zswag 1.9.1.dev6__tar.gz → 1.9.2.dev21__tar.gz

{zswag-1.9.1.dev6 → zswag-1.9.2.dev21}/.github/workflows/build-deploy.yml

@@ -48,6 +48,8 @@ jobs:
           echo "Node at $(which node): $(node -v); npm: $(npm -v)"
       - name: Checkout code
         uses: actions/checkout@v4
+        with:
+          submodules: recursive
       - name: Configure
         run: |
           python3 -m venv venv && . ./venv/bin/activate
@@ -124,8 +126,8 @@ jobs:
       if: matrix.os == 'windows-latest'
       working-directory: build
       run: |
-        # Install NASM using chocolatey (required for OpenSSL build)
-        choco install nasm -y
+        # Install NASM and jom using chocolatey (required for OpenSSL build)
+        choco install nasm jom -y
         # Add NASM to PATH for current session
         $env:PATH = "$env:PATH;C:\Program Files\NASM"
         # Verify NASM installation
@@ -155,7 +157,7 @@ jobs:
         with:
           fetch-depth: 0
           fetch-tags: true
-      
+
       - name: Setup Python
         uses: actions/setup-python@v5
         with:

{zswag-1.9.1.dev6 → zswag-1.9.2.dev21}/.gitignore

@@ -28,6 +28,8 @@ share/python-wheels/
 .installed.cfg
 *.egg
 MANIFEST
+cmake-build-*
+venv*
 
 # PyInstaller
 #  Usually these files are written by a python script from a template

zswag-1.9.2.dev21/.gitmodules

@@ -0,0 +1,3 @@
+[submodule "cmake/CPM.cmake"]
+	path = cmake/CPM.cmake
+	url = https://github.com/cpm-cmake/CPM.cmake.git

{zswag-1.9.1.dev6 → zswag-1.9.2.dev21}/CMakeLists.txt

@@ -10,7 +10,7 @@ set(CMAKE_CXX_STANDARD_REQUIRED ON)
 # without requiring CMakeLists.txt updates between releases.
 # For official releases, this value should match the git tag.
 if(NOT DEFINED ZSWAG_VERSION)
-  set(ZSWAG_VERSION 1.9.1)
+  set(ZSWAG_VERSION 1.10.0)
 endif()
 
 option(ZSWAG_BUILD_WHEELS "Enable zswag whl-output to WHEEL_DEPLOY_DIRECTORY." ON)
@@ -41,9 +41,14 @@ set (CMAKE_LIBRARY_OUTPUT_DIRECTORY "${ZSWAG_DEPLOY_DIR}")
 set (CMAKE_RUNTIME_OUTPUT_DIRECTORY "${ZSWAG_DEPLOY_DIR}")
 
 ##############
-# Dependencies via FetchContent
-
-# Include centralized dependency management
+# Dependencies via CPM (CMake Package Manager)
+
+set(CPM_DOWNLOAD_ALL ON)
+set(CPM_USE_LOCAL_PACKAGES OFF)
+# Include CPM.cmake
+if (NOT CPM_INITIALIZED)
+  add_subdirectory(cmake/CPM.cmake)
+endif ()
 include(cmake/Dependencies.cmake)
 
