zswag 1.9.1.dev5__tar.gz → 1.9.2.dev14__tar.gz

{zswag-1.9.1.dev5 → zswag-1.9.2.dev14}/.gitignore

@@ -28,6 +28,8 @@ share/python-wheels/
 .installed.cfg
 *.egg
 MANIFEST
+cmake-build-*
+venv*
 
 # PyInstaller
 #  Usually these files are written by a python script from a template

{zswag-1.9.1.dev5 → zswag-1.9.2.dev14}/CMakeLists.txt

@@ -10,7 +10,7 @@ set(CMAKE_CXX_STANDARD_REQUIRED ON)
 # without requiring CMakeLists.txt updates between releases.
 # For official releases, this value should match the git tag.
 if(NOT DEFINED ZSWAG_VERSION)
-  set(ZSWAG_VERSION 1.9.0)
+  set(ZSWAG_VERSION 1.9.1)
 endif()
 
 option(ZSWAG_BUILD_WHEELS "Enable zswag whl-output to WHEEL_DEPLOY_DIRECTORY." ON)

{zswag-1.9.1.dev5 → zswag-1.9.2.dev14}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: zswag
-Version: 1.9.1.dev5
+Version: 1.9.2.dev14
 Summary: OpenAPI service transport layer for zserio.
 Home-page: https://github.com/klebert-engineering/zswag
 Author: Klebert Engineering
@@ -705,11 +705,13 @@ http-settings:
     basic-auth:  # Basic auth credentials for matching requests.
       user: johndoe
       keychain: keychain-service-string
+      password: cleartext-password  # alternative to keychain
     proxy:      # Proxy settings for matching requests.
       host: localhost
       port: 8888
       user: test
       keychain: ...
+      password: cleartext-password  # alternative to keychain
     cookies:    # Additional Cookies for matching requests.
       key: value
     headers:    # Additional Headers for matching requests.
@@ -717,6 +719,14 @@ http-settings:
     query:      # Additional Query parameters for matching requests.
       key: value
     api-key: value  # API Key as required by OpenAPI config - see description below.
+    oauth2:
+      clientId: my-client-id                               # For OAuth2 client-credentials auth
+      clientSecretKeychain: keychain-service-string        # Prefer a keychain entry over cleartext
+      clientSecret: cleartext-secret                       # discouraged, use keychain
+      tokenUrl: https://issuer.example.com/oauth/token     # optional override; defaults to tokenUrl from OpenAPI
+      refreshUrl: https://issuer.example.com/oauth/token   # optional override; defaults to refreshUrl from OpenAPI, then tokenUrl
+      audience: https://api.example.com/  # Optional (some providers require it)
+      scope: ["orders.read", ...]  # Optional scope override; defaults to OpenAPI setting per operation
 ```
 
 **Note:** For `proxy` configs, the credentials are optional.
@@ -965,10 +975,11 @@ constructor in C++/Python with the relevant detail.
 
 #### Component Support
 
-| Feature            | C++ Client | Python Client | OAServer | zswag.gen |
-| ------------------ | ---------- | ------------- | -------- | --------- |
-| `HTTP Basic-Auth` `HTTP Bearer-Auth` `Cookie API-Key` `Header API-Key` `Query API-Key`  | ✔️ | ✔️ | ✔️(**) | ✔️ |
-| `OpenID Connect` `OAuth2`  | ❌️ | ❌️ | ✔️(**) | ❌️ |
+| Feature                                                                                | C++ Client | Python Client | OAServer | zswag.gen |
+|----------------------------------------------------------------------------------------| ---------- | ------------- | -------- | --------- |
+| `HTTP Basic-Auth` `HTTP Bearer-Auth` `Cookie API-Key` `Header API-Key` `Query API-Key` | ✔️ | ✔️ | ✔️(**) | ✔️ |
+| `OAuth2[clientCredentials]`                                                            | ✔️ | ✔️ | ✔️(**) | ✔️ |
+| `OpenID Connect` `OAuth2[authorizationCode]` `OAuth2[implicit]` `OAuth2[password]`     | ❌️ | ❌️ | ✔️(**) | ❌️ |
 
 **(\*\*)**: The server support for all authentication schemes depends on your
 configuration of the WSGI server (Apache/Nginx/...) which wraps the zswag Flask app.

{zswag-1.9.1.dev5 → zswag-1.9.2.dev14}/README.md

@@ -690,11 +690,13 @@ http-settings:
     basic-auth:  # Basic auth credentials for matching requests.
       user: johndoe
       keychain: keychain-service-string
+      password: cleartext-password  # alternative to keychain
     proxy:      # Proxy settings for matching requests.
       host: localhost
       port: 8888
       user: test
       keychain: ...
+      password: cleartext-password  # alternative to keychain
     cookies:    # Additional Cookies for matching requests.
       key: value
     headers:    # Additional Headers for matching requests.
@@ -702,6 +704,14 @@ http-settings:
     query:      # Additional Query parameters for matching requests.
       key: value
     api-key: value  # API Key as required by OpenAPI config - see description below.
+    oauth2:
+      clientId: my-client-id                               # For OAuth2 client-credentials auth
+      clientSecretKeychain: keychain-service-string        # Prefer a keychain entry over cleartext
+      clientSecret: cleartext-secret                       # discouraged, use keychain
+      tokenUrl: https://issuer.example.com/oauth/token     # optional override; defaults to tokenUrl from OpenAPI
+      refreshUrl: https://issuer.example.com/oauth/token   # optional override; defaults to refreshUrl from OpenAPI, then tokenUrl
+      audience: https://api.example.com/  # Optional (some providers require it)
+      scope: ["orders.read", ...]  # Optional scope override; defaults to OpenAPI setting per operation
 ```
 
