@voxgig/sdkgen 4.24.0 → 4.24.2

package/project/.sdk/tm/perl/t/pipeline.t

@@ -551,60 +551,157 @@ sub named_feature {
 
 # === prepare_auth ===
 
+# A cookie credential as prepare_auth writes it: `<scheme>=K` for the probe
+# key, with no scheme prefix and nothing else in the bag.
+sub _is_cookie_pair {
+  my ($value) = @_;
+  return (defined $value && !ref $value && $value =~ m{^[^=;]+=K$}) ? 1 : 0;
+}
+
 sub auth_ctx {
-  my ($options, $headers) = @_;
+  my ($options, $spec) = @_;
   my $ctx = ProjectNameContext->new({
     'client' => PipelineOptClient->new($options),
     'utility' => $utility,
     'opname' => 'load',
   }, undef);
-  $ctx->{spec} = defined $headers
-    ? ProjectNameSpec->new({ 'headers' => $headers, 'step' => 's' })
-    : undef;
+  $ctx->{spec} = $spec;
   return $ctx;
 }
 
+sub auth_bags {
+  return ProjectNameSpec->new({ 'headers' => {}, 'query' => {}, 'step' => 's' });
+}
+
+# A cookie credential rides the header bag, because a cookie IS a header.
+sub auth_bag {
+  my ($spec, $where) = @_;
+  return 'query' eq $where ? $spec->{query} : $spec->{headers};
+}
+
+# `basic: false` is explicit: an HTTP Basic API's generated config carries
+# `auth.basic: true`, and a client that merges it in takes a branch that needs
+# a secret as well. With none supplied that branch deliberately writes
+# nothing, which the probe would read as a public API.
+sub auth_block {
+  my ($prefix) = @_;
+  return { 'prefix' => $prefix, 'basic' => 0 };
+}
+
+# Run prepare_auth with both containers present and see which one the
+# generated utility writes to, and under what name. undef means this SDK
+# places no credential at all - a public API - which is a legitimate shape,
+# and the tests below assert exactly that instead. `pair` is the `<scheme>=`
+# lead-in of a COOKIE credential, which rides the header bag under the key
+# `cookie` instead of taking a header of its own.
+sub auth_probe {
+  my ($options) = @_;
+  my $ctx = auth_ctx($options, auth_bags());
+  $utility->{prepare_auth}->($ctx);
+  for my $where ('headers', 'query') {
+    my $bag = auth_bag($ctx->{spec}, $where);
+    for my $name (keys %{ $bag || {} }) {
+      my $value = $bag->{$name};
+      my $pair = '';
+      if ('headers' eq $where && 'cookie' eq $name && _is_cookie_pair($value)) {
+        $pair = substr($value, 0, -1);
+      }
+      return { 'where' => $where, 'name' => $name,
+        'value' => $value, 'pair' => $pair };
+    }
+  }
+  return undef;
+}
+
+sub auth_credential {
+  return auth_probe({ 'apikey' => 'K', 'auth' => auth_block('Bearer') });
+}
+
+# Every credential this SDK could possibly place: both credentials and Basic
+# switched on, so whichever branch the API has, something lands unless the API
+# is public.
+sub auth_any_credential {
+  return auth_probe({ 'apikey' => 'K', 'secret' => 'S',
+    'auth' => { 'prefix' => 'Bearer', 'basic' => 1 } });
+}
+
+# Returns the value left in the credential slot, and whether it is there.
+sub auth_placed {
+  my ($options, $seed) = @_;
+  my $cred = auth_credential();
+  my $spec = auth_bags();
+  if (defined $cred && defined $seed) {
+    auth_bag($spec, $cred->{where})->{ $cred->{name} } = $seed;
+  }
+  my $ctx = auth_ctx($options, $spec);
+  $utility->{prepare_auth}->($ctx);
+  return (undef, 0) if !defined $cred;
+  my $bag = auth_bag($ctx->{spec}, $cred->{where});
+  return ($bag->{ $cred->{name} }, exists $bag->{ $cred->{name} } ? 1 : 0);
+}
+
 {
-  my $ctx = auth_ctx({ 'auth' => { 'prefix' => '' }, 'apikey' => 'K' }, undef);
+  my $ctx = auth_ctx({ 'auth' => auth_block(''), 'apikey' => 'K' }, undef);
   my (undef, $err) = $utility->{prepare_auth}->($ctx);
   is($err->{code}, 'auth_no_spec', 'prepare_auth guards a missing spec');
 }
 
