@voxgig/sdkgen 4.24.0 → 4.24.2

package/project/.sdk/tm/go/test/pipeline_test.go

@@ -2,6 +2,7 @@ package sdktest
 
 
 import (
+	"regexp"
 	"testing"
 
 	sdk "GOMODULE"
@@ -464,13 +465,105 @@ func TestPipelineFeatureOrder(t *testing.T) {
 	})
 }
 
+// plAuthCookiePair matches a cookie credential as PrepareAuth writes it:
+// `<scheme>=K` for the probe key, with no scheme prefix and nothing else in
+// the bag.
+var plAuthCookiePair = regexp.MustCompile(`^[^=;]+=K$`)
+
+// plAuthCred is where this SDK's PrepareAuth actually puts the credential.
+// The name is the API's own scheme name, not always "authorization", so the
+// cases below read it from a probe run instead of asserting a name. Pair is
+// the `<scheme>=` lead-in of a COOKIE credential, which rides the header bag
+// under the key "cookie" instead of taking a header of its own.
+type plAuthCred struct {
+	where string
+	name  string
+	value any
+	pair  string
+}
+
+// plAuthBag picks the container by placement. A cookie credential rides the
+// header bag, because a cookie IS a header.
+func plAuthBag(spec *sdk.Spec, where string) map[string]any {
+	if "query" == where {
+		return spec.Query
+	}
+	return spec.Headers
+}
+
+// plAuth is the options auth block every case passes. `basic: false` is
+// explicit: an HTTP Basic API's generated config carries `auth.basic: true`,
+// and a client that merges it in takes a branch needing a secret as well.
+// With none supplied that branch writes nothing, which the probe would then
+// read as a public API.
+func plAuth(prefix string) map[string]any {
+	return map[string]any{"prefix": prefix, "basic": false}
+}
+
+// plAuthCredential runs PrepareAuth once with both containers present and
+// reports which one it wrote to, and under what name. Nil means this SDK
+// places no credential at all - a public API - which is a legitimate shape.
+func plAuthProbe(t *testing.T, sdkopts map[string]any) *plAuthCred {
+	t.Helper()
+	client, utility := plClient(t, sdkopts)
+	ctx := plCtx(client, utility, nil)
+	ctx.Spec = sdk.NewSpec(map[string]any{"step": "s"})
+	if _, err := utility.PrepareAuth(ctx); err != nil {
+		return nil
+	}
+	for _, where := range []string{"headers", "query"} {
+		for name, value := range plAuthBag(ctx.Spec, where) {
+			pair := ""
+			text, is := value.(string)
+			if "headers" == where && "cookie" == name && is &&
+				plAuthCookiePair.MatchString(text) {
+				pair = text[:len(text)-1]
+			}
+			return &plAuthCred{where: where, name: name, value: value, pair: pair}
+		}
+	}
+	return nil
+}
+
+func plAuthCredential(t *testing.T) *plAuthCred {
+	t.Helper()
+	return plAuthProbe(t, map[string]any{"apikey": "K", "auth": plAuth("Bearer")})
+}
+
+// plAuthAnyCredential is every credential this SDK could possibly place: both
+// credentials and Basic switched on, so whichever branch the API has,
+// something lands unless the API is public.
+func plAuthAnyCredential(t *testing.T) *plAuthCred {
+	t.Helper()
+	return plAuthProbe(t, map[string]any{
+		"apikey": "K",
+		"secret": "S",
+		"auth":   map[string]any{"prefix": "Bearer", "basic": true},
+	})
+}
+
 func TestPipelinePrepareAuth(t *testing.T) {
 