 **Note:** For `proxy` configs, the credentials are optional.
@@ -950,10 +960,11 @@ constructor in C++/Python with the relevant detail.
 
 #### Component Support
 
-| Feature            | C++ Client | Python Client | OAServer | zswag.gen |
-| ------------------ | ---------- | ------------- | -------- | --------- |
-| `HTTP Basic-Auth` `HTTP Bearer-Auth` `Cookie API-Key` `Header API-Key` `Query API-Key`  | ✔️ | ✔️ | ✔️(**) | ✔️ |
-| `OpenID Connect` `OAuth2`  | ❌️ | ❌️ | ✔️(**) | ❌️ |
+| Feature                                                                                | C++ Client | Python Client | OAServer | zswag.gen |
+|----------------------------------------------------------------------------------------| ---------- | ------------- | -------- | --------- |
+| `HTTP Basic-Auth` `HTTP Bearer-Auth` `Cookie API-Key` `Header API-Key` `Query API-Key` | ✔️ | ✔️ | ✔️(**) | ✔️ |
+| `OAuth2[clientCredentials]`                                                            | ✔️ | ✔️ | ✔️(**) | ✔️ |
+| `OpenID Connect` `OAuth2[authorizationCode]` `OAuth2[implicit]` `OAuth2[password]`     | ❌️ | ❌️ | ✔️(**) | ❌️ |
 
 **(\*\*)**: The server support for all authentication schemes depends on your
 configuration of the WSGI server (Apache/Nginx/...) which wraps the zswag Flask app.

{zswag-1.9.1.dev5 → zswag-1.9.2.dev14}/cmake/Dependencies.cmake

@@ -77,7 +77,7 @@ if(NOT TARGET yaml-cpp)
     FetchContent_Declare(
         yaml-cpp
         GIT_REPOSITORY https://github.com/jbeder/yaml-cpp.git
-        GIT_TAG        "2f86d13775d119edbb69af52e5f566fd65c6953b"  # Latest commit on master as of Dec 2024
+        GIT_TAG        "aa8d4e4750ec9fe9f8cc680eb90f1b15955c817e"  # Latest commit on master as of Dec 2024
         GIT_SHALLOW    TRUE
     )
     set(YAML_CPP_BUILD_TESTS OFF CACHE BOOL "" FORCE)

