@voxgig/sdkgen 4.24.0 → 4.24.2

package/project/.sdk/tm/py/test/test_pipeline.py

@@ -13,6 +13,8 @@
 #   result_body utility (it has no parse guard), so that ts case is
 #   omitted.
 
+import re
+
 import pytest
 
 from projectname_sdk import ProjectNameSDK
@@ -495,6 +497,10 @@ class TestFeatureOrdering:
 
 class TestPrepareAuth:
 
+    # A cookie credential as prepare_auth writes it: `<scheme>=K` for the
+    # probe key, with no scheme prefix and nothing else in the bag.
+    COOKIE_PAIR = re.compile(r"^[^=;]+=K$")
+
     class _AuthClient:
         def __init__(self, options):
             self._options = options
@@ -503,57 +509,128 @@ class TestPrepareAuth:
             return self._options
 
     # Fake client so the exact options.auth / apikey shape is controlled.
-    def _auth_ctx(self, client, options, headers):
+    def _auth_ctx(self, client, options, spec):
         utility = client._utility
         ctx = utility.make_context({"opname": "load"}, client.get_root_ctx())
         ctx.client = self._AuthClient(options)
-        ctx.spec = None if headers is None else ProjectNameSpec(
-            {"headers": headers})
+        ctx.spec = spec
         return ctx
 
+    @staticmethod
+    def _bags():
+        return ProjectNameSpec({"headers": {}, "query": {}})
+
+    @staticmethod
+    def _bag(spec, where):
+        # A cookie credential rides the header bag, because a cookie IS a
+        # header.
+        return spec.query if "query" == where else spec.headers
+
+    @staticmethod
+    def _auth(prefix):
+        # `basic: false` is explicit: an HTTP Basic API's generated config
+        # carries `auth.basic: true`, and a client that merges it in takes a
+        # branch that needs a secret as well. With none supplied that branch
+        # deliberately writes nothing, which the probe reads as a public API.
+        return {"prefix": prefix, "basic": False}
+
+    # Run prepare_auth with both containers present and see which one the
+    # generated utility writes to, and under what name. None means this SDK
+    # places no credential at all - a public API - which is a legitimate
+    # shape, and the tests below assert exactly that instead. `pair` is the
+    # `<scheme>=` lead-in of a COOKIE credential, which rides the header bag
+    # under the key `cookie` instead of taking a header of its own.
+    def _probe(self, client, options):
+        ctx = self._auth_ctx(client, options, self._bags())
+        client._utility.prepare_auth(ctx)
+        for where in ("headers", "query"):
+            bag = self._bag(ctx.spec, where)
+            for name in bag:
+                value = bag[name]
+                pair = ""
+                if ("headers" == where and "cookie" == name
+                        and isinstance(value, str)
+                        and self.COOKIE_PAIR.match(value)):
+                    pair = value[:-1]
+                return {"where": where, "name": name, "value": value, "pair": pair}
+        return None
+
+    def _credential(self, client):
+        return self._probe(
+            client, {"apikey": "K", "auth": self._auth("Bearer")})
+
+    # Every credential this SDK could possibly place: both credentials and
+    # Basic switched on, so whichever branch the API has, something lands
+    # unless the API is public.
+    def _any_credential(self, client):
+        return self._probe(client, {
+            "apikey": "K", "secret": "S",
+            "auth": {"prefix": "Bearer", "basic": True}})
+
+    def _placed(self, client, options, seed=None):
+        cred = self._credential(client)
+        spec = self._bags()
+        if cred is not None and seed is not None:
+            self._bag(spec, cred["where"])[cred["name"]] = seed
+        ctx = self._auth_ctx(client, options, spec)
+        client._utility.prepare_auth(ctx)
+        if cred is None:
+            return None
+        return self._bag(ctx.spec, cred["where"]).get(cred["name"])
+
     def test_guards_a_missing_spec(self):
         client = _client()
         ctx = self._auth_ctx(client,
-                             {"auth": {"prefix": ""}, "apikey": "K"}, None)
+                             {"auth": self._auth(""), "apikey": "K"}, None)
         _, err = client._utility.prepare_auth(ctx)
         assert err.code == "auth_no_spec"
 