+# Without this the cases below cannot fail for an SDK whose credential the
+# probe misses: every one of them takes the public-API path instead.
 {
-  my $ctx = auth_ctx({ 'apikey' => 'K', 'auth' => { 'prefix' => 'Bearer' } }, {});
-  my (undef, $err) = $utility->{prepare_auth}->($ctx);
-  ok(!defined $err, 'prepare_auth prefix: no error');
-  is($ctx->{spec}{headers}{authorization}, 'Bearer K',
-    'prepare_auth an apikey with a prefix is space-joined');
+  is(defined auth_credential() ? 1 : 0, defined auth_any_credential() ? 1 : 0,
+    'prepare_auth probe finds the credential this SDK places');
 }
 
 {
-  my $ctx = auth_ctx({ 'apikey' => 'K', 'auth' => { 'prefix' => '' } }, {});
-  $utility->{prepare_auth}->($ctx);
-  is($ctx->{spec}{headers}{authorization}, 'K', 'prepare_auth a raw apikey goes in as-is');
+  my $cred = auth_credential();
+  if (!defined $cred) {
+    # A public API places nothing, and that is the whole assertion.
+    my (undef, $has) =
+      auth_placed({ 'apikey' => 'K', 'auth' => auth_block('Bearer') });
+    ok(!$has, 'prepare_auth places no credential for a public API');
+  }
+  elsif ('' ne $cred->{pair}) {
+    # A cookie credential is a `<scheme>=<key>` pair, and the scheme name
+    # leaves no room for the option's prefix.
+    ok(_is_cookie_pair($cred->{value}),
+      'prepare_auth places the apikey as a cookie pair');
+  }
+  else {
+    ok('headers' eq $cred->{where} || 'query' eq $cred->{where},
+      'prepare_auth places the credential in headers or query');
+    # A header credential is prefix-joined; a query credential is the raw
+    # key, because a query parameter has nowhere to put a scheme name.
+    is($cred->{value}, 'query' eq $cred->{where} ? 'K' : 'Bearer K',
+      'prepare_auth places the apikey where this API puts it');
+  }
 }
 
 {
-  my $ctx = auth_ctx({ 'apikey' => '', 'auth' => { 'prefix' => 'Bearer' } },
-    { 'authorization' => 'stale' });
-  $utility->{prepare_auth}->($ctx);
-  ok(!exists $ctx->{spec}{headers}{authorization},
-    'prepare_auth an empty apikey drops the header');
+  my ($value, $has) = auth_placed({ 'apikey' => 'K', 'auth' => auth_block('') });
+  my $cred = auth_credential();
+  if (defined $cred) {
+    is($value, $cred->{pair} . 'K', 'prepare_auth a raw apikey goes in as-is');
+  }
+  else {
+    ok(!$has, 'prepare_auth a raw apikey places nothing for a public API');
+  }
 }
 
 {
-  my $ctx = auth_ctx({ 'apikey' => 'K' }, { 'authorization' => 'stale' });
-  $utility->{prepare_auth}->($ctx);
-  ok(!exists $ctx->{spec}{headers}{authorization},
-    'prepare_auth a public api drops the header');
+  my (undef, $has) =
+    auth_placed({ 'apikey' => '', 'auth' => auth_block('Bearer') }, 'stale');
+  ok(!$has, 'prepare_auth an empty apikey drops the credential');
 }
 
 {
-  my $ctx = auth_ctx({ 'auth' => { 'prefix' => 'Bearer' } },
-    { 'authorization' => 'stale' });
-  $utility->{prepare_auth}->($ctx);
-  ok(!exists $ctx->{spec}{headers}{authorization},
-    'prepare_auth a missing apikey option drops the header');
+  my (undef, $has) = auth_placed({ 'apikey' => 'K' }, 'stale');
+  ok(!$has, 'prepare_auth a public api drops the credential');
+}
+
+{
+  my (undef, $has) = auth_placed({ 'auth' => auth_block('Bearer') }, 'stale');
+  ok(!$has, 'prepare_auth a missing apikey option drops the credential');
 }
 
