@voxgig/sdkgen 4.24.0 → 4.24.2

package/project/.sdk/tm/js/test/pipeline.test.js

@@ -323,45 +323,111 @@ describe('pipeline:feature order', () => {
 })
 
 
+// A cookie credential as prepareAuth writes it: `<scheme>=K` for the probe
+// key, with no scheme prefix and nothing else in the bag.
+const COOKIE_PAIR = /^[^=;]+=K$/
+
+
 describe('pipeline:prepareAuth', () => {
 
   // Fake client so the exact options.auth / apikey shape is controlled.
-  function authCtx(options, headers) {
-    return base({ client: { options: () => options }, spec: headers == null ? null : { headers } })
+  function authCtx(options, spec) {
+    return base({ client: { options: () => options }, spec })
+  }
+
+  function bags() {
+    return { headers: {}, query: {} }
+  }
+
+  // `basic: false` is explicit: an HTTP Basic API's generated config carries
+  // `auth.basic: true`, and a client that merges it in takes a branch that
+  // needs a secret as well. With none supplied that branch deliberately
+  // writes nothing, which the probe below would read as a public API.
+  function auth(prefix) {
+    return { prefix, basic: false }
+  }
+
+  // Run prepareAuth with both containers present and see which one the
+  // generated utility writes to, and under what name. Null means this SDK
+  // places no credential at all — a public API — which is a legitimate
+  // shape, and the tests below assert exactly that instead.
+  //
+  // `pair` is the `<scheme>=` lead-in of a COOKIE credential, which rides the
+  // header bag under the key `cookie` instead of taking a header of its own.
+  function probe(options) {
+    const ctx = authCtx(options, bags())
+    stdutil.prepareAuth(ctx)
+    for (const where of ['headers', 'query']) {
+      const name = Object.keys(ctx.spec[where])[0]
+      if (null == name) continue
+      const value = ctx.spec[where][name]
+      const pair = 'headers' === where && 'cookie' === name
+        && COOKIE_PAIR.test(String(value))
+        ? String(value).slice(0, -1)
+        : ''
+      return { where, name, value, pair }
+    }
+    return null
+  }
+
+  const CRED = probe({ apikey: 'K', auth: auth('Bearer') })
+
+  // Every credential this SDK could possibly place: both credentials and
+  // Basic switched on, so whichever branch the API has, something lands
+  // unless the API is public.
+  const ANY = probe({ apikey: 'K', secret: 'S', auth: { prefix: 'Bearer', basic: true } })
+
+  function placed(options, seed) {
+    const spec = bags()
+    if (null != CRED && null != seed) spec[CRED.where][CRED.name] = seed
+    const ctx = authCtx(options, spec)
+    stdutil.prepareAuth(ctx)
+    return null == CRED ? undefined : ctx.spec[CRED.where][CRED.name]
   }
 
   test('guards a missing spec', () => {
-    strictEqual(stdutil.prepareAuth(authCtx({ auth: { prefix: '' }, apikey: 'K' }, null)).code, 'auth_no_spec')
+    strictEqual(stdutil.prepareAuth(authCtx({ auth: auth(''), apikey: 'K' }, null)).code, 'auth_no_spec')
   })
 
-  test('an apikey with a prefix is space-joined', () => {
-    const ctx = authCtx({ apikey: 'K', auth: { prefix: 'Bearer' } }, {})
-    stdutil.prepareAuth(ctx)
-    strictEqual(ctx.spec.headers.authorization, 'Bearer K')
+  // Without this the cases below cannot fail for an SDK whose credential the
+  // probe misses: every one of them takes the public-API path instead.
+  test('the probe finds the credential this SDK places', () => {
+    strictEqual(null != CRED, null != ANY)
+  })
+
+  test('the apikey is placed where this API puts it', () => {
+    if (null == CRED) {
+      // A public API places nothing, and that is the whole assertion.
+      strictEqual(placed({ apikey: 'K', auth: auth('Bearer') }), undefined)
+      return
+    }
+    ok('headers' === CRED.where || 'query' === CRED.where)
+    if ('' !== CRED.pair) {
+      // A cookie credential is a `<scheme>=<key>` pair, and the scheme name
+      // leaves no room for the option's prefix.
+      ok(COOKIE_PAIR.test(String(CRED.value)), String(CRED.value))
+      return
+    }
+    // A header credential is prefix-joined; a query credential is the raw
+    // key, because a query parameter has nowhere to put a scheme name.
+    strictEqual(CRED.value, 'headers' === CRED.where ? 'Bearer K' : 'K')
   })
 