-    def test_an_apikey_with_a_prefix_is_space_joined(self):
-        client = _client()
-        ctx = self._auth_ctx(client,
-                             {"apikey": "K", "auth": {"prefix": "Bearer"}}, {})
-        _, err = client._utility.prepare_auth(ctx)
-        assert err is None
-        assert ctx.spec.headers["authorization"] == "Bearer K"
+    # Without this the cases below cannot fail for an SDK whose credential the
+    # probe misses: every one of them takes the public-API path instead.
+    def test_the_probe_finds_the_credential_this_sdk_places(self):
+        client = _client()
+        assert (self._credential(client) is None) == (
+            self._any_credential(client) is None)
+
+    def test_the_apikey_is_placed_where_this_api_puts_it(self):
+        client = _client()
+        cred = self._credential(client)
+        if cred is None:
+            # A public API places nothing, and that is the whole assertion.
+            assert self._placed(
+                client, {"apikey": "K", "auth": self._auth("Bearer")}) is None
+            return
+        assert cred["where"] in ("headers", "query")
+        if "" != cred["pair"]:
+            # A cookie credential is a `<scheme>=<key>` pair, and the scheme
+            # name leaves no room for the option's prefix.
+            assert self.COOKIE_PAIR.match(cred["value"]), cred["value"]
+            return
+        # A header credential is prefix-joined; a query credential is the raw
+        # key, because a query parameter has nowhere to put a scheme name.
+        assert cred["value"] == ("K" if "query" == cred["where"] else "Bearer K")
 
     def test_a_raw_apikey_goes_in_as_is(self):
         client = _client()
-        ctx = self._auth_ctx(client,
-                             {"apikey": "K", "auth": {"prefix": ""}}, {})
-        client._utility.prepare_auth(ctx)
-        assert ctx.spec.headers["authorization"] == "K"
+        cred = self._credential(client)
+        expected = None if cred is None else cred["pair"] + "K"
+        assert self._placed(
+            client, {"apikey": "K", "auth": self._auth("")}) == expected
 
-    def test_an_empty_apikey_drops_the_header(self):
+    def test_an_empty_apikey_drops_the_credential(self):
         client = _client()
-        ctx = self._auth_ctx(client,
-                             {"apikey": "", "auth": {"prefix": "Bearer"}},
-                             {"authorization": "stale"})
-        client._utility.prepare_auth(ctx)
-        assert ctx.spec.headers.get("authorization") is None
+        assert self._placed(
+            client, {"apikey": "", "auth": self._auth("Bearer")},
+            "stale") is None
 
-    def test_a_public_api_with_no_auth_block_drops_the_header(self):
+    def test_a_public_api_with_no_auth_block_drops_the_credential(self):
         client = _client()
-        ctx = self._auth_ctx(client, {"apikey": "K"},
-                             {"authorization": "stale"})
-        client._utility.prepare_auth(ctx)
-        assert ctx.spec.headers.get("authorization") is None
+        assert self._placed(client, {"apikey": "K"}, "stale") is None
 
-    def test_a_missing_apikey_option_drops_the_header(self):
+    def test_a_missing_apikey_option_drops_the_credential(self):
         client = _client()
-        ctx = self._auth_ctx(client, {"auth": {"prefix": "Bearer"}},
-                             {"authorization": "stale"})
-        client._utility.prepare_auth(ctx)
-        assert ctx.spec.headers.get("authorization") is None
+        assert self._placed(
+            client, {"auth": self._auth("Bearer")}, "stale") is None
 
 
 class TestResultHelpers:

