading space.
+			if basicPrefix == "" {
+				${bagName(spec.where)}[credName] = b64
+			} else {
+				${bagName(spec.where)}[credName] = basicPrefix + " " + b64
+			}
+		}
+
+		return spec, nil
+	}
+`
+
+  return head + basicBlock + `
+	if skip {
+		${clear(spec.where)}
+	} else {
+${place(spec.where)}
+	}
+
+	return spec, nil
+}
+`
+}
+
+
+// The credential's key, as it goes into the bag.
+//
+// A HEADER name is lowercased. HTTP header names are case-insensitive
+// (RFC 9110 5.1) and go's `req.Header.Set` canonicalises on the wire, so
+// nothing changes over the socket — but this SDK's own header map is keyed
+// in lowercase throughout (`content-type`, and the `authorization` that the
+// generated pipeline/feature/secrets tests assert on), and the shipped
+// `prepare_auth.go` said `"authorization"`. Emitting the resolver's
+// title-cased default here would have left every header SDK's own test
+// suite failing on a purely cosmetic difference.
+//
+// A QUERY parameter and a COOKIE name are case-SENSITIVE, so those go in
+// verbatim: `?token=` is not `?Token=`.
+function credLiteral(where: string, name: string): string {
+  return 'header' === where ? String(name).toLowerCase() : String(name)
+}
+
+
+// The bag the credential lands in, per placement. Cookies ride the header
+// bag because a cookie IS a header.
+function bagName(where: string): string {
+  return 'query' === where ? 'query' : 'headers'
+}
+
+
+function bagField(where: string): string {
+  return 'query' === where ? 'Query' : 'Headers'
+}
+
+
+function clear(where: string): string {
+  return `delete(${bagName(where)}, credName)`
+}
+
+
+function place(where: string): string {
+  if ('query' === where) {
+    // NO PREFIX IN A QUERY STRING. `?token=Bearer%20abc` is not a thing any
+    // API reads; the prefix is a header convention and is dropped here
+    // deliberately rather than silently concatenated.
+    return `		apikeyVal := ""
+		if av, ok := apikey.(string); ok {
+			apikeyVal = av
+		}
+		query[credName] = apikeyVal`
+  }
+
+  if ('cookie' === where) {
+    // Append, never replace: the cookie header may already carry pairs this
+    // SDK did not set, and clobbering it would drop them.
+    return `		apikeyVal := ""
+		if av, ok := apikey.(string); ok {
+			apikeyVal = av
+		}
+		pair := credName + "=" + apikeyVal
+		existing := ""
+		if ec, ok := headers[cookieHeader].(string); ok {
+			existing = ec
+		}
+		if existing == "" {
+			headers[cookieHeader] = pair
+		} else {
+			headers[cookieHeader] = existing + "; " + pair
+		}`
+  }
+
+  return `		authPrefix := ""
+		if ap := vs.GetPath(options, []any{"auth", "prefix"}); ap != nil {
+			authPrefix, _ = ap.(string)
+		}
+		apikeyVal := ""
+		if av, ok := apikey.(string); ok {
+			apikeyVal = av
+		}
+		// Empty prefix (raw apiKey credential) must not add a leading space.
+		if authPrefix == "" {
+			headers[credName] = apikeyVal
+		} else {
+			headers[credName] = authPrefix + " " + apikeyVal
+		}`
+}
+
+
+function gostr(s: string): string {
+  return String(s).replace(/\\/g, '\\\\').replace(/"/g, '\\"')
+}
+
+
+export {
+  PrepareAuth
+}
+
+
+// NOT `isAuthActive`, AND THE DIFFERENCE IS LOAD-BEARING. That helper is
+// also false whenever the SPEC declares no security scheme
+// (`main.kit.info.auth: false`) — a statement about the DEFINITION, not a
+// ban on ever sending a credential. `optspec` still declares `apikey` and
+// makeOptions fills `options.auth` from its defaults, so the runtime
+// `options.auth == null` guard never fired and those SDKs have always sent
+// the credential. Gating the body on `isAuthActive` does not trim dead
+// code, it removes working authentication — which
+// `go: auth null suppresses the credential` catches, and which takes the
+// secrets feature down with it.
+//
+// `main.kit.config.auth.active: false` is the project saying "no credential,
+// ever", and it is the only signal that can be honoured before runtime.
+function isAuthActive_go(model: any): boolean {
+  const auth = getModelPath(model, `main.${KIT}.config.auth`,
+    { only_active: false, required: false })
+  return !(null != auth && false === auth.active)
+}