 ##############

{zswag-1.9.1.dev6 → zswag-1.9.2.dev21}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: zswag
-Version: 1.9.1.dev6
+Version: 1.9.2.dev21
 Summary: OpenAPI service transport layer for zserio.
 Home-page: https://github.com/klebert-engineering/zswag
 Author: Klebert Engineering
@@ -705,11 +705,13 @@ http-settings:
     basic-auth:  # Basic auth credentials for matching requests.
       user: johndoe
       keychain: keychain-service-string
+      password: cleartext-password  # alternative to keychain
     proxy:      # Proxy settings for matching requests.
       host: localhost
       port: 8888
       user: test
       keychain: ...
+      password: cleartext-password  # alternative to keychain
     cookies:    # Additional Cookies for matching requests.
       key: value
     headers:    # Additional Headers for matching requests.
@@ -717,6 +719,14 @@ http-settings:
     query:      # Additional Query parameters for matching requests.
       key: value
     api-key: value  # API Key as required by OpenAPI config - see description below.
+    oauth2:
+      clientId: my-client-id                               # For OAuth2 client-credentials auth
+      clientSecretKeychain: keychain-service-string        # Prefer a keychain entry over cleartext
+      clientSecret: cleartext-secret                       # discouraged, use keychain
+      tokenUrl: https://issuer.example.com/oauth/token     # optional override; defaults to tokenUrl from OpenAPI
+      refreshUrl: https://issuer.example.com/oauth/token   # optional override; defaults to refreshUrl from OpenAPI, then tokenUrl
+      audience: https://api.example.com/  # Optional (some providers require it)
+      scope: ["orders.read", ...]  # Optional scope override; defaults to OpenAPI setting per operation
 ```
 
 **Note:** For `proxy` configs, the credentials are optional.
@@ -965,10 +975,11 @@ constructor in C++/Python with the relevant detail.
 
 #### Component Support
 
-| Feature            | C++ Client | Python Client | OAServer | zswag.gen |
-| ------------------ | ---------- | ------------- | -------- | --------- |
-| `HTTP Basic-Auth` `HTTP Bearer-Auth` `Cookie API-Key` `Header API-Key` `Query API-Key`  | ✔️ | ✔️ | ✔️(**) | ✔️ |
-| `OpenID Connect` `OAuth2`  | ❌️ | ❌️ | ✔️(**) | ❌️ |
+| Feature                                                                                | C++ Client | Python Client | OAServer | zswag.gen |
+|----------------------------------------------------------------------------------------| ---------- | ------------- | -------- | --------- |
+| `HTTP Basic-Auth` `HTTP Bearer-Auth` `Cookie API-Key` `Header API-Key` `Query API-Key` | ✔️ | ✔️ | ✔️(**) | ✔️ |
+| `OAuth2[clientCredentials]`                                                            | ✔️ | ✔️ | ✔️(**) | ✔️ |
+| `OpenID Connect` `OAuth2[authorizationCode]` `OAuth2[implicit]` `OAuth2[password]`     | ❌️ | ❌️ | ✔️(**) | ❌️ |
 
 **(\*\*)**: The server support for all authentication schemes depends on your
 configuration of the WSGI server (Apache/Nginx/...) which wraps the zswag Flask app.

{zswag-1.9.1.dev6 → zswag-1.9.2.dev21}/README.md

@@ -690,11 +690,13 @@ http-settings:
     basic-auth:  # Basic auth credentials for matching requests.
       user: johndoe
       keychain: keychain-service-string
+      password: cleartext-password  # alternative to keychain
     proxy:      # Proxy settings for matching requests.
       host: localhost
       port: 8888
       user: test
       keychain: ...
+      password: cleartext-password  # alternative to keychain
     cookies:    # Additional Cookies for matching requests.
       key: value
     headers:    # Additional Headers for matching requests.
@@ -702,6 +704,14 @@ http-settings:
     query:      # Additional Query parameters for matching requests.
       key: value
     api-key: value  # API Key as required by OpenAPI config - see description below.
+    oauth2:
+      clientId: my-client-id                               # For OAuth2 client-credentials auth
+      clientSecretKeychain: keychain-service-string        # Prefer a keychain entry over cleartext
+      clientSecret: cleartext-secret                       # discouraged, use keychain
+      tokenUrl: https://issuer.example.com/oauth/token     # optional override; defaults to tokenUrl from OpenAPI
+      refreshUrl: https://issuer.example.com/oauth/token   # optional override; defaults to refreshUrl from OpenAPI, then tokenUrl
+      audience: https://api.example.com/  # Optional (some providers require it)
+      scope: ["orders.read", ...]  # Optional scope override; defaults to OpenAPI setting per operation
 ```
 
 **Note:** For `proxy` configs, the credentials are optional.
@@ -950,10 +960,11 @@ constructor in C++/Python with the relevant detail.
 
 #### Component Support
 
-| Feature            | C++ Client | Python Client | OAServer | zswag.gen |
-| ------------------ | ---------- | ------------- | -------- | --------- |
-| `HTTP Basic-Auth` `HTTP Bearer-Auth` `Cookie API-Key` `Header API-Key` `Query API-Key`  | ✔️ | ✔️ | ✔️(**) | ✔️ |
-| `OpenID Connect` `OAuth2`  | ❌️ | ❌️ | ✔️(**) | ❌️ |
+| Feature                                                                                | C++ Client | Python Client | OAServer | zswag.gen |
+|----------------------------------------------------------------------------------------| ---------- | ------------- | -------- | --------- |
+| `HTTP Basic-Auth` `HTTP Bearer-Auth` `Cookie API-Key` `Header API-Key` `Query API-Key` | ✔️ | ✔️ | ✔️(**) | ✔️ |
+| `OAuth2[clientCredentials]`                                                            | ✔️ | ✔️ | ✔️(**) | ✔️ |
+| `OpenID Connect` `OAuth2[authorizationCode]` `OAuth2[implicit]` `OAuth2[password]`     | ❌️ | ❌️ | ✔️(**) | ❌️ |
 
 **(\*\*)**: The server support for all authentication schemes depends on your
 configuration of the WSGI server (Apache/Nginx/...) which wraps the zswag Flask app.

zswag-1.9.2.dev21/cmake/Dependencies.cmake

@@ -0,0 +1,121 @@
+# Dependencies.cmake
+# Centralized dependency management using CPM (CMake Package Manager)
+# CPM provides better version management and diagnostics compared to raw FetchContent
+
+# =============================================================================
+# Core dependencies
+# =============================================================================
+
+# zlib
+CPMAddPackage(
+    URI "gh:madler/zlib@1.3.1"
+    OPTIONS
+        "