{zswag-1.9.1.dev5 → zswag-1.9.2.dev14}/cmake/OpenSSL.cmake

@@ -10,12 +10,15 @@ ProcessorCount(N)
 # Set OpenSSL install directory
 set(OPENSSL_INSTALL_DIR ${CMAKE_CURRENT_BINARY_DIR}/_deps/openssl-install)
 
+# Use find_package so Perl executable can be set in cmake
+find_package(Perl REQUIRED)
+
 # Determine platform-specific OpenSSL configuration
 if(CMAKE_SYSTEM_NAME STREQUAL "Windows")
     if(CMAKE_SIZEOF_VOID_P EQUAL 8)
-        set(OPENSSL_CONFIGURE_COMMAND perl ${OPENSSL_SOURCE_DIR}/Configure VC-WIN64A --prefix=${OPENSSL_INSTALL_DIR} --openssldir=${OPENSSL_INSTALL_DIR}/ssl no-shared no-tests)
+        set(OPENSSL_CONFIGURE_COMMAND ${PERL_EXECUTABLE} ${OPENSSL_SOURCE_DIR}/Configure VC-WIN64A --prefix=${OPENSSL_INSTALL_DIR} --openssldir=${OPENSSL_INSTALL_DIR}/ssl no-shared no-tests)
     else()
-        set(OPENSSL_CONFIGURE_COMMAND perl ${OPENSSL_SOURCE_DIR}/Configure VC-WIN32 --prefix=${OPENSSL_INSTALL_DIR} --openssldir=${OPENSSL_INSTALL_DIR}/ssl no-shared no-tests)
+        set(OPENSSL_CONFIGURE_COMMAND ${PERL_EXECUTABLE} ${OPENSSL_SOURCE_DIR}/Configure VC-WIN32 --prefix=${OPENSSL_INSTALL_DIR} --openssldir=${OPENSSL_INSTALL_DIR}/ssl no-shared no-tests)
     endif()
     set(OPENSSL_BUILD_COMMAND nmake)
     set(OPENSSL_INSTALL_COMMAND nmake install_sw)

{zswag-1.9.1.dev5 → zswag-1.9.2.dev14}/libs/httpcl/include/httpcl/http-settings.hpp

@@ -46,6 +46,16 @@ struct Config
         std::string keychain;
     };
 
+    struct OAuth2 {
+        std::string clientId;
+        std::string clientSecret;
+        std::string clientSecretKeychain;
+        std::string tokenUrlOverride; // optional
+        std::string refreshUrlOverride; // optional
+        std::string audience; // optional
+        std::vector<std::string> scopesOverride; // optional
+    };
+
     std::optional<std::string> scope;
     std::regex urlPattern;
     std::string urlPatternString;
@@ -53,6 +63,7 @@ struct Config
     std::map<std::string, std::string> cookies;
     std::optional<BasicAuthentication> auth;
     std::optional<Proxy> proxy;
+    std::optional<OAuth2> oauth2;
     std::optional<std::string> apiKey;
     Headers headers;
     Query query;

{zswag-1.9.1.dev5 → zswag-1.9.2.dev14}/libs/httpcl/src/http-settings.cpp

@@ -180,6 +180,25 @@ YAML::Node configToNode(Config const& config) {
     if (config.apiKey)
         result["api-key"] = *config.apiKey;
 
+    if (config.oauth2) {
+        YAML::Node oauth2Node;
+        if (!config.oauth2->clientId.empty())
+            oauth2Node["clientId"] = config.oauth2->clientId;
+        if (!config.oauth2->clientSecret.empty())
+            oauth2Node["clientSecret"] = config.oauth2->clientSecret;
+        if (!config.oauth2->clientSecretKeychain.empty())
+            oauth2Node["clientSecretKeychain"] = config.oauth2->clientSecretKeychain;
+        if (!config.oauth2->tokenUrlOverride.empty())
+            oauth2Node["tokenUrl"] = config.oauth2->tokenUrlOverride;
+        if (!config.oauth2->refreshUrlOverride.empty())
+            oauth2Node["refreshUrl"] = config.oauth2->refreshUrlOverride;
+        if (!config.oauth2->audience.empty())
+            oauth2Node["audience"] = config.oauth2->audience;
+        if (!config.oauth2->scopesOverride.empty())
+            oauth2Node["scopes"] = config.oauth2->scopesOverride;
+        result["oauth2"] = oauth2Node;
+    }
+
     return result;
 }
 