package/project/.sdk/src/cmp/java/Config_java.ts

@@ -6,6 +6,9 @@ import {
   configDefinition,
   each,
   isAuthActive,
+  isHttpBasicAuth,
+  resolveAuthIn,
+  resolveAuthName,
   resolveAuthPrefix,
   targetFeatures,
 } from '@voxgig/sdkgen'
@@ -53,6 +56,14 @@ const Config = cmp(async function Config(props: any) {
   const authActive = isAuthActive(model)
   // config.auth.prefix override -> spec-derived info.security.prefix -> 'Bearer'
   const authPrefix = resolveAuthPrefix(model)
+  const authBasic = isHttpBasicAuth(model)
+  // `in` and `name` travel with the prefix now. They were resolved by
+  // apidef all along and dropped here, so an apiKey-in-query API got an
+  // Authorization header it does not read. Emitted only when they differ
+  // from the defaults, so a header/Authorization SDK is byte-identical to
+  // what it generated before.
+  const authIn = resolveAuthIn(model)
+  const authName = resolveAuthName(model)
 
   let baseUrl = ''
   try { baseUrl = getModelPath(model, `main.${KIT}.info.servers.0.url`) } catch (_e) { }
@@ -174,7 +185,15 @@ const Config = cmp(async function Config(props: any) {
   }
 
   if (authActive) {
-    options.auth = { prefix: authPrefix }
+    const auth: Record<string, any> = { prefix: authPrefix }
+    // `basic` joins it for the same reason: the generated prepareAuth only
+    // emits the base64(user:pass) branch for a spec-declared HTTP Basic
+    // scheme, and that branch reads this option at runtime — without it the
+    // branch could never fire.
+    if (authBasic) { auth.basic = true }
+    if ('header' !== authIn) { auth.in = authIn }
+    if ('Authorization' !== authName) { auth.name = authName }
+    options.auth = auth
   }
   options.headers = headers
   options.entity = optionsEntity

package/project/.sdk/src/cmp/java/Main_java.ts

@@ -28,6 +28,7 @@ import { MainEntity } from './MainEntity_java'
 import { EntityBase } from './EntityBase_java'
 import { EntityTypes } from './EntityTypes_java'
 import { SdkError } from './SdkError_java'
+import { PrepareAuth } from './PrepareAuth_java'
 import { javaPackage } from './utility_java'
 
 
@@ -72,6 +73,19 @@ const Main = cmp(async function Main(props: any) {
   // Shared entity runtime (entity/EntityBase.java).
   EntityBase({ target })
 
+  // utility/PrepareAuth.java. WHERE the credential goes (header, query
+  // parameter or cookie) and UNDER WHAT NAME are facts about the API, so
+  // the file is generated from the model rather than copied from tm/ —
+  // which is why tm/java/utility/PrepareAuth.java was deleted: the blanket
+  // Copy above and this component would otherwise both claim that path and
+  // jostraca refuses a duplicate output path.
+  //
+  // Called HERE, at Main's top level, and NOT inside the `core` Folder
+  // below. The java target is flat — utility/ is a SIBLING of core/, not a
+  // child — and the component opens `utility` itself, exactly as
+  // EntityBase opens `entity`.
+  PrepareAuth({ target })
+
   // Generate the client class and config in core/.
   Folder({ name: 'core' }, () => {
 