-	authSpec := func(headers map[string]any) *sdk.Spec {
-		if headers == nil {
-			headers = map[string]any{}
+	cred := plAuthCredential(t)
+
+	// placed runs PrepareAuth over a fresh spec, seeding the credential slot
+	// first when seed is non-nil, and reports what is left there.
+	placed := func(t *testing.T, sdkopts map[string]any, seed any) (any, bool) {
+		t.Helper()
+		client, utility := plClient(t, sdkopts)
+		ctx := plCtx(client, utility, nil)
+		ctx.Spec = sdk.NewSpec(map[string]any{"step": "s"})
+		if cred != nil && seed != nil {
+			plAuthBag(ctx.Spec, cred.where)[cred.name] = seed
+		}
+		if _, err := utility.PrepareAuth(ctx); err != nil {
+			t.Fatalf("unexpected error: %v", err)
 		}
-		return sdk.NewSpec(map[string]any{"headers": headers, "step": "s"})
+		if cred == nil {
+			return nil, false
+		}
+		value, has := plAuthBag(ctx.Spec, cred.where)[cred.name]
+		return value, has
 	}
 
 	t.Run("guards-missing-spec", func(t *testing.T) {
@@ -482,86 +575,99 @@ func TestPipelinePrepareAuth(t *testing.T) {
 		}
 	})
 
-	t.Run("apikey-with-prefix-space-joined", func(t *testing.T) {
-		client, utility := plClient(t, map[string]any{
-			"apikey": "K",
-			"auth":   map[string]any{"prefix": "Bearer"},
-		})
-		ctx := plCtx(client, utility, nil)
-		ctx.Spec = authSpec(nil)
-		if _, err := utility.PrepareAuth(ctx); err != nil {
-			t.Fatalf("unexpected error: %v", err)
+	// Without this the cases below cannot fail for an SDK whose credential the
+	// probe misses: every one of them takes the public-API path instead.
+	t.Run("probe-finds-the-credential-this-sdk-places", func(t *testing.T) {
+		if (cred == nil) != (plAuthAnyCredential(t) == nil) {
+			t.Error("the probe missed a credential this SDK places, so every " +
+				"case below takes the public-API path")
+		}
+	})
+
+	t.Run("apikey-placed-where-this-api-puts-it", func(t *testing.T) {
+		if cred == nil {
+			// A public API places nothing, and that is the whole assertion.
+			if _, has := placed(t, map[string]any{
+				"apikey": "K",
+				"auth":   plAuth("Bearer"),
+			}, nil); has {
+				t.Errorf("expected no credential placed at all")
+			}
+			return
+		}
+		if cred.where != "headers" && cred.where != "query" {
+			t.Fatalf("unexpected credential container %q", cred.where)
+		}
+		if "" != cred.pair {
+			// A cookie credential is a `<scheme>=<key>` pair, and the scheme
+			// name leaves no room for the option's prefix.
+			text, _ := cred.value.(string)
+			if !plAuthCookiePair.MatchString(text) {
+				t.Errorf("expected a cookie pair, got %v", cred.value)
+			}
+			return
+		}
+		// A header credential is prefix-joined; a query credential is the raw
+		// key, because a query parameter has nowhere to put a scheme name.
+		want := "Bearer K"
+		if "query" == cred.where {
+			want = "K"
 		}
-		if ctx.Spec.Headers["authorization"] != "Bearer K" {
-			t.Errorf("expected 'Bearer K', got %v", ctx.Spec.Headers["authorization"])
+		if cred.value != want {
+			t.Errorf("expected %q in %s[%q], got %v",
+				want, cred.where, cred.name, cred.value)
 		}
 	})
 
 	t.Run("raw-apikey-empty-prefix-as-is", func(t *testing.T) {
-		client, utility := plClient(t, map[string]any{
+		value, has := placed(t, map[string]any{
 			"apikey": "K",
-			"auth":   map[string]any{"prefix": ""},
-		})
-		ctx := plCtx(client, utility, nil)
-		ctx.Spec = authSpec(nil)
-		if _, err := utility.PrepareAuth(ctx); err != nil {
-			t.Fatalf("unexpected error: %v", err)
+			"auth":   plAuth(""),
+		}, nil)
+		if cred == nil {
+			if has {
+				t.Errorf("expected no credential placed at all")
+			}
+			return
 		}
-		if ctx.Spec.Headers["authorization"] != "K" {
-			t.Errorf("expected raw 'K', got %v", ctx.Spec.Headers["authorization"])
+		if value != cred.pair+"K" {
+			t.Errorf("expected %q, got %v", cred.pair+"K", value)
 		}
 	})
 