package/project/.sdk/tm/py/test/test_primary_utility.py

@@ -47,6 +47,63 @@ client = _run['client']['sdk']
 utility = client._utility
 
 
+def _auth_bag(spec_obj, where):
+    # A cookie credential rides the header bag, because a cookie IS a header.
+    return spec_obj.query if "query" == where else spec_obj.headers
+
+
+class _AuthProbeClient:
+    """Minimal stand-in so the probe below controls the apikey: the suite's
+    own client carries whatever options a project configured, and an empty
+    apikey places no credential to find."""
+
+    def options_map(self):
+        # `basic: False`: a Basic API's config defaults it true, and the branch
+        # it selects needs a secret, so the probe would find nothing.
+        return {"apikey": "PROBE", "auth": {"prefix": "", "basic": False}}
+
+
+def _auth_credential():
+    """Which container the generated prepare_auth writes the credential
+    into, and under what name. The name is the API's OWN scheme name, so it
+    is discovered by running prepare_auth once rather than assumed."""
+    ctx = _make_test_ctx(client, utility)
+    ctx.client = _AuthProbeClient()
+    ctx.spec = ProjectNameSpec({"headers": {}, "query": {}})
+    try:
+        utility.prepare_auth(ctx)
+    except Exception:
+        return None
+    for where in ("headers", "query"):
+        bag = _auth_bag(ctx.spec, where)
+        for name in bag:
+            return {"where": where, "name": name}
+    return None
+
+
+def _retarget_auth(node, cred):
+    """Rename the corpus's `headers` bag to the real container, and the
+    `authorization` key inside it to the real credential name. Applied only
+    to the prepareAuth section, so real header assertions elsewhere are
+    untouched."""
+    if isinstance(node, list):
+        return [_retarget_auth(n, cred) for n in node]
+    if not isinstance(node, dict):
+        return node
+    out = {}
+    for key in node:
+        if "headers" == key:
+            bag = {}
+            inner = node[key] if isinstance(node[key], dict) else {}
+            for bagkey in inner:
+                name = cred["name"] if "authorization" == bagkey else bagkey
+                bag[name] = _retarget_auth(inner[bagkey], cred)
+            out[cred["where"]] = bag
+        else:
+            out[key] = _retarget_auth(node[key], cred)
+    return out
+
+
 # Sections deliberately left empty in the shared corpus
 # (.sdk/test/primary/<name>.aon carries a PENDING header). Everything else
 # MUST contribute cases.
@@ -538,7 +595,25 @@ class TestPrimaryUtility:
             ctx.client = auth_client
             return _unwrap(utility.prepare_auth(ctx))
 
-        runsection('prepareAuth', subject)
+        # The corpus writes the credential as `headers.authorization`: a
+        # PLACEHOLDER each runner points at the container and name this API
+        # actually uses.
+        cred = _auth_credential()
+        assert cred is not None, \
+            'prepare_auth placed no credential in headers or query'
+
+        # An absent section is runsection's report to make.
+        section = spec.get('prepareAuth') if isinstance(spec, dict) else None
+        swap = isinstance(section, dict) and (
+            'headers' != cred['where'] or 'authorization' != cred['name'])
+        original = section['basic'] if swap else None
+        if swap:
+            section['basic'] = _retarget_auth(original, cred)
+        try:
+            runsection('prepareAuth', subject)
+        finally:
+            if swap:
+                section['basic'] = original
 
     def test_prepare_body_basic(self):
         runsection('prepareBody', lambda ctx: utility.prepare_body(ctx))

package/project/.sdk/tm/rb/test/pipeline_test.rb

@@ -513,52 +513,128 @@ class PipelineTest < Minitest::Test
 
   # === prepare_auth ===
 
-  def auth_ctx(options, headers)
+  # A cookie credential as prepare_auth writes it: `<scheme>=K` for the probe
+  # key, with no scheme prefix and nothing else in the bag.
+  COOKIE_PAIR = /\A[^=;]+=K\z/
+
+  def auth_ctx(options, spec)
     ctx = ProjectNameContext.new({
       "client" => OptClient.new(options),
       "utility" => @utility,
       "opname" => "load",
     }, nil)
-    ctx.spec = headers.nil? ? nil : ProjectNameSpec.new({ "headers" => headers, "step" => "s" })
+    ctx.spec = spec
     ctx
   end
 