@@ -221,6 +240,27 @@ Config configFromNode(YAML::Node const& node)
     if (auto apiKey = node["api-key"])
         conf.apiKey = apiKey.as<std::string>();
 
+    if (auto oauth2Node = node["oauth2"]) {
+        Config::OAuth2 oauth2;
+        if (auto v = oauth2Node["clientId"])
+            oauth2.clientId = v.as<std::string>();
+        if (auto v = oauth2Node["clientSecret"])
+            oauth2.clientSecret = v.as<std::string>();
+        if (auto v = oauth2Node["clientSecretKeychain"])
+            oauth2.clientSecretKeychain = v.as<std::string>();
+        if (auto v = oauth2Node["tokenUrl"])
+            oauth2.tokenUrlOverride = v.as<std::string>();
+        if (auto v = oauth2Node["refreshUrl"])
+            oauth2.refreshUrlOverride = v.as<std::string>();
+        if (auto v = oauth2Node["audience"])
+            oauth2.audience = v.as<std::string>();
+        if (auto v = oauth2Node["scope"]) {
+            for (auto const& scope : v)
+                oauth2.scopesOverride.emplace_back(scope.as<std::string>());
+        }
+        conf.oauth2 = oauth2;
+    }
+
     return conf;
 }
 }
@@ -520,5 +560,23 @@ Config& Config::operator |= (Config const& other) {
         proxy = other.proxy;
     if (other.apiKey)
         apiKey = other.apiKey;
+    if (other.oauth2) {
+        if (!oauth2)
+            oauth2.emplace();
+        if (!other.oauth2->clientId.empty())
+            oauth2->clientId = other.oauth2->clientId;
+        if (!other.oauth2->clientSecretKeychain.empty())
+            oauth2->clientSecretKeychain = other.oauth2->clientSecretKeychain;
+        if (!other.oauth2->clientSecret.empty())
+            oauth2->clientSecret = other.oauth2->clientSecret;
+        if (!other.oauth2->tokenUrlOverride.empty())
+            oauth2->tokenUrlOverride = other.oauth2->tokenUrlOverride;
+        if (!other.oauth2->refreshUrlOverride.empty())
+            oauth2->refreshUrlOverride = other.oauth2->refreshUrlOverride;
+        if (!other.oauth2->audience.empty())
+            oauth2->audience = other.oauth2->audience;
+        if (!other.oauth2->scopesOverride.empty())
+            oauth2->scopesOverride = other.oauth2->scopesOverride;
+    }
     return *this;
 }