-	t.Run("empty-apikey-drops-header", func(t *testing.T) {
-		client, utility := plClient(t, map[string]any{
+	t.Run("empty-apikey-drops-credential", func(t *testing.T) {
+		if _, has := placed(t, map[string]any{
 			"apikey": "",
-			"auth":   map[string]any{"prefix": "Bearer"},
-		})
-		ctx := plCtx(client, utility, nil)
-		ctx.Spec = authSpec(map[string]any{"authorization": "stale"})
-		if _, err := utility.PrepareAuth(ctx); err != nil {
-			t.Fatalf("unexpected error: %v", err)
-		}
-		if _, has := ctx.Spec.Headers["authorization"]; has {
-			t.Errorf("expected authorization dropped, got %v", ctx.Spec.Headers["authorization"])
+			"auth":   plAuth("Bearer"),
+		}, "stale"); has {
+			t.Errorf("expected the credential dropped")
 		}
 	})
 
-	t.Run("missing-apikey-drops-header", func(t *testing.T) {
-		client, utility := plClient(t, map[string]any{
-			"auth": map[string]any{"prefix": "Bearer"},
-		})
+	t.Run("missing-apikey-drops-credential", func(t *testing.T) {
+		sdkopts := map[string]any{"auth": plAuth("Bearer")}
+		client, _ := plClient(t, sdkopts)
 		options := client.OptionsMap()
 		if apikey, _ := options["apikey"].(string); apikey != "" {
 			t.Skip("SDK options carry a configured apikey; case not reproducible here")
 		}
-		ctx := plCtx(client, utility, nil)
-		ctx.Spec = authSpec(map[string]any{"authorization": "stale"})
-		if _, err := utility.PrepareAuth(ctx); err != nil {
-			t.Fatalf("unexpected error: %v", err)
-		}
-		if _, has := ctx.Spec.Headers["authorization"]; has {
-			t.Errorf("expected authorization dropped, got %v", ctx.Spec.Headers["authorization"])
+		if _, has := placed(t, sdkopts, "stale"); has {
+			t.Errorf("expected the credential dropped")
 		}
 	})
 
-	t.Run("public-api-no-auth-block-drops-header", func(t *testing.T) {
-		client, utility := plClient(t, map[string]any{"apikey": "K"})
-		options := client.OptionsMap()
-		if options["auth"] != nil {
+	t.Run("public-api-no-auth-block-drops-credential", func(t *testing.T) {
+		sdkopts := map[string]any{"apikey": "K"}
+		client, _ := plClient(t, sdkopts)
+		if client.OptionsMap()["auth"] != nil {
 			// Option validation supplies an auth shape for this SDK, so a
 			// truly auth-less client cannot be constructed here (the ts test
 			// fakes the client object; Go's prepareAuth reads the concrete
 			// client options).
 			t.Skip("options always carry an auth block in this SDK")
 		}
-		ctx := plCtx(client, utility, nil)
-		ctx.Spec = authSpec(map[string]any{"authorization": "stale"})
-		if _, err := utility.PrepareAuth(ctx); err != nil {
-			t.Fatalf("unexpected error: %v", err)
-		}
-		if _, has := ctx.Spec.Headers["authorization"]; has {
-			t.Errorf("expected authorization dropped, got %v", ctx.Spec.Headers["authorization"])
+		if _, has := placed(t, sdkopts, "stale"); has {
+			t.Errorf("expected the credential dropped")
 		}
 	})
 }

package/project/.sdk/tm/go/test/primary_utility_test.go

@@ -618,6 +618,23 @@ func TestPrimaryUtility(t *testing.T) {
 		authClient := sdk.TestSDK(nil, setupOpts)
 		authUtility := authClient.GetUtility()
 