   test('a raw apikey (empty prefix) goes in as-is', () => {
-    const ctx = authCtx({ apikey: 'K', auth: { prefix: '' } }, {})
-    stdutil.prepareAuth(ctx)
-    strictEqual(ctx.spec.headers.authorization, 'K')
+    const raw = null == CRED ? undefined : CRED.pair + 'K'
+    strictEqual(placed({ apikey: 'K', auth: auth('') }), raw)
   })
 
-  test('an empty apikey drops the header', () => {
-    const ctx = authCtx({ apikey: '', auth: { prefix: 'Bearer' } }, { authorization: 'stale' })
-    stdutil.prepareAuth(ctx)
-    strictEqual(ctx.spec.headers.authorization, undefined)
+  test('an empty apikey drops the credential', () => {
+    strictEqual(placed({ apikey: '', auth: auth('Bearer') }, 'stale'), undefined)
   })
 
-  test('a public API (no auth block) drops the header', () => {
-    const ctx = authCtx({ apikey: 'K' }, { authorization: 'stale' })
-    stdutil.prepareAuth(ctx)
-    strictEqual(ctx.spec.headers.authorization, undefined)
+  test('a public API (no auth block) drops the credential', () => {
+    strictEqual(placed({ apikey: 'K' }, 'stale'), undefined)
   })
 
-  test('a missing apikey option drops the header', () => {
-    const ctx = authCtx({ auth: { prefix: 'Bearer' } }, { authorization: 'stale' })
-    stdutil.prepareAuth(ctx)
-    strictEqual(ctx.spec.headers.authorization, undefined)
+  test('a missing apikey option drops the credential', () => {
+    strictEqual(placed({ auth: auth('Bearer') }, 'stale'), undefined)
   })
 })
 

package/project/.sdk/tm/js/test/utility/PrimaryUtility.test.js

@@ -79,10 +79,56 @@ describe('PrimaryUtility', async () => {
   })
 
 
+  function credential() {
+    const ctx = {
+      utility,
+      // `basic: false`: a Basic API's config defaults it true, and the
+      // branch it selects needs a secret, so the probe would find nothing.
+      client: { options: () => ({ apikey: 'PROBE', auth: { prefix: '', basic: false } }) },
+      spec: { headers: {}, query: {} },
+      error: (code, msg) => Object.assign(new Error(msg), { code }),
+    }
+    try { utility.prepareAuth(ctx) } catch (e) { return null }
+    for (const where of ['headers', 'query']) {
+      const name = Object.keys(ctx.spec[where] || {})[0]
+      if (null != name) return { where, name }
+    }
+    return null
+  }
+
+  // Rename the corpus's `headers` bag to the real container, and the
+  // `authorization` key inside it to the real credential name. Applied only
+  // to the prepareAuth section, so real header assertions elsewhere are
+  // untouched.
+  function retarget(node, cred) {
+    if (null == node || 'object' !== typeof node) return node
+    if (Array.isArray(node)) return node.map((n) => retarget(n, cred))
+    const out = {}
+    for (const key of Object.keys(node)) {
+      if ('headers' === key) {
+        const bag = {}
+        for (const bk of Object.keys(node[key] || {})) {
+          bag['authorization' === bk ? cred.name : bk] = retarget(node[key][bk], cred)
+        }
+        out[cred.where] = bag
+      }
+      else out[key] = retarget(node[key], cred)
+    }
+    return out
+  }
+
   test('auth-basic', async () => {
     const sdkopts = spec.prepareAuth?.DEF?.setup?.a || {}
     const authClient = SDK.test({}, sdkopts)
-    await runset(spec.prepareAuth.basic, (ctx) => {
+
+    const cred = credential()
+    ok(null != cred, 'prepareAuth placed no credential in headers or query')
+
+    const cases = 'headers' === cred.where && 'authorization' === cred.name
+      ? spec.prepareAuth.basic
+      : retarget(spec.prepareAuth.basic, cred)
+
+    await runset(cases, (ctx) => {
       ctx.client = authClient
       fixctx(ctx)
       return utility.prepareAuth(ctx)