+  def auth_bags
+    ProjectNameSpec.new({ "headers" => {}, "query" => {}, "step" => "s" })
+  end
+
+  # A cookie credential rides the header bag, because a cookie IS a header.
+  def auth_bag(spec, where)
+    "query" == where ? spec.query : spec.headers
+  end
+
+  # `basic: false` is explicit: an HTTP Basic API's generated config carries
+  # `auth.basic: true`, and a client that merges it in takes a branch that
+  # needs a secret as well. With none supplied that branch deliberately writes
+  # nothing, which the probe would read as a public API.
+  def auth_block(prefix)
+    { "prefix" => prefix, "basic" => false }
+  end
+
+  # Run prepare_auth with both containers present and see which one the
+  # generated utility writes to, and under what name. nil means this SDK
+  # places no credential at all - a public API - which is a legitimate shape,
+  # and the tests below assert exactly that instead. `pair` is the `<scheme>=`
+  # lead-in of a COOKIE credential, which rides the header bag under the key
+  # `cookie` instead of taking a header of its own.
+  def auth_probe(options)
+    ctx = auth_ctx(options, auth_bags)
+    @utility.prepare_auth.call(ctx)
+    ["headers", "query"].each do |where|
+      bag = auth_bag(ctx.spec, where)
+      bag.each do |name, value|
+        pair = ""
+        if "headers" == where && "cookie" == name && value.is_a?(String) &&
+           COOKIE_PAIR.match?(value)
+          pair = value[0..-2]
+        end
+        return { "where" => where, "name" => name, "value" => value, "pair" => pair }
+      end
+    end
+    nil
+  end
+
+  def auth_credential
+    auth_probe({ "apikey" => "K", "auth" => auth_block("Bearer") })
+  end
+
+  # Every credential this SDK could possibly place: both credentials and Basic
+  # switched on, so whichever branch the API has, something lands unless the
+  # API is public.
+  def auth_any_credential
+    auth_probe({ "apikey" => "K", "secret" => "S",
+                 "auth" => { "prefix" => "Bearer", "basic" => true } })
+  end
+
+  def auth_placed(options, seed = nil)
+    cred = auth_credential
+    spec = auth_bags
+    auth_bag(spec, cred["where"])[cred["name"]] = seed if !cred.nil? && !seed.nil?
+    ctx = auth_ctx(options, spec)
+    @utility.prepare_auth.call(ctx)
+    cred.nil? ? nil : auth_bag(ctx.spec, cred["where"])[cred["name"]]
+  end
+
   def test_prepare_auth_guards_a_missing_spec
-    ctx = auth_ctx({ "auth" => { "prefix" => "" }, "apikey" => "K" }, nil)
+    ctx = auth_ctx({ "auth" => auth_block(""), "apikey" => "K" }, nil)
     _, err = @utility.prepare_auth.call(ctx)
     assert_equal "auth_no_spec", err.code
   end
 
-  def test_prepare_auth_an_apikey_with_a_prefix_is_space_joined
-    ctx = auth_ctx({ "apikey" => "K", "auth" => { "prefix" => "Bearer" } }, {})
-    _, err = @utility.prepare_auth.call(ctx)
-    assert_nil err
-    assert_equal "Bearer K", ctx.spec.headers["authorization"]
+  # Without this the cases below cannot fail for an SDK whose credential the
+  # probe misses: every one of them takes the public-API path instead.
+  def test_prepare_auth_probe_finds_the_credential_this_sdk_places
+    assert_equal auth_credential.nil?, auth_any_credential.nil?
+  end
+
+  def test_prepare_auth_places_the_apikey_where_this_api_puts_it
+    cred = auth_credential
+    if cred.nil?
+      # A public API places nothing, and that is the whole assertion.
+      assert_nil auth_placed({ "apikey" => "K", "auth" => auth_block("Bearer") })
+      return
+    end
+    assert_includes ["headers", "query"], cred["where"]
+    if "" != cred["pair"]
+      # A cookie credential is a `<scheme>=<key>` pair, and the scheme name
+      # leaves no room for the option's prefix.
+      assert_match COOKIE_PAIR, cred["value"]
+      return
+    end
+    # A header credential is prefix-joined; a query credential is the raw
+    # key, because a query parameter has nowhere to put a scheme name.
+    assert_equal("query" == cred["where"] ? "K" : "Bearer K", cred["value"])
   end
 
   def test_prepare_auth_a_raw_apikey_goes_in_as_is
-    ctx = auth_ctx({ "apikey" => "K", "auth" => { "prefix" => "" } }, {})
-    @utility.prepare_auth.call(ctx)
-    assert_equal "K", ctx.spec.headers["authorization"]
+    cred = auth_credential
+    expected = cred.nil? ? nil : cred["pair"] + "K"
+    assert_equal expected, auth_placed({ "apikey" => "K", "auth" => auth_block("") })
   end
 
-  def test_prepare_auth_an_empty_apikey_drops_the_header
-    ctx = auth_ctx({ "apikey" => "", "auth" => { "prefix" => "Bearer" } },
-      { "authorization" => "stale" })
-    @utility.prepare_auth.call(ctx)
-    assert_nil ctx.spec.headers["authorization"]
+  def test_prepare_auth_an_empty_apikey_drops_the_credential
+    assert_nil auth_placed({ "apikey" => "", "auth" => auth_block("Bearer") }, "stale")
   end
 
-  def test_prepare_auth_a_public_api_drops_the_header
-    ctx = auth_ctx({ "apikey" => "K" }, { "authorization" => "stale" })
-    @utility.prepare_auth.call(ctx)
-    assert_nil ctx.spec.headers["authorization"]
+  def test_prepare_auth_a_public_api_drops_the_credential
+    assert_nil auth_placed({ "apikey" => "K" }, "stale")
   end
 