+		// The corpus writes the credential as `headers.authorization`: a
+		// PLACEHOLDER each runner points at the container and name this API
+		// actually uses. plAuthCredential (pipeline_test.go, same package)
+		// discovers both by running PrepareAuth once.
+		cred := plAuthCredential(t)
+		if cred == nil {
+			t.Fatal("prepareAuth placed no credential in headers or query")
+		}
+
+		// An absent section is runsection's report to make, not a nil-map write.
+		if section, has := primary["prepareAuth"].(map[string]any); has &&
+			("headers" != cred.where || "authorization" != cred.name) {
+			original := section["basic"]
+			section["basic"] = retargetAuth(original, cred)
+			defer func() { section["basic"] = original }()
+		}
+
 		runsection(t, "prepareAuth", func(args ...any) (any, error) {
 			ctx := omniCtx(args[0], authClient, authUtility)
 
@@ -823,3 +840,39 @@ func makeTestFullCtx(client *sdk.ProjectNameSDK, utility *sdk.Utility) *sdk.Cont
 
 // useVS prevents unused import error
 var _ = vs.Clone
+
+
+// retargetAuth rewrites the corpus's `headers` bag to the container this
+// SDK's PrepareAuth writes to, and the `authorization` key inside it to the
+// API's own credential name. Applied only to the prepareAuth section, so
+// real header assertions elsewhere are untouched.
+func retargetAuth(node any, cred *plAuthCred) any {
+	switch value := node.(type) {
+	case map[string]any:
+		out := map[string]any{}
+		for key, child := range value {
+			if "headers" == key {
+				bag := map[string]any{}
+				inner, _ := child.(map[string]any)
+				for bagkey, bagvalue := range inner {
+					name := bagkey
+					if "authorization" == bagkey {
+						name = cred.name
+					}
+					bag[name] = retargetAuth(bagvalue, cred)
+				}
+				out[cred.where] = bag
+			} else {
+				out[key] = retargetAuth(child, cred)
+			}
+		}
+		return out
+	case []any:
+		out := make([]any, len(value))
+		for index, child := range value {
+			out[index] = retargetAuth(child, cred)
+		}
+		return out
+	}
+	return node
+}

package/project/.sdk/tm/java/test/PipelineTest.java

@@ -11,7 +11,6 @@ package JAVAPACKAGE.sdktest;
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertFalse;
 import static org.junit.jupiter.api.Assertions.assertNotNull;
-import static org.junit.jupiter.api.Assertions.assertNull;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 import static org.junit.jupiter.api.Assertions.fail;
 
@@ -23,6 +22,7 @@ import java.util.ArrayList;
 import java.util.LinkedHashMap;
 import java.util.List;
 import java.util.Map;
+import java.util.regex.Pattern;
 
 import org.junit.jupiter.api.Test;
 
@@ -529,13 +529,98 @@ public class PipelineTest {
 
   // --- prepareAuth --------------------------------------------------------------
 
-  static Spec authSpec(Map<String, Object> headers) {
+  // A cookie credential as prepareAuth writes it: `<scheme>=K` for the probe
+  // key, with no scheme prefix and nothing else in the bag.
+  static final Pattern COOKIE_PAIR = Pattern.compile("^[^=;]+=K$");
+
+  static Spec authSpec() {
     Map<String, Object> m = new LinkedHashMap<>();
-    m.put("headers", headers == null ? new LinkedHashMap<>() : headers);
+    m.put("headers", new LinkedHashMap<String, Object>());
+    m.put("query", new LinkedHashMap<String, Object>());
     m.put("step", "s");
     return new Spec(m);
   }
 