package/project/.sdk/tm/lua/test/omni.lua

@@ -403,7 +403,14 @@ end
 --- omni's value model), which keeps smoke tests free of fixture files.
 function M.makeRunner(testfile, client)
   local specref = testfile
-  if "string" == type(testfile) and "/" ~= testfile:sub(1, 1) then
+  -- A drive letter and a UNC prefix are absolute too, and neither starts
+  -- with "/": treating one as relative joins it onto _test_dir and reads
+  -- nothing. Lua has no path library, so the shapes are spelled out.
+  local function isabs(p)
+    return nil ~= p:match("^/") or nil ~= p:match("^%a:[/\\]")
+      or nil ~= p:match("^\\\\")
+  end
+  if "string" == type(testfile) and not isabs(testfile) then
     specref = _test_dir .. testfile
   end
 

package/project/.sdk/tm/lua/test/pipeline_test.lua

@@ -536,58 +536,137 @@ describe("pipeline", function()
 
   describe("prepareAuth", function()
 
+    -- A cookie credential as prepare_auth writes it: `<scheme>=K` for the
+    -- probe key, with no scheme prefix and nothing else in the bag.
+    local function is_cookie_pair(value)
+      return "string" == type(value) and nil ~= value:match("^[^=;]+=K$")
+    end
+
     -- Fake client so the exact options.auth / apikey shape is controlled.
-    local function auth_ctx(options, headers)
+    local function auth_ctx(options, spec)
       local ctx = base_ctx({})
       ctx.client = {
         options_map = function(_self)
           return options
         end,
       }
-      if headers == nil then
-        ctx.spec = nil
-      else
-        ctx.spec = Spec.new({ headers = headers })
-      end
+      ctx.spec = spec
       return ctx
     end
 
+    local function auth_bags()
+      return Spec.new({ headers = {}, query = {} })
+    end
+
+    -- A cookie credential rides the header bag, because a cookie IS a header.
+    local function auth_bag(spec, where)
+      if "query" == where then return spec.query end
+      return spec.headers
+    end
+
+    -- `basic = false` is explicit: an HTTP Basic API's generated config
+    -- carries `auth.basic: true`, and a client that merges it in takes a
+    -- branch needing a secret as well. With none supplied that branch writes
+    -- nothing, which the probe would read as a public API.
+    local function auth_block(prefix)
+      return { prefix = prefix, basic = false }
+    end
+
+    -- Run prepare_auth with both containers present and see which one the
+    -- generated utility writes to, and under what name. nil means this SDK
+    -- places no credential at all - a public API - which is a legitimate
+    -- shape, and the tests below assert exactly that instead. `pair` is the
+    -- `<scheme>=` lead-in of a COOKIE credential, which rides the header bag
+    -- under the key "cookie" instead of taking a header of its own.
+    local function auth_probe(options)
+      local ctx = auth_ctx(options, auth_bags())
+      ctx.utility.prepare_auth(ctx)
+      for _, where in ipairs({ "headers", "query" }) do
+        for name, value in pairs(auth_bag(ctx.spec, where)) do
+          local pair = ""
+          if "headers" == where and "cookie" == name and is_cookie_pair(value) then
+            pair = value:sub(1, -2)
+          end
+          return { where = where, name = name, value = value, pair = pair }
+        end
+      end
+      return nil
+    end
+
+    local function auth_credential()
+      return auth_probe({ apikey = "K", auth = auth_block("Bearer") })
+    end
+
+    -- Every credential this SDK could possibly place: both credentials and
+    -- Basic switched on, so whichever branch the API has, something lands
+    -- unless the API is public.
+    local function auth_any_credential()
+      return auth_probe({ apikey = "K", secret = "S",
+        auth = { prefix = "Bearer", basic = true } })
+    end
+
+    local function auth_placed(options, seed)
+      local cred = auth_credential()
+      local spec = auth_bags()
+      if nil ~= cred and nil ~= seed then
+        auth_bag(spec, cred.where)[cred.name] = seed
+      end
+      local ctx = auth_ctx(options, spec)
+      ctx.utility.prepare_auth(ctx)
+      if nil == cred then return nil end
+      return auth_bag(ctx.spec, cred.where)[cred.name]
+    end
+
     it("guards a missing spec", function()
-      local ctx = auth_ctx({ auth = { prefix = "" }, apikey = "K" }, nil)
+      local ctx = auth_ctx({ auth = auth_block(""), apikey = "K" }, nil)
       local _, err = ctx.utility.prepare_auth(ctx)
       assert.are.equal("auth_no_spec", err.code)
     end)
 