{zswag-1.9.1.dev5 → zswag-1.9.2.dev14}/libs/zswag.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: zswag
-Version: 1.9.1.dev5
+Version: 1.9.2.dev14
 Summary: OpenAPI service transport layer for zserio.
 Home-page: https://github.com/klebert-engineering/zswag
 Author: Klebert Engineering
@@ -705,11 +705,13 @@ http-settings:
     basic-auth:  # Basic auth credentials for matching requests.
       user: johndoe
       keychain: keychain-service-string
+      password: cleartext-password  # alternative to keychain
     proxy:      # Proxy settings for matching requests.
       host: localhost
       port: 8888
       user: test
       keychain: ...
+      password: cleartext-password  # alternative to keychain
     cookies:    # Additional Cookies for matching requests.
       key: value
     headers:    # Additional Headers for matching requests.
@@ -717,6 +719,14 @@ http-settings:
     query:      # Additional Query parameters for matching requests.
       key: value
     api-key: value  # API Key as required by OpenAPI config - see description below.
+    oauth2:
+      clientId: my-client-id                               # For OAuth2 client-credentials auth
+      clientSecretKeychain: keychain-service-string        # Prefer a keychain entry over cleartext
+      clientSecret: cleartext-secret                       # discouraged, use keychain
+      tokenUrl: https://issuer.example.com/oauth/token     # optional override; defaults to tokenUrl from OpenAPI
+      refreshUrl: https://issuer.example.com/oauth/token   # optional override; defaults to refreshUrl from OpenAPI, then tokenUrl
+      audience: https://api.example.com/  # Optional (some providers require it)
+      scope: ["orders.read", ...]  # Optional scope override; defaults to OpenAPI setting per operation
 ```
 
 **Note:** For `proxy` configs, the credentials are optional.
@@ -965,10 +975,11 @@ constructor in C++/Python with the relevant detail.
 
 #### Component Support
 
-| Feature            | C++ Client | Python Client | OAServer | zswag.gen |
-| ------------------ | ---------- | ------------- | -------- | --------- |
-| `HTTP Basic-Auth` `HTTP Bearer-Auth` `Cookie API-Key` `Header API-Key` `Query API-Key`  | ✔️ | ✔️ | ✔️(**) | ✔️ |
-| `OpenID Connect` `OAuth2`  | ❌️ | ❌️ | ✔️(**) | ❌️ |
+| Feature                                                                                | C++ Client | Python Client | OAServer | zswag.gen |
+|----------------------------------------------------------------------------------------| ---------- | ------------- | -------- | --------- |
+| `HTTP Basic-Auth` `HTTP Bearer-Auth` `Cookie API-Key` `Header API-Key` `Query API-Key` | ✔️ | ✔️ | ✔️(**) | ✔️ |
+| `OAuth2[clientCredentials]`                                                            | ✔️ | ✔️ | ✔️(**) | ✔️ |
+| `OpenID Connect` `OAuth2[authorizationCode]` `OAuth2[implicit]` `OAuth2[password]`     | ❌️ | ❌️ | ✔️(**) | ❌️ |
 
 **(\*\*)**: The server support for all authentication schemes depends on your
 configuration of the WSGI server (Apache/Nginx/...) which wraps the zswag Flask app.

{zswag-1.9.1.dev5 → zswag-1.9.2.dev14}/libs/zswag.egg-info/SOURCES.txt

@@ -60,23 +60,31 @@ libs/zswagcl/include/zswagcl/export.hpp
 libs/zswagcl/include/zswagcl/oaclient.hpp
 libs/zswagcl/include/zswagcl/private/openapi-client.hpp
 libs/zswagcl/include/zswagcl/private/openapi-config.hpp
+libs/zswagcl/include/zswagcl/private/openapi-oauth.hpp
 libs/zswagcl/include/zswagcl/private/openapi-parameter-helper.hpp
 libs/zswagcl/include/zswagcl/private/openapi-parser.hpp
+libs/zswagcl/include/zswagcl/private/openapi-security.hpp
 libs/zswagcl/src/base64.cpp
 libs/zswagcl/src/base64.hpp