+  // Where this SDK's prepareAuth actually puts the credential. The name is
+  // the API's OWN scheme name, not always "authorization", so it is
+  // discovered rather than asserted. `pair` is the `<scheme>=` lead-in of a
+  // COOKIE credential, which rides the header bag under the key "cookie"
+  // instead of taking a header of its own.
+  record AuthCred(String where, String name, Object value, String pair) {
+  }
+
+  // A cookie credential rides the header bag, because a cookie IS a header.
+  static Map<String, Object> authBag(Spec spec, String where) {
+    return "query".equals(where) ? spec.query : spec.headers;
+  }
+
+  // `basic: false` is explicit: an HTTP Basic API's generated config carries
+  // `auth.basic: true`, testSDK merges it in, and the branch it selects needs
+  // a secret as well. With none supplied that branch deliberately writes
+  // nothing, which the probe below would read as a public API.
+  static Map<String, Object> authBlock(String prefix) {
+    return fhMap("prefix", prefix, "basic", Boolean.FALSE);
+  }
+
+  // Run prepareAuth with both containers present and see which one the
+  // generated utility writes to, and under what name. Null means this SDK
+  // places no credential at all - a public API - which is a legitimate
+  // shape, and the tests below assert exactly that instead.
+  static AuthCred authProbe(Map<String, Object> sdkopts) {
+    ProjectNameSDK client = plClient(sdkopts);
+    Utility utility = client.getUtility();
+    Context ctx = plCtx(client, utility, null);
+    ctx.spec = authSpec();
+    utility.prepareAuth.apply(ctx);
+    for (String where : new String[] { "headers", "query" }) {
+      for (Map.Entry<String, Object> entry : authBag(ctx.spec, where).entrySet()) {
+        Object value = entry.getValue();
+        String pair = "";
+        if ("headers".equals(where) && "cookie".equals(entry.getKey())
+            && value instanceof String
+            && COOKIE_PAIR.matcher((String) value).matches()) {
+          String text = (String) value;
+          pair = text.substring(0, text.length() - 1);
+        }
+        return new AuthCred(where, entry.getKey(), value, pair);
+      }
+    }
+    return null;
+  }
+
+  static AuthCred authCredential() {
+    return authProbe(fhMap("apikey", "K", "auth", authBlock("Bearer")));
+  }
+
+  // Every credential this SDK could possibly place: both credentials and
+  // Basic switched on, so whichever branch the API has, something lands
+  // unless the API is public.
+  static AuthCred authAnyCredential() {
+    return authProbe(fhMap(
+        "apikey", "K",
+        "secret", "S",
+        "auth", fhMap("prefix", "Bearer", "basic", Boolean.TRUE)));
+  }
+
+  // Runs prepareAuth over a fresh spec, seeding the credential slot first
+  // when seed is non-null, and reports what is left there.
+  static Object[] authPlaced(Map<String, Object> sdkopts, Object seed) {
+    AuthCred cred = authCredential();
+    ProjectNameSDK client = plClient(sdkopts);
+    Utility utility = client.getUtility();
+    Context ctx = plCtx(client, utility, null);
+    ctx.spec = authSpec();
+    if (cred != null && seed != null) {
+      authBag(ctx.spec, cred.where()).put(cred.name(), seed);
+    }
+    utility.prepareAuth.apply(ctx);
+    if (cred == null) {
+      return new Object[] { null, Boolean.FALSE };
+    }
+    Map<String, Object> bag = authBag(ctx.spec, cred.where());
+    return new Object[] { bag.get(cred.name()), bag.containsKey(cred.name()) };
+  }
+
   @Test
   public void prepareAuth_guardsMissingSpec() {
     ProjectNameSDK client = plClient(fhMap("apikey", "K"));
@@ -545,74 +630,82 @@ public class PipelineTest {
     assertEquals("auth_no_spec", errCodeOf(() -> utility.prepareAuth.apply(ctx)));
   }
 
+  // Without this the cases below cannot fail for an SDK whose credential the
+  // probe misses: every one of them takes the public-API path instead.
   @Test
-  public void prepareAuth_apikeyWithPrefixSpaceJoined() {
-    ProjectNameSDK client = plClient(fhMap(
-        "apikey", "K",
-        "auth", fhMap("prefix", "Bearer")));
-    Utility utility = client.getUtility();
-    Context ctx = plCtx(client, utility, null);
-    ctx.spec = authSpec(null);
-    utility.prepareAuth.apply(ctx);
-    assertEquals("Bearer K", ctx.spec.headers.get("authorization"));
+  public void prepareAuth_probeFindsTheCredentialThisSdkPlaces() {
+    assertEquals(null == authCredential(), null == authAnyCredential(),
+        "the probe missed a credential this SDK places, so every case "
+        + "takes the public-API path");
+  }
+
+  @Test
+  public void prepareAuth_placedWhereThisApiPutsIt() {
+    AuthCred cred = authCredential();
+    if (cred == null) {
+      // A public API places nothing, and that is the whole assertion.
+      Object[] got = authPlaced(fhMap(
+          "apikey", "K",
+          "auth", authBlock("Bearer")), null);
+      assertFalse((Boolean) got[1], "expected no credential placed at all");
+      return;
+    }
+    assertTrue("headers".equals(cred.where()) || "query".equals(cred.where()),
+        "unexpected credential container " + cred.where());
+    if (!"".equals(cred.pair())) {
+      // A cookie credential is a `<scheme>=<key>` pair, and the scheme name
+      // leaves no room for the option's prefix.
+      assertTrue(COOKIE_PAIR.matcher(String.valueOf(cred.value())).matches(),
+          "expected a cookie pair, got " + cred.value());
+      return;
+    }
+    // A header credential is prefix-joined; a query credential is the raw
+    // key, because a query parameter has nowhere to put a scheme name.
+    assertEquals("query".equals(cred.where()) ? "K" : "Bearer K", cred.value());
   }
 