-    it("an apikey with a prefix is space-joined", function()
-      local ctx = auth_ctx({ apikey = "K", auth = { prefix = "Bearer" } }, {})
-      ctx.utility.prepare_auth(ctx)
-      assert.are.equal("Bearer K", ctx.spec.headers["authorization"])
+    -- Without this the cases below cannot fail for an SDK whose credential the
+    -- probe misses: every one of them takes the public-API path instead.
+    it("the probe finds the credential this SDK places", function()
+      assert.are.equal(nil == auth_credential(), nil == auth_any_credential())
+    end)
+
+    it("the apikey is placed where this API puts it", function()
+      local cred = auth_credential()
+      if nil == cred then
+        -- A public API places nothing, and that is the whole assertion.
+        assert.is_nil(auth_placed({ apikey = "K", auth = auth_block("Bearer") }))
+        return
+      end
+      assert.is_true("headers" == cred.where or "query" == cred.where)
+      if "" ~= cred.pair then
+        -- A cookie credential is a `<scheme>=<key>` pair, and the scheme name
+        -- leaves no room for the option's prefix.
+        assert.is_true(is_cookie_pair(cred.value), tostring(cred.value))
+        return
+      end
+      -- A header credential is prefix-joined; a query credential is the raw
+      -- key, because a query parameter has nowhere to put a scheme name.
+      local want = "Bearer K"
+      if "query" == cred.where then want = "K" end
+      assert.are.equal(want, cred.value)
     end)
 
     it("a raw apikey (empty prefix) goes in as-is", function()
-      local ctx = auth_ctx({ apikey = "K", auth = { prefix = "" } }, {})
-      ctx.utility.prepare_auth(ctx)
-      assert.are.equal("K", ctx.spec.headers["authorization"])
+      local cred = auth_credential()
+      local want = nil
+      if nil ~= cred then want = cred.pair .. "K" end
+      assert.are.equal(want, auth_placed({ apikey = "K", auth = auth_block("") }))
     end)
 
-    it("an empty apikey drops the header", function()
-      local ctx = auth_ctx({ apikey = "", auth = { prefix = "Bearer" } },
-        { authorization = "stale" })
-      ctx.utility.prepare_auth(ctx)
-      assert.is_nil(ctx.spec.headers["authorization"])
+    it("an empty apikey drops the credential", function()
+      assert.is_nil(auth_placed({ apikey = "", auth = auth_block("Bearer") }, "stale"))
     end)
 
-    it("a public API (no auth block) drops the header", function()
-      local ctx = auth_ctx({ apikey = "K" }, { authorization = "stale" })
-      ctx.utility.prepare_auth(ctx)
-      assert.is_nil(ctx.spec.headers["authorization"])
+    it("a public API (no auth block) drops the credential", function()
+      assert.is_nil(auth_placed({ apikey = "K" }, "stale"))
     end)
 
-    it("a missing apikey option drops the header", function()
-      local ctx = auth_ctx({ auth = { prefix = "Bearer" } },
-        { authorization = "stale" })
-      ctx.utility.prepare_auth(ctx)
-      assert.is_nil(ctx.spec.headers["authorization"])
+    it("a missing apikey option drops the credential", function()
+      assert.is_nil(auth_placed({ auth = auth_block("Bearer") }, "stale"))
     end)
   end)
 

package/project/.sdk/tm/lua/test/primary_utility_test.lua

@@ -70,6 +70,64 @@ local function get_spec(base, ...)
 end
 
 
+-- Where this SDK's prepare_auth actually puts the credential: the name is
+-- the API's OWN scheme name, not always `authorization`, so it is discovered
+-- by running prepare_auth once.
+local function auth_credential(auth_client, auth_utility)
+  local ctx = auth_utility.make_context({
+    opname = "load",
+    client = auth_client,
+    utility = auth_utility,
+  }, auth_client:get_root_ctx())
+  ctx.spec = Spec.new({ headers = {}, query = {} })
+  local _, err = auth_utility.prepare_auth(ctx)
+  if err ~= nil then
+    return nil
+  end
+  for _, where in ipairs({ "headers", "query" }) do
+    -- A cookie credential rides the header bag, because a cookie IS a header.
+    local bag = ctx.spec.headers
+    if "query" == where then bag = ctx.spec.query end
+    for name, _value in pairs(bag) do
+      return { where = where, name = name }
+    end
+  end
+  return nil
+end
+
+
+-- Rename the corpus's `headers` bag to the real container, and the
+-- `authorization` key inside it to the real credential name. Applied only to
+-- the prepareAuth section, so real header assertions elsewhere are untouched.
+local function retarget_auth(node, cred)
+  if type(node) ~= "table" then
+    return node
+  end
+
+  -- The metatable carries the corpus's `__jsontype` marker, which the struct
+  -- library's islist/ismap read to tell a one-element list from a map. A
+  -- plain-table copy leaves the rebuilt `set` unrecognisable.
+  local out = setmetatable({}, getmetatable(node))
+  for key, value in pairs(node) do
+    if "headers" == key then
+      local bag = {}
+      if type(value) == "table" then
+        setmetatable(bag, getmetatable(value))
+        for bagkey, bagvalue in pairs(value) do
+          local name = bagkey
+          if "authorization" == bagkey then name = cred.name end
+          bag[name] = retarget_auth(bagvalue, cred)
+        end
+      end
+      out[cred.where] = bag
+    else
+      out[key] = retarget_auth(value, cred)
+    end
+  end
+  return out
+end
+
+
 -- Sections deliberately left empty in the shared corpus
 -- (.sdk/test/primary/<name>.aon carries a PENDING header). Everything else
 -- MUST contribute cases.
@@ -749,7 +807,23 @@ describe("PrimaryUtility", function()
     local auth_client = sdk.test(nil, setup_opts)
     local auth_utility = auth_client:get_utility()
 
-    runsection("prepareAuth", function(cin)
+    -- The corpus writes the credential as `headers.authorization`: a
+    -- PLACEHOLDER each runner points at the container and name this API
+    -- actually uses.
+    local cred = auth_credential(auth_client, auth_utility)
+    assert(cred ~= nil, "prepare_auth placed no credential in headers or query")
+
+    -- An absent section is runsection's report to make.
+    local section = get_spec(spec, "prepareAuth")
+    local original = nil
+    if section ~= nil
+      and not ("headers" == cred.where and "authorization" == cred.name)
+    then
+      original = section.basic
+      section.basic = retarget_auth(original, cred)
+    end
+
+    local subject = function(cin)
       if type(cin) ~= "table" then
         cin = {}
       end
@@ -758,15 +832,21 @@ describe("PrimaryUtility", function()
 
       unwrap(utility.prepare_auth(ctx))
 
-      -- Write live-context spec headers back for match checking
+      -- Write the live-context spec bags back for match checking. QUERY as
+      -- well as headers: this API may place its credential there.
       if ctx.spec ~= nil then
         cin["spec"] = {
           headers = ctx.spec.headers,
+          query = ctx.spec.query,
         }
       end
 
       return nil
-    end)
+    end
+
+    local ok, failure = pcall(runsection, "prepareAuth", subject)
+    if original ~= nil then section.basic = original end
+    if not ok then error(failure) end
   end)
 
 

package/project/.sdk/tm/perl/t/omni.pm

@@ -587,7 +587,13 @@ sub make_runner {
   my ($testfile, $client) = @_;
 
   my $specref = $testfile;
-  if (defined $testfile && !ref $testfile && $testfile !~ m{^/}) {
+  # A leading slash alone is not the whole of absolute: a Windows path
+  # starts `C:/` or `\\host\share`, and joining one onto $DIR reads
+  # nothing. Spelled out rather than left to File::Spec, which an MSYS perl
+  # resolves to the Unix flavour and which answers no for a drive letter.
+  if (defined $testfile && !ref $testfile
+    && $testfile !~ m{^/} && $testfile !~ m{^[A-Za-z]:[\\/]}
+    && $testfile !~ m{^\\\\}) {
     $specref = Cwd::abs_path("$DIR/$testfile") || "$DIR/$testfile";
   }