package/project/.sdk/src/cmp/java/PrepareAuth_java.ts

@@ -0,0 +1,298 @@
+
+import {
+  Content,
+  File,
+  Folder,
+  cmp,
+  isAuthSuppressed,
+  isHttpBasicAuth,
+  resolveAuthIn,
+  resolveAuthName,
+} from '@voxgig/sdkgen'
+
+
+import { javaPackage } from './utility_java'
+
+
+// WHERE THE CREDENTIAL GOES IS A FACT ABOUT THE API, so it is generated
+// rather than templated.
+//
+// This was a static file in `tm/java/utility/` that hardcoded
+// `authorization` and a header. apidef has always resolved the scheme's
+// `in` and `name` into `main.kit.info.security` — joplin's says
+// `in: "query", name: "token"` — and generation dropped both. The result
+// was an SDK that sent a header the API does not read and never sent the
+// query parameter it does, so it could not authenticate at all. Four
+// repos in the cedar fleet shipped that way: joplin (`token`), pipedrive
+// (`api_token`), trello (`key`), lm-umbrella (`apiKey`).
+//
+// A template cannot fix this, because the three placements need three
+// different bodies and a template has to pick one. A component emits the
+// branch this API actually uses and nothing else — no dead query code in
+// a bearer-token SDK, and no runtime `if` on a value that is fixed at
+// generation time. The ts port (PrepareAuth_ts) is the donor.
+const PrepareAuth = cmp(async function PrepareAuth(props: any) {
+  const { target } = props
+  const { model } = props.ctx$
+
+  const javapackage = javaPackage(model)
+
+  // `!isAuthSuppressed`, NOT `isAuthActive`. The latter is also false when
+  // the SPEC merely declares no security scheme (`main.kit.info.auth:
+  // false`), and those SDKs still carry a credential: optspec always
+  // declares `apikey` and makeOptions fills `options.auth` from its
+  // defaults, so the runtime guard never fired and they have always sent
+  // it. Only an explicit `main.kit.config.auth.active: false` means "no
+  // credential, ever", which is what isAuthSuppressed reads.
+  const active = !isAuthSuppressed(model)
+  const where = resolveAuthIn(model)
+  const name = resolveAuthName(model)
+  const basic = isHttpBasicAuth(model)
+
+  // FOLDER NESTING. The java target is FLAT: Main opens no `src` folder at
+  // all, and the blanket `Copy({ from: 'tm/java' })` lands core/, utility/,
+  // feature/ and test/ straight at the target root (pom.xml declares
+  // `sourceDirectory` as the project base and includes `utility/**`). So
+  // `utility` is opened HERE — the same shape EntityBase_java uses for
+  // `entity` — and this component must be called from Main's TOP level,
+  // NOT from inside its `Folder({ name: 'core' })`. Nested there it would
+  // write core/utility/PrepareAuth.java, which javac would compile into
+  // the wrong package while Register.java kept calling the stale
+  // utility/PrepareAuth.java.
+  Folder({ name: 'utility' }, () => {
+    File({ name: 'PrepareAuth.' + target.ext }, () => {
+      Content(render({ javapackage, active, where, name, basic }))
+    })
+  })
+})
+
+
+function render(spec: {
+  javapackage: string, active: boolean, where: string, name: string,
+  basic: boolean
+}): string {
+  const jp = spec.javapackage
+
+  // NO AUTH AT ALL. A public API's SDK gets a prepareAuth that is honest
+  // about it rather than one that deletes a header nobody set.
+  if (!spec.active) {
+    return `package ${jp}.utility;
+
+import ${jp}.core.Context;
+import ${jp}.core.Spec;
+
+// This API declares no authentication, so there is no credential to place.
+// The class stays in the pipeline because Register wires prepareAuth
+// unconditionally and MakeSpec calls it on every request.
+final class PrepareAuth {