   @Test
   public void prepareAuth_rawApikeyEmptyPrefixAsIs() {
-    ProjectNameSDK client = plClient(fhMap(
+    Object[] got = authPlaced(fhMap(
         "apikey", "K",
-        "auth", fhMap("prefix", "")));
-    Utility utility = client.getUtility();
-    Context ctx = plCtx(client, utility, null);
-    ctx.spec = authSpec(null);
-    utility.prepareAuth.apply(ctx);
-    assertEquals("K", ctx.spec.headers.get("authorization"));
+        "auth", authBlock("")), null);
+    AuthCred cred = authCredential();
+    if (cred == null) {
+      assertFalse((Boolean) got[1], "expected no credential placed at all");
+      return;
+    }
+    assertEquals(cred.pair() + "K", got[0]);
   }
 
   @Test
-  public void prepareAuth_emptyApikeyDropsHeader() {
-    ProjectNameSDK client = plClient(fhMap(
+  public void prepareAuth_emptyApikeyDropsCredential() {
+    Object[] got = authPlaced(fhMap(
         "apikey", "",
-        "auth", fhMap("prefix", "Bearer")));
-    Utility utility = client.getUtility();
-    Context ctx = plCtx(client, utility, null);
-    ctx.spec = authSpec(fhMap("authorization", "stale"));
-    utility.prepareAuth.apply(ctx);
-    assertFalse(ctx.spec.headers.containsKey("authorization"),
-        "expected authorization dropped");
+        "auth", authBlock("Bearer")), "stale");
+    assertFalse((Boolean) got[1], "expected the credential dropped");
   }
 
   @Test
-  public void prepareAuth_missingApikeyDropsHeader() {
-    ProjectNameSDK client = plClient(fhMap(
-        "auth", fhMap("prefix", "Bearer")));
-    Map<String, Object> options = client.optionsMap();
-    Object apikey = options.get("apikey");
+  public void prepareAuth_missingApikeyDropsCredential() {
+    Map<String, Object> sdkopts = fhMap("auth", authBlock("Bearer"));
+    Object apikey = plClient(sdkopts).optionsMap().get("apikey");
     if (apikey instanceof String && !"".equals(apikey)) {
       // SDK options carry a configured apikey; case not reproducible here.
       return;
     }
-    Utility utility = client.getUtility();
-    Context ctx = plCtx(client, utility, null);
-    ctx.spec = authSpec(fhMap("authorization", "stale"));
-    utility.prepareAuth.apply(ctx);
-    assertFalse(ctx.spec.headers.containsKey("authorization"),
-        "expected authorization dropped");
+    Object[] got = authPlaced(sdkopts, "stale");
+    assertFalse((Boolean) got[1], "expected the credential dropped");
   }
 