 

package/project/.sdk/tm/perl/t/primary_utility.t

@@ -200,6 +200,64 @@ sub _def_setup {
 }
 
 
+# Where this SDK's prepare_auth actually puts the credential: the name is the
+# API's OWN scheme name, not always `authorization`, so it is discovered by
+# running prepare_auth once.
+sub _auth_credential {
+  my ($auth_client) = @_;
+  my $auth_utility = $auth_client->get_utility;
+  my $ctx = ProjectNameContext->new({
+    'client' => $auth_client,
+    'utility' => $auth_utility,
+    'opname' => 'load',
+  }, undef);
+  # The DEF setup this client is built from carries `auth.basic: false`, so
+  # the single-token branch runs and there is a credential to find.
+  $ctx->{spec} = ProjectNameSpec->new({
+    'headers' => {}, 'query' => {}, 'step' => 's' });
+  my (undef, $err) = $auth_utility->{prepare_auth}->($ctx);
+  return undef if defined $err;
+  for my $where ('headers', 'query') {
+    # A cookie credential rides the header bag, because a cookie IS a header.
+    my $bag = 'query' eq $where ? $ctx->{spec}{query} : $ctx->{spec}{headers};
+    for my $name (keys %{ $bag || {} }) {
+      return { 'where' => $where, 'name' => $name };
+    }
+  }
+  return undef;
+}
+
+
+# Rename the corpus's `headers` bag to the real container, and the
+# `authorization` key inside it to the real credential name. Applied only to
+# the prepareAuth section, so real header assertions elsewhere are untouched.
+sub _retarget_auth {
+  my ($node, $cred) = @_;
+
+  if (ref($node) eq 'ARRAY') {
+    return [ map { _retarget_auth($_, $cred) } @$node ];
+  }
+  return $node unless ref($node) eq 'HASH';
+
+  my $out = {};
+  for my $key (keys %$node) {
+    if ('headers' eq $key) {
+      my $bag = {};
+      my $inner = ref($node->{$key}) eq 'HASH' ? $node->{$key} : {};
+      for my $bagkey (keys %$inner) {
+        my $name = 'authorization' eq $bagkey ? $cred->{name} : $bagkey;
+        $bag->{$name} = _retarget_auth($inner->{$bagkey}, $cred);
+      }
+      $out->{ $cred->{where} } = $bag;
+    }
+    else {
+      $out->{$key} = _retarget_auth($node->{$key}, $cred);
+    }
+  }
+  return $out;
+}
+
+
 # === exists ===
 
 for my $name (qw(
@@ -606,12 +664,27 @@ runsection('param', sub {
 {
   my $auth_client = ProjectNameSDK->test(undef, _def_setup('prepareAuth'));
 
+  # The corpus writes the credential as `headers.authorization`: a
+  # PLACEHOLDER each runner points at the container and name this API
+  # actually uses.
+  my $cred = _auth_credential($auth_client);
+  ok(defined $cred, 'prepare_auth placed a credential in headers or query');
+
+  # An absent section is runsection's report to make.
+  my $section = ref($spec) eq 'HASH' ? $spec->{prepareAuth} : undef;
+  my $swap = ref($section) eq 'HASH' && defined $cred
+    && !('headers' eq $cred->{where} && 'authorization' eq $cred->{name});
+  my $original = $swap ? $section->{basic} : undef;
+  $section->{basic} = _retarget_auth($original, $cred) if $swap;
+
   runsection('prepareAuth', sub {
     my ($view) = @_;
     my $ctx = ProjectNameOmni::livectx($view);
     $ctx->{client} = $auth_client;
     return _unwrap($utility->{prepare_auth}->($ctx));
   });
+
+  $section->{basic} = $original if $swap;
 }
 