-  def test_prepare_auth_a_missing_apikey_option_drops_the_header
-    ctx = auth_ctx({ "auth" => { "prefix" => "Bearer" } }, { "authorization" => "stale" })
-    @utility.prepare_auth.call(ctx)
-    assert_nil ctx.spec.headers["authorization"]
+  def test_prepare_auth_a_missing_apikey_option_drops_the_credential
+    assert_nil auth_placed({ "auth" => auth_block("Bearer") }, "stale")
   end
 
 

package/project/.sdk/tm/rb/test/primary_utility_test.rb

@@ -533,7 +533,24 @@ class PrimaryUtilityTest < Minitest::Test
       unwrap(@utility.prepare_auth.call(ctx))
     end
 
-    runsection("prepareAuth", subject)
+    # The corpus writes the credential as `headers.authorization`: a
+    # PLACEHOLDER each runner points at the container and name this API
+    # actually uses.
+    cred = auth_credential(auth_client)
+    refute_nil cred, "prepare_auth placed no credential in headers or query"
+
+    # An absent section is runsection's report to make.
+    section = @spec.is_a?(Hash) ? @spec["prepareAuth"] : nil
+    swap = section.is_a?(Hash) &&
+      !("headers" == cred["where"] && "authorization" == cred["name"])
+    original = swap ? section["basic"] : nil
+    section["basic"] = retarget_auth(original, cred) if swap
+
+    begin
+      runsection("prepareAuth", subject)
+    ensure
+      section["basic"] = original if swap
+    end
   end
 
 
@@ -650,6 +667,47 @@ class PrimaryUtilityTest < Minitest::Test
     utility.make_context.call(ctxmap, client.get_root_ctx)
   end
 
+  # Where this SDK's prepare_auth actually puts the credential: the name is
+  # the API's OWN scheme name, not always `authorization`, so it is
+  # discovered by running prepare_auth once.
+  def auth_credential(client)
+    utility = client.get_utility
+    ctx = make_test_ctx(client, utility, nil)
+    ctx.spec = ProjectNameSpec.new({ "headers" => {}, "query" => {}, "step" => "s" })
+    _, err = utility.prepare_auth.call(ctx)
+    return nil unless err.nil?
+    ["headers", "query"].each do |where|
+      # A cookie credential rides the header bag, because a cookie IS a header.
+      bag = "query" == where ? ctx.spec.query : ctx.spec.headers
+      bag.each { |name, _value| return { "where" => where, "name" => name } }
+    end
+    nil
+  end
+
+  # Rename the corpus's `headers` bag to the real container, and the
+  # `authorization` key inside it to the real credential name. Applied only
+  # to the prepareAuth section, so real header assertions elsewhere are
+  # untouched.
+  def retarget_auth(node, cred)
+    return node.map { |child| retarget_auth(child, cred) } if node.is_a?(Array)
+    return node unless node.is_a?(Hash)
+
+    out = {}
+    node.each do |key, value|
+      if "headers" == key
+        bag = {}
+        (value.is_a?(Hash) ? value : {}).each do |bagkey, bagvalue|
+          name = "authorization" == bagkey ? cred["name"] : bagkey
+          bag[name] = retarget_auth(bagvalue, cred)
+        end
+        out[cred["where"]] = bag
+      else
+        out[key] = retarget_auth(value, cred)
+      end
+    end
+    out
+  end
+
   # === Helper: make_test_full_ctx ===
   def make_test_full_ctx(client, utility)
     ctx = make_test_ctx(client, utility, nil)

package/project/.sdk/tm/ts/test/pipeline.test.ts

@@ -317,6 +317,11 @@ describe('pipeline:feature order', () => {
 })
 
 
+// A cookie credential as prepareAuth writes it: `<scheme>=K` for the probe
+// key, with no scheme prefix and nothing else in the bag.
+const COOKIE_PAIR = /^[^=;]+=K$/
+
+
 describe('pipeline:prepareAuth', () => {
 
   function authCtx(options: any, spec: any) {
@@ -327,19 +332,42 @@ describe('pipeline:prepareAuth', () => {
     return { headers: {} as any, query: {} as any }
   }
 