 libs/zswagcl/src/oaclient.cpp
 libs/zswagcl/src/openapi-client.cpp
 libs/zswagcl/src/openapi-config.cpp
+libs/zswagcl/src/openapi-oauth.cpp
 libs/zswagcl/src/openapi-parameter-helper.cpp
 libs/zswagcl/src/openapi-parser.cpp
+libs/zswagcl/src/openapi-security.cpp
 libs/zswagcl/test/CMakeLists.txt
 libs/zswagcl/test/src/base64.cpp
 libs/zswagcl/test/src/http-service-format.cpp
 libs/zswagcl/test/src/main.cpp
 libs/zswagcl/test/src/oaclient.cpp
+libs/zswagcl/test/src/oauth2-integration-test.cpp
+libs/zswagcl/test/src/oauth2-test.cpp
 libs/zswagcl/test/src/openapi-parameter-helper.cpp
 libs/zswagcl/test/src/service_client_test.zs
 libs/zswagcl/test/testdata/auth.yaml
 libs/zswagcl/test/testdata/config-template.json
 libs/zswagcl/test/testdata/config-with-auth.json
-libs/zswagcl/test/testdata/dummy.json
+libs/zswagcl/test/testdata/dummy.json
+libs/zswagcl/test/testdata/oauth2-openapi.yaml
+libs/zswagcl/test/testdata/oauth2-settings.yaml

{zswag-1.9.1.dev5 → zswag-1.9.2.dev14}/libs/zswag.egg-info/requires.txt

@@ -1,4 +1,4 @@
-pyzswagcl==1.9.1.dev5
+pyzswagcl==1.9.2.dev14
 connexion~=2.14.2
 requests
 zserio<3.0.0

{zswag-1.9.1.dev5 → zswag-1.9.2.dev14}/libs/zswagcl/CMakeLists.txt

@@ -10,13 +10,17 @@ add_library(zswagcl SHARED
   include/zswagcl/private/openapi-parameter-helper.hpp
   include/zswagcl/private/openapi-parser.hpp
   include/zswagcl/oaclient.hpp
+  include/zswagcl/private/openapi-security.hpp
+  include/zswagcl/private/openapi-oauth.hpp
 
   src/base64.cpp
   src/openapi-client.cpp
   src/openapi-config.cpp
   src/openapi-parameter-helper.cpp
   src/openapi-parser.cpp
-  src/oaclient.cpp)
+  src/openapi-security.cpp
+  src/oaclient.cpp
+  src/openapi-oauth.cpp)
 
 target_link_libraries(zswagcl
   PUBLIC

{zswag-1.9.1.dev5 → zswag-1.9.2.dev14}/libs/zswagcl/include/zswagcl/private/openapi-client.hpp

@@ -5,6 +5,7 @@
 #include "openapi-parser.hpp"
 #include "openapi-config.hpp"
 #include "openapi-parameter-helper.hpp"
+#include "openapi-security.hpp"
 
 #include "httpcl/uri.hpp"
 #include "httpcl/http-client.hpp"
@@ -17,6 +18,7 @@ class OpenAPIClient
 public:
     OpenAPIConfig config_;
     httpcl::Config httpConfig_;
+    AuthRegistry authHandlers_;
 
     OpenAPIClient(OpenAPIConfig config,
                   httpcl::Config httpConfig,

{zswag-1.9.1.dev5 → zswag-1.9.2.dev14}/libs/zswagcl/include/zswagcl/private/openapi-config.hpp

@@ -21,46 +21,45 @@ struct OpenAPIConfig
         Header
     };
 
-    struct SecurityScheme {
-        std::string id;
-        explicit SecurityScheme(std::string id);
-        virtual ~SecurityScheme() = default;
-        virtual bool checkOrApply(httpcl::Config& config, std::string& err) const = 0;
+    enum class SecuritySchemeType {
+        HttpBasic,
+        HttpBearer,
+        ApiKeyQuery,
+        ApiKeyHeader,
+        ApiKeyCookie,
+        OAuth2ClientCredentials
     };
 
+    struct SecurityScheme
+    {
+        SecuritySchemeType type;
+        std::string oauthTokenUrl; // For oauth2
+        std::string oauthRefreshUrl; // For oauth2
+        std::map<std::string, std::string> oauthScopes; // Scope -> Description
+        std::string apiKeyName; // Header/Query/Cookie name
+        std::string id; // Scheme name for introspection/debugging
+    };
     using SecuritySchemePtr = std::shared_ptr<SecurityScheme>;
 
     /**
-     * Security Scheme References
+     * Security Scheme References by operations.
      *
      * Disjunctive normal form ([A [AND B]+][ OR C [AND D]+]+) of required
      * security schemes. An empty vector is used to encode that no auth
      * scheme is required.
      */
-    using SecurityAlternatives = std::vector<std::vector<SecuritySchemePtr>>;