+
+  private PrepareAuth() {}
+
+  static Spec prepareAuth(Context ctx) {
+    Spec spec = ctx.spec;
+    if (spec == null) {
+      throw ctx.makeError("auth_no_spec",
+          "Expected context spec property to be defined.");
+    }
+
+    return spec;
+  }
+}
+`
+  }
+
+  const header = 'header' === spec.where
+  const query = 'query' === spec.where
+  const cookie = 'cookie' === spec.where
+
+  // HTTP Basic is header-only by definition: the scheme is
+  // `Authorization: Basic base64(user:pass)`. It cannot be expressed as a
+  // query parameter or a cookie, so the branch is emitted only where it
+  // can mean something.
+  const basicBranch = spec.basic && header
+
+  // The bag the credential lands in, per placement. Cookies ride the
+  // header bag because a cookie IS a header.
+  const bag = query ? 'query' : 'headers'
+
+  const imports = [
+    ...(basicBranch ? [
+      'import java.nio.charset.StandardCharsets;',
+      'import java.util.Base64;',
+    ] : []),
+    // `List.of("auth", "prefix")` is the only use of java.util.List, and a
+    // prefix is a HEADER convention — the query and cookie branches drop it,
+    // so neither needs the import.
+    ...(header ? ['import java.util.List;'] : []),
+    'import java.util.Map;',
+  ].join('\n')
+
+  const consts = [
+    `  static final String CRED_NAME = "${javastr(credName(spec.where, spec.name))}";`,
+    ...(cookie ? ['  static final String COOKIE_HEADER = "cookie";'] : []),
+    '  static final String OPTION_APIKEY = "apikey";',
+    ...(basicBranch ? ['  static final String OPTION_SECRET = "secret";'] : []),
+    '  static final String NOT_FOUND = "__NOTFOUND__";',
+  ].join('\n')
+
+  const basicBlock = basicBranch ? `
+    // True HTTP Basic Auth needs TWO credentials, base64-joined - a single
+    // token in the header (the branch below) can never authenticate against
+    // an API that actually checks \`Authorization: Basic base64(user:pass)\`.
+    if (Boolean.TRUE.equals(Struct.getpath(options, List.of("auth", "basic")))) {
+      Object secret = Struct.getprop(options, OPTION_SECRET, NOT_FOUND);
+      boolean noApikey = !(apikey instanceof String)
+          || NOT_FOUND.equals(apikey) || "".equals(apikey);
+      boolean noSecret = !(secret instanceof String)
+          || NOT_FOUND.equals(secret) || "".equals(secret);
+
+      if (noApikey || noSecret) {
+        headers.remove(CRED_NAME);
+      }
+      else {
+        String basicPrefix = "";
+        Object bp = Struct.getpath(options, List.of("auth", "prefix"));
+        if (bp instanceof String) {
+          basicPrefix = (String) bp;
+        }
+        String b64 = Base64.getEncoder().encodeToString(
+            ((String) apikey + ":" + (String) secret).getBytes(StandardCharsets.UTF_8));
+        if ("".equals(basicPrefix)) {
+          headers.put(CRED_NAME, b64);
+        }
+        else {
+          headers.put(CRED_NAME, basicPrefix + " " + b64);
+        }
+      }
+
+      return spec;
+    }
+` : ''
+
+  return `package ${jp}.utility;
+
+${imports}
+
+import ${jp}.core.Context;
+import ${jp}.core.Spec;
+import ${jp}.utility.struct.Struct;
+
+final class PrepareAuth {
+
+  private PrepareAuth() {}
+
+${consts}
+
+  static Spec prepareAuth(Context ctx) {
+    Spec spec = ctx.spec;
+    if (spec == null) {
+      throw ctx.makeError("auth_no_spec",
+          "Expected context spec property to be defined.");
+    }
+
+    Map<String, Object> ${bag} = spec.${bag};
+    Map<String, Object> options = ctx.client.optionsMap();
+
+    // Public APIs that need no auth omit the options.auth block entirely.
+    if (options.get("auth") == null) {