+  // `basic: false` is explicit: an HTTP Basic API's generated config carries
+  // `auth.basic: true`, and a client that merges it in takes a branch needing
+  // a secret as well. With none supplied that branch writes nothing, which
+  // the probe below would then read as a public API.
+  function auth(prefix: string): any {
+    return { prefix, basic: false }
+  }
+
   // Run prepareAuth with both containers present and see which one the
   // generated utility writes to, and under what name. Null means this SDK
-  // places no credential at all — a public API — which is a legitimate
-  // shape, and the tests below assert exactly that instead.
-  const CRED = (() => {
-    const ctx = authCtx({ apikey: 'K', auth: { prefix: 'Bearer' } }, bags())
+  // places no credential at all — a public API — which the cases below then
+  // assert instead.
+
+  // `pair` is the `<scheme>=` lead-in of a COOKIE credential, which rides the
+  // header bag under the key `cookie` rather than taking a header of its own.
+  function probe(options: any) {
+    const ctx = authCtx(options, bags())
     ;(stdutil as any).prepareAuth(ctx)
     for (const where of ['headers', 'query'] as const) {
       const name = Object.keys(ctx.spec[where] as any)[0]
-      if (null != name) return { where, name, value: ctx.spec[where][name] }
+      if (null == name) continue
+      const value = ctx.spec[where][name]
+      const pair = COOKIE_PAIR.test(String(value)) && 'cookie' === name && 'headers' === where
+        ? String(value).slice(0, -1)
+        : ''
+      return { where, name, value, pair }
     }
     return null
-  })()
+  }
+
+  const CRED = probe({ apikey: 'K', auth: auth('Bearer') })
+
+  // Every credential this SDK could possibly place: both credentials and
+  // Basic switched on, so whichever branch the API has, something lands
+  // unless the API is public.
+  const ANY = probe({ apikey: 'K', secret: 'S', auth: { prefix: 'Bearer', basic: true } })
 
   function placed(options: any, seed?: any) {
     const spec: any = bags()
@@ -350,27 +378,40 @@ describe('pipeline:prepareAuth', () => {
   }
 
   test('guards a missing spec', () => {
-    strictEqual((stdutil as any).prepareAuth(authCtx({ auth: { prefix: '' }, apikey: 'K' }, null)).code, 'auth_no_spec')
+    strictEqual((stdutil as any).prepareAuth(authCtx({ auth: auth(''), apikey: 'K' }, null)).code, 'auth_no_spec')
+  })
+
+  // Without this the cases below cannot fail for an SDK whose credential the
+  // probe misses: every one of them takes the public-API path instead.
+  test('the probe finds the credential this SDK places', () => {
+    strictEqual(null != CRED, null != ANY)
   })
 
   test('the apikey is placed where this API puts it', () => {
     if (null == CRED) {
       // A public API places nothing, and that is the whole assertion.
-      strictEqual(placed({ apikey: 'K', auth: { prefix: 'Bearer' } }), undefined)
+      strictEqual(placed({ apikey: 'K', auth: auth('Bearer') }), undefined)
       return
     }
     ok('headers' === CRED.where || 'query' === CRED.where)
+    if ('' !== CRED.pair) {
+      // A cookie credential is a `<scheme>=<key>` pair, and the scheme name
+      // leaves no room for the option's prefix.
+      ok(COOKIE_PAIR.test(String(CRED.value)), String(CRED.value))
+      return
+    }
     // A header credential is prefix-joined; a query credential is the raw
     // key, because a query parameter has nowhere to put a scheme name.
     strictEqual(CRED.value, 'headers' === CRED.where ? 'Bearer K' : 'K')
   })
 
   test('a raw apikey (empty prefix) goes in as-is', () => {
-    strictEqual(placed({ apikey: 'K', auth: { prefix: '' } }), null == CRED ? undefined : 'K')
+    const raw = null == CRED ? undefined : CRED.pair + 'K'
+    strictEqual(placed({ apikey: 'K', auth: auth('') }), raw)
   })
 
   test('an empty apikey drops the credential', () => {
-    strictEqual(placed({ apikey: '', auth: { prefix: 'Bearer' } }, 'stale'), undefined)
+    strictEqual(placed({ apikey: '', auth: auth('Bearer') }, 'stale'), undefined)
   })
 
   test('a public API (no auth block) drops the credential', () => {
@@ -378,7 +419,7 @@ describe('pipeline:prepareAuth', () => {
   })
 
   test('a missing apikey option drops the credential', () => {
-    strictEqual(placed({ auth: { prefix: 'Bearer' } }, 'stale'), undefined)
+    strictEqual(placed({ auth: auth('Bearer') }, 'stale'), undefined)
   })
 })
 

package/project/sdkgen-package.json

@@ -3,7 +3,7 @@
     "package": 1
   },
   "name": "@voxgig/sdkgen",
-  "version": "4.24.0",
+  "version": "4.24.2",
   "provides": {
     "target": [
       "c",