   @Test
-  public void prepareAuth_publicApiNoAuthBlockDropsHeader() {
-    ProjectNameSDK client = plClient(fhMap("apikey", "K"));
-    Map<String, Object> options = client.optionsMap();
-    if (options.get("auth") != null) {
+  public void prepareAuth_publicApiNoAuthBlockDropsCredential() {
+    Map<String, Object> sdkopts = fhMap("apikey", "K");
+    if (plClient(sdkopts).optionsMap().get("auth") != null) {
       // Option validation supplies an auth shape for this SDK, so a truly
       // auth-less client cannot be constructed here.
       return;
     }
-    Utility utility = client.getUtility();
-    Context ctx = plCtx(client, utility, null);
-    ctx.spec = authSpec(fhMap("authorization", "stale"));
-    utility.prepareAuth.apply(ctx);
-    assertNull(ctx.spec.headers.get("authorization"), "expected authorization dropped");
+    Object[] got = authPlaced(sdkopts, "stale");
+    assertFalse((Boolean) got[1], "expected the credential dropped");
   }
 }

package/project/.sdk/tm/java/test/PrimaryUtilityTest.java

@@ -100,6 +100,44 @@ public class PrimaryUtilityTest {
     run.runset(basic, subject);
   }
 
+  // Rename the corpus's `headers` bag to the real container, and the
+  // `authorization` key inside it to the real credential name. Applied only
+  // to the prepareAuth section, so real header assertions elsewhere are
+  // untouched.
+  @SuppressWarnings("unchecked")
+  static Object retargetAuth(Object node, PipelineTest.AuthCred cred) {
+    if (node instanceof List) {
+      List<Object> out = new ArrayList<>();
+      for (Object child : (List<Object>) node) {
+        out.add(retargetAuth(child, cred));
+      }
+      return out;
+    }
+    if (!(node instanceof Map)) {
+      return node;
+    }
+
+    Map<String, Object> out = new LinkedHashMap<>();
+    for (Map.Entry<String, Object> entry : ((Map<String, Object>) node).entrySet()) {
+      if ("headers".equals(entry.getKey())) {
+        Map<String, Object> bag = new LinkedHashMap<>();
+        Map<String, Object> inner = Helpers.toMapAny(entry.getValue());
+        if (inner != null) {
+          for (Map.Entry<String, Object> bagentry : inner.entrySet()) {
+            String name = "authorization".equals(bagentry.getKey())
+                ? cred.name() : bagentry.getKey();
+            bag.put(name, retargetAuth(bagentry.getValue(), cred));
+          }
+        }
+        out.put(cred.where(), bag);
+      }
+      else {
+        out.put(entry.getKey(), retargetAuth(entry.getValue(), cred));
+      }
+    }
+    return out;
+  }
+
   // Helper: create basic test context.
   static Context makeTestCtx(ProjectNameSDK client, Utility utility,
       Map<String, Object> overrides) {
@@ -684,15 +722,38 @@ public class PrimaryUtilityTest {
     ProjectNameSDK authClient = ProjectNameSDK.testSDK(null, setupOpts);
     Utility authUtility = authClient.getUtility();
 
-    runsection("prepareAuth", (args) -> {
-      Context ctx = OmniResolver.omniCtx(args[0], authClient, authUtility);
+    // The corpus writes the credential as `headers.authorization`: a
+    // PLACEHOLDER each runner points at the container and name this API
+    // actually uses. PipelineTest.authCredential (same package) discovers
+    // both by running prepareAuth once.
+    PipelineTest.AuthCred cred = PipelineTest.authCredential();
+    assertNotNull(cred, "prepareAuth placed no credential in headers or query");
+
+    // An absent section is runsection's report to make.
+    Map<String, Object> section = Helpers.toMapAny(run().spec.get("prepareAuth"));
+    boolean swap = section != null
+        && (!"headers".equals(cred.where()) || !"authorization".equals(cred.name()));
+    Object original = swap ? section.get("basic") : null;
+    if (swap) {
+      section.put("basic", retargetAuth(original, cred));
+    }
 
-      authUtility.prepareAuth.apply(ctx);
+    try {
+      runsection("prepareAuth", (args) -> {
+        Context ctx = OmniResolver.omniCtx(args[0], authClient, authUtility);
 
-      OmniResolver.omniSyncCtx(args[0], ctx);
+        authUtility.prepareAuth.apply(ctx);
 
-      return null;
-    });
+        OmniResolver.omniSyncCtx(args[0], ctx);
+
+        return null;
+      });
+    }
+    finally {
+      if (swap) {
+        section.put("basic", original);
+      }
+    }
   }
 
   @Test