+    struct SecurityRequirement
+    {
+        SecuritySchemePtr scheme;
+        // For each operation, a subset of scopes may be defined which are required for it.
+        std::vector<std::string> scopes;
+    };
+    using SecurityAlternative = std::vector<SecurityRequirement>;
+    using SecurityAlternatives = std::vector<SecurityAlternative>;
 
     /**
      * Supported Authentication Schemes
      */
-    struct BasicAuth : public SecurityScheme {
-        explicit BasicAuth(std::string id);
-        bool checkOrApply(httpcl::Config& config, std::string& err) const override;
-    };
-    struct BearerAuth : public SecurityScheme {
-        explicit BearerAuth(std::string id);
-        bool checkOrApply(httpcl::Config& config, std::string& err) const override;
-    };
-    struct APIKeyAuth : public SecurityScheme {
-        explicit APIKeyAuth(std::string id, ParameterLocation location, std::string keyName);
-        bool checkOrApply(httpcl::Config& config, std::string& err) const override;
-        ParameterLocation location = ParameterLocation::Header;
-        std::string keyName;
-    };
-    struct CookieAuth : public SecurityScheme {
-        explicit CookieAuth(std::string id, std::string cookieName);
-        bool checkOrApply(httpcl::Config& config, std::string& err) const override;
-        std::string cookieName;
-    };
 
     struct Parameter {
         ParameterLocation location = ParameterLocation::Query;

zswag-1.9.2.dev14/libs/zswagcl/include/zswagcl/private/openapi-oauth.hpp

@@ -0,0 +1,60 @@
+#pragma once
+
+#include "openapi-security.hpp"
+
+namespace zswagcl
+{
+
+class OAuth2ClientCredentialsHandler final : public ISecurityHandler
+{
+public:
+    bool satisfy(
+        const OpenAPIConfig::SecurityRequirement& req,
+        AuthContext const& ctx,
+        std::string& mismatchReason) override;
+
+private:
+    // OAuth2 grant type constants
+    static constexpr const char* GRANT_TYPE_CLIENT_CREDENTIALS = "client_credentials";
+    static constexpr const char* GRANT_TYPE_REFRESH_TOKEN = "refresh_token";
+    
+    struct TokenKey
+    {
+        std::string tokenUrl, clientId, audience, scopeKey;
+        bool operator==(const TokenKey& o) const
+        {
+            return tokenUrl == o.tokenUrl && clientId == o.clientId && audience == o.audience &&
+                scopeKey == o.scopeKey;
+        }
+    };
+
+    struct TokenKeyHash
+    {
+        size_t operator()(const TokenKey& k) const
+        {
+            std::hash<std::string> H;
+            return H(k.tokenUrl) ^ H(k.clientId) ^ H(k.audience) ^ H(k.scopeKey);
+        }
+    };
+
+    struct MintedToken
+    {
+        std::string accessToken;
+        std::string refreshToken;  // may be empty (most CC flows don’t return one)
+        std::chrono::steady_clock::time_point expiresAt;
+    };
+
+    std::shared_mutex m_;
+    std::unordered_map<TokenKey, MintedToken, TokenKeyHash> cache_;
+
+    // Method for both token fetch and refresh requests
+    MintedToken requestToken(
+        AuthContext const& httpCtx,
+        const httpcl::Config::OAuth2& oauthConfig,
+        const std::string& resolvedTokenUrl,
+        const std::string& grantType,
+        const std::vector<std::string>& resolvedScopes = {},
+        const std::string& refreshToken = "");
+};
+
+}  // namespace zswagcl

zswag-1.9.2.dev14/libs/zswagcl/include/zswagcl/private/openapi-security.hpp

@@ -0,0 +1,56 @@
+#pragma once
+
+#include <memory>
+#include <unordered_map>
+
+#include "httpcl/http-client.hpp"
+#include "httpcl/http-settings.hpp"
+#include "openapi-config.hpp"
+
+namespace zswagcl
+{
+
+struct AuthContext
+{
+    httpcl::IHttpClient& httpClient;