+      ${clear(spec.where)}
+      return spec;
+    }
+
+    Object apikey = Struct.getprop(options, OPTION_APIKEY, NOT_FOUND);
+${basicBlock}
+    boolean skip = false;
+    if (apikey == null) {
+      skip = true;
+    }
+    else if (apikey instanceof String
+        && (NOT_FOUND.equals(apikey) || "".equals(apikey))) {
+      skip = true;
+    }
+
+    if (skip) {
+      ${clear(spec.where)}
+    }
+    else {
+${place(spec.where)}
+    }
+
+    return spec;
+  }
+}
+`
+}
+
+
+// THE CREDENTIAL NAME AS THIS TARGET SPELLS IT.
+//
+// java's header map is a plain case-sensitive LinkedHashMap and the whole
+// generated SDK — Fetcher, SecretsFeature, and the SDK's own PipelineTest —
+// spells the default header `authorization`, exactly as the deleted
+// tm/java/utility/PrepareAuth.java did. Keep that spelling when the model
+// resolves the DEFAULT, so a header-based java SDK behaves byte-for-byte as
+// it did before; a spec that names a header explicitly gets that name
+// verbatim, as do query parameters and cookies.
+// EVERY header name, not just the default. java's map is a case-sensitive
+// LinkedHashMap and the generated SDK spells headers lower-case throughout
+// — Fetcher, SecretsFeature and PipelineTest all do. Special-casing only
+// the literal 'Authorization' left a spec-named header like `X-API-Key`
+// capitalised here while the other nineteen targets lower-cased it, so the
+// same model produced a header java could not find and the rest could.
+// Query parameters and cookies stay verbatim: those ARE case-sensitive.
+function credName(where: string, name: string): string {
+  return 'header' === where ? name.toLowerCase() : name
+}
+
+
+function clear(where: string): string {
+  return 'query' === where ? 'query.remove(CRED_NAME);' : 'headers.remove(CRED_NAME);'
+}
+
+
+function place(where: string): string {
+  if ('query' === where) {
+    // NO PREFIX IN A QUERY STRING. `?token=Bearer%20abc` is not a thing any
+    // API reads; the prefix is a header convention and is dropped here
+    // deliberately rather than silently concatenated.
+    return `      String apikeyVal = apikey instanceof String ? (String) apikey : "";
+      // NO PREFIX IN A QUERY STRING: ?name=Bearer%20abc is not a thing any
+      // API reads, so the auth.prefix option is dropped here deliberately.
+      query.put(CRED_NAME, apikeyVal);`
+  }
+
+  if ('cookie' === where) {
+    return `      String apikeyVal = apikey instanceof String ? (String) apikey : "";
+      // A cookie IS a header, but the request may already carry others, so
+      // the pair is APPENDED rather than replacing the whole cookie header.
+      // No prefix, for the same reason a query parameter carries none.
+      Object existing = Struct.getprop(headers, COOKIE_HEADER, "");
+      String cookie = existing instanceof String ? (String) existing : "";
+      String pair = CRED_NAME + "=" + apikeyVal;
+      headers.put(COOKIE_HEADER, "".equals(cookie) ? pair : cookie + "; " + pair);`
+  }
+
+  return `      String authPrefix = "";
+      Object ap = Struct.getpath(options, List.of("auth", "prefix"));
+      if (ap instanceof String) {
+        authPrefix = (String) ap;
+      }
+      String apikeyVal = apikey instanceof String ? (String) apikey : "";
+      // Empty prefix (raw apiKey credential) must not add a leading space.
+      if ("".equals(authPrefix)) {
+        headers.put(CRED_NAME, apikeyVal);
+      }
+      else {
+        headers.put(CRED_NAME, authPrefix + " " + apikeyVal);
+      }`
+}
+
+
+function javastr(s: string): string {
+  return String(s).replace(/\\/g, '\\\\').replace(/"/g, '\\"')
+}
+
+
+export {
+  PrepareAuth
+}