 

package/project/.sdk/tm/php/test/PipelineTest.php

@@ -611,59 +611,176 @@ class PipelineTest extends TestCase
 
     // --- prepare_auth ------------------------------------------------------------
 
-    private static function auth_ctx(array $options, ?array $headers): ProjectNameContext
+    /**
+     * A cookie credential as prepare_auth writes it: `<scheme>=K` for the
+     * probe key, with no scheme prefix and nothing else in the bag.
+     */
+    private const COOKIE_PAIR = '/^[^=;]+=K$/';
+
+    private static function auth_ctx(array $options, ?ProjectNameSpec $spec): ProjectNameContext
     {
         $client = new PlClient($options);
         return self::ctx([
             'client' => $client,
-            'spec' => $headers === null ? null : new ProjectNameSpec(['headers' => $headers]),
+            'spec' => $spec,
+        ]);
+    }
+
+    private static function auth_bags(): ProjectNameSpec
+    {
+        return new ProjectNameSpec(['headers' => [], 'query' => []]);
+    }
+
+    /**
+     * `basic: false` is explicit: an HTTP Basic API's generated config carries
+     * `auth.basic: true`, and a client that merges it in takes a branch that
+     * needs a secret as well. With none supplied that branch deliberately
+     * writes nothing, which the probe would read as a public API.
+     */
+    private static function auth_block(string $prefix): array
+    {
+        return ['prefix' => $prefix, 'basic' => false];
+    }
+
+    /**
+     * Run prepare_auth with both containers present and see which one the
+     * generated utility writes to, and under what name. Null means this SDK
+     * places no credential at all - a public API - which is a legitimate
+     * shape, and the tests below assert exactly that instead. `pair` is the
+     * `<scheme>=` lead-in of a COOKIE credential, which rides the header bag
+     * under the key `cookie` instead of taking a header of its own.
+     *
+     * @return array{where:string,name:string,value:mixed,pair:string}|null
+     */
+    private static function auth_probe(array $options): ?array
+    {
+        $ctx = self::auth_ctx($options, self::auth_bags());
+        ProjectNamePrepareAuth::call($ctx);
+        foreach (['headers', 'query'] as $where) {
+            // A cookie credential rides the header bag, because a cookie IS
+            // a header.
+            $bag = 'query' === $where ? $ctx->spec->query : $ctx->spec->headers;
+            foreach ($bag as $name => $value) {
+                $pair = '';
+                if ('headers' === $where && 'cookie' === $name && is_string($value)
+                    && 1 === preg_match(self::COOKIE_PAIR, $value)) {
+                    $pair = substr($value, 0, -1);
+                }
+                return ['where' => $where, 'name' => $name, 'value' => $value, 'pair' => $pair];
+            }
+        }
+        return null;
+    }
+
+    /** @return array{where:string,name:string,value:mixed,pair:string}|null */
+    private static function auth_credential(): ?array
+    {
+        return self::auth_probe(
+            ['apikey' => 'K', 'auth' => self::auth_block('Bearer')]);
+    }
+
+    /**
+     * Every credential this SDK could possibly place: both credentials and
+     * Basic switched on, so whichever branch the API has, something lands
+     * unless the API is public.
+     *
+     * @return array{where:string,name:string,value:mixed,pair:string}|null
+     */
+    private static function auth_any_credential(): ?array
+    {
+        return self::auth_probe([
+            'apikey' => 'K', 'secret' => 'S',
+            'auth' => ['prefix' => 'Bearer', 'basic' => true],
         ]);
     }
 
+    /** @return array{0:mixed,1:bool} the value left in the credential slot, and whether it is there */
+    private static function auth_placed(array $options, $seed = null): array
+    {
+        $cred = self::auth_credential();
+        $spec = self::auth_bags();
+        if (null !== $cred && null !== $seed) {
+            if ('query' === $cred['where']) {
+                $spec->query[$cred['name']] = $seed;
+            } else {
+                $spec->headers[$cred['name']] = $seed;
+            }
+        }
+        $ctx = self::auth_ctx($options, $spec);
+        ProjectNamePrepareAuth::call($ctx);
+        if (null === $cred) {
+            return [null, false];
+        }
+        $bag = 'query' === $cred['where'] ? $ctx->spec->query : $ctx->spec->headers;
+        return [$bag[$cred['name']] ?? null, array_key_exists($cred['name'], $bag)];
+    }
+
     public function test_prepare_auth_guards_a_missing_spec(): void
     {
-        $ctx = self::auth_ctx(['auth' => ['prefix' => ''], 'apikey' => 'K'], null);
+        $ctx = self::auth_ctx(['auth' => self::auth_block(''), 'apikey' => 'K'], null);
         [, $err] = ProjectNamePrepareAuth::call($ctx);
         $this->assertSame('auth_no_spec', self::code($err));
     }
 
-    public function test_prepare_auth_an_apikey_with_a_prefix_is_space_joined(): void
+    /**
+     * Without this the cases below cannot fail for an SDK whose credential the
+     * probe misses: every one of them takes the public-API path instead.
+     */
+    public function test_prepare_auth_probe_finds_the_credential_this_sdk_places(): void
     {
-        $ctx = self::auth_ctx(['apikey' => 'K', 'auth' => ['prefix' => 'Bearer']], []);
-        [, $err] = ProjectNamePrepareAuth::call($ctx);
-        $this->assertNull($err);
-        $this->assertSame('Bearer K', $ctx->spec->headers['authorization']);
+        $this->assertSame(
+            null === self::auth_credential(), null === self::auth_any_credential());
+    }
+
+    public function test_prepare_auth_places_the_apikey_where_this_api_puts_it(): void
+    {
+        $cred = self::auth_credential();
+        if (null === $cred) {
+            // A public API places nothing, and that is the whole assertion.
+            [, $has] = self::auth_placed(['apikey' => 'K', 'auth' => self::auth_block('Bearer')]);
+            $this->assertFalse($has);
+            return;
+        }
+        $this->assertContains($cred['where'], ['headers', 'query']);
+        if ('' !== $cred['pair']) {
+            // A cookie credential is a `<scheme>=<key>` pair, and the scheme
+            // name leaves no room for the option's prefix.
+            $this->assertMatchesRegularExpression(self::COOKIE_PAIR, $cred['value']);
+            return;
+        }
+        // A header credential is prefix-joined; a query credential is the raw
+        // key, because a query parameter has nowhere to put a scheme name.
+        $this->assertSame('query' === $cred['where'] ? 'K' : 'Bearer K', $cred['value']);
     }
 
     public function test_prepare_auth_a_raw_apikey_goes_in_as_is(): void
     {
-        $ctx = self::auth_ctx(['apikey' => 'K', 'auth' => ['prefix' => '']], []);
-        ProjectNamePrepareAuth::call($ctx);
-        $this->assertSame('K', $ctx->spec->headers['authorization']);
+        [$value, $has] = self::auth_placed(['apikey' => 'K', 'auth' => self::auth_block('')]);
+        $cred = self::auth_credential();
+        if (null === $cred) {
+            $this->assertFalse($has);
+            return;
+        }
+        $this->assertSame($cred['pair'] . 'K', $value);
     }
 
-    public function test_prepare_auth_an_empty_apikey_drops_the_header(): void
+    public function test_prepare_auth_an_empty_apikey_drops_the_credential(): void
     {
-        $ctx = self::auth_ctx(
-            ['apikey' => '', 'auth' => ['prefix' => 'Bearer']],
-            ['authorization' => 'stale']
-        );
-        ProjectNamePrepareAuth::call($ctx);
-        $this->assertArrayNotHasKey('authorization', $ctx->spec->headers);
+        [, $has] = self::auth_placed(
+            ['apikey' => '', 'auth' => self::auth_block('Bearer')], 'stale');
+        $this->assertFalse($has);
     }
 
-    public function test_prepare_auth_a_public_api_drops_the_header(): void
+    public function test_prepare_auth_a_public_api_drops_the_credential(): void
     {
-        $ctx = self::auth_ctx(['apikey' => 'K'], ['authorization' => 'stale']);
-        ProjectNamePrepareAuth::call($ctx);
-        $this->assertArrayNotHasKey('authorization', $ctx->spec->headers);
+        [, $has] = self::auth_placed(['apikey' => 'K'], 'stale');
+        $this->assertFalse($has);
     }
 
-    public function test_prepare_auth_a_missing_apikey_option_drops_the_header(): void
+    public function test_prepare_auth_a_missing_apikey_option_drops_the_credential(): void
     {
-        $ctx = self::auth_ctx(['auth' => ['prefix' => 'Bearer']], ['authorization' => 'stale']);
-        ProjectNamePrepareAuth::call($ctx);
-        $this->assertArrayNotHasKey('authorization', $ctx->spec->headers);
+        [, $has] = self::auth_placed(['auth' => self::auth_block('Bearer')], 'stale');
+        $this->assertFalse($has);
     }
 
 

package/project/.sdk/tm/php/test/PrimaryUtilityTest.php

@@ -70,7 +70,8 @@ class PrimaryUtilityTest extends TestCase
      * `set` used to pass silently, which defeats the point of a shared
      * oracle. EVERY corpus-backed test goes through here (mirrors ts/py).
      */
-    private function runsection(string $name, callable $subject): void
+    private function runsection(
+        string $name, callable $subject, ?callable $adapt = null): void
     {
         $R = self::runpack();
         $spec = $R['spec'];
@@ -89,6 +90,10 @@ class PrimaryUtilityTest extends TestCase
                 "add cases, or mark the fixture PENDING in .sdk/test/primary/");
         }
 
+        if (null !== $adapt) {
+            $basic = $adapt($basic);
+        }
+
         $R['runset']($basic, $subject);
         $this->assertTrue(true, "corpus section '{$name}' completed");
     }
@@ -111,6 +116,66 @@ class PrimaryUtilityTest extends TestCase
         return ($utility->make_context)($ctxmap, $client->get_root_ctx());
     }
 
+    /**
+     * Where this SDK's prepare_auth actually puts the credential: the name is
+     * the API's OWN scheme name, not always `authorization`, so it is
+     * discovered by running prepare_auth once.
+     *
+     * @return array{where:string,name:string}|null
+     */
+    private static function auth_credential(
+        ProjectNameSDK $client,
+        ProjectNameUtility $utility
+    ): ?array {
+        $ctx = self::make_test_ctx($client, $utility);
+        $ctx->spec = new ProjectNameSpec(['headers' => [], 'query' => []]);
+        [, $err] = ($utility->prepare_auth)($ctx);
+        // The DEF setup this client is built from carries `auth.basic: false`,
+        // so the single-token branch runs and there is a credential to find.
+        if ($err !== null) {
+            return null;
+        }
+        foreach (['headers', 'query'] as $where) {
+            // A cookie credential rides the header bag, because a cookie IS
+            // a header.
+            $bag = 'query' === $where ? $ctx->spec->query : $ctx->spec->headers;
+            foreach ($bag as $name => $value) {
+                return ['where' => $where, 'name' => $name];
+            }
+        }
+        return null;
+    }
+
+    /**
+     * Rename the corpus's `headers` bag to the real container, and the
+     * `authorization` key inside it to the real credential name. Applied only
+     * to the prepareAuth section, so real header assertions elsewhere are
+     * untouched.
+     *
+     * @param array{where:string,name:string} $cred
+     */
+    private static function retarget_auth($node, array $cred)
+    {
+        if (!is_array($node)) {
+            return $node;
+        }
+
+        $out = [];
+        foreach ($node as $key => $value) {
+            if ('headers' === $key) {
+                $bag = [];
+                foreach (is_array($value) ? $value : [] as $bagkey => $bagvalue) {
+                    $name = 'authorization' === $bagkey ? $cred['name'] : $bagkey;
+                    $bag[$name] = self::retarget_auth($bagvalue, $cred);
+                }
+                $out[$cred['where']] = $bag;
+            } else {
+                $out[$key] = self::retarget_auth($value, $cred);
+            }
+        }
+        return $out;
+    }
+
     private static function make_test_full_ctx(
         ProjectNameSDK $client,
         ProjectNameUtility $utility
@@ -749,6 +814,19 @@ class PrimaryUtilityTest extends TestCase
         $auth_utility = $auth_client->get_utility();
         $utility = self::client()->get_utility();
 
+        // The corpus writes the credential as `headers.authorization`: a
+        // PLACEHOLDER each runner points at the container and name this API
+        // actually uses.
+        $cred = self::auth_credential($auth_client, $auth_utility);
+        $this->assertIsArray($cred,
+            'prepare_auth placed no credential in headers or query');
+
+        $adapt = ('headers' === $cred['where'] && 'authorization' === $cred['name'])
+            ? null
+            : function (array $basic) use ($cred) {
+                return self::retarget_auth($basic, $cred);
+            };
+
         $this->runsection('prepareAuth', function (array $ctxmap) use ($auth_client, $auth_utility, $utility) {
             $ctx = ProjectNameOmni::ctx_from_map($ctxmap, $auth_client, $auth_utility);
 
@@ -759,7 +837,7 @@ class PrimaryUtilityTest extends TestCase
                 throw $err;
             }
             return null;
-        });
+        }, $adapt);
     }