+    const std::string& targetResourceUri;
+    httpcl::Settings const& httpSettings;
+    httpcl::Config& resultHttpConfigWithAuthorization;
+};
+
+class ISecurityHandler
+{
+public:
+    virtual ~ISecurityHandler() = default;
+
+    /**
+     * Checks if current HTTP settings can satisfy the derived Security scheme handler.
+     * Potentially modifies the AuthContext::httpConfig.
+     */
+    virtual bool satisfy(
+        const OpenAPIConfig::SecurityRequirement& req,
+        AuthContext const& ctx,
+        std::string& mismatchReason) = 0;
+};
+
+class AuthRegistry
+{
+public:
+    /**
+     * Construct an auth registry. Instantiates and registers handlers for all known security types.
+     */
+    AuthRegistry();
+
+    /**
+     * Try to satisfy an OR of AND-sets. Throws if none can be satisfied.
+     */
+    void satisfySecurity(
+        const OpenAPIConfig::SecurityAlternatives& alts,
+        AuthContext const& ctx);
+
+private:
+    std::unordered_map<OpenAPIConfig::SecuritySchemeType, std::shared_ptr<ISecurityHandler>>
+        handlers_;
+};
+
+}  // namespace zswagcl

{zswag-1.9.1.dev5 → zswag-1.9.2.dev14}/libs/zswagcl/src/openapi-client.cpp

@@ -79,40 +79,6 @@ void resolveHeaderAndQueryParameters(httpcl::Config& result,
     }
 }
 
-void checkSecurityAlternativesAndApplyApiKey(OpenAPIConfig::SecurityAlternatives const& alts, httpcl::Config& conf)
-{
-    if (alts.empty())
-        return; // Nothing to check
-
-    bool anyAlternativeMatched = false;
-    std::stringstream error;
-    error << "The provided HTTP configuration does not satisfy authentication requirements:\n";
-
-    int i = 0;
-    for (auto const& schemeSet : alts)
-    {
-        bool matched = true;
-
-        for (auto const& scheme : schemeSet) {
-            std::string reasonForMismatch;
-            if (!scheme->checkOrApply(conf, reasonForMismatch)) {
-                error << "  In security configuration " << i << ": " << reasonForMismatch << "\n";
-                matched = false;
-                break;
-            }
-        }
-
-        if (matched) {
-            anyAlternativeMatched = true;
-            break;
-        }
-        ++i;
-    }
-
-    if (!anyAlternativeMatched)
-        throw std::runtime_error(error.str());
-}
-
 }
 
 OpenAPIClient::OpenAPIClient(OpenAPIConfig config,
@@ -167,11 +133,15 @@ std::string OpenAPIClient::call(const std::string& methodIdent,
     // Throws if the http config does not fulfill any allowed scheme.
     if (method.security) {
         httpcl::log().debug("{} Checking required security schemes for method ...", debugContext);
-        checkSecurityAlternativesAndApplyApiKey(*method.security, httpConfig);
+        authHandlers_.satisfySecurity(
+            *method.security,
+            {*client_, builtUri, settings_, httpConfig});
     }
     else {
         httpcl::log().debug("{} Checking default security scheme ...", debugContext);
-        checkSecurityAlternativesAndApplyApiKey(config_.defaultSecurityScheme, httpConfig);
+        authHandlers_.satisfySecurity(
+            config_.defaultSecurityScheme,
+            {*client_, builtUri, settings_, httpConfig});
     }
 
     const auto& httpMethod = method.httpMethod;

zswag-1.9.2.dev14/libs/zswagcl/src/openapi-config.cpp

@@ -0,0 +1,14 @@
+#include <regex>
+
+#include "zswagcl/private/openapi-config.hpp"
+#include "zswagcl/export.hpp"
+#include "stx/format.h"
+
+namespace zswagcl
+{
+
+ZSWAGCL_EXPORT const std::string ZSERIO_OBJECT_CONTENT_TYPE = "application/x-zserio-object";
+ZSWAGCL_EXPORT const std::string ZSERIO_REQUEST_PART = "x-zserio-request-part";
+ZSWAGCL_EXPORT const std::string ZSERIO_REQUEST_PART_WHOLE = "*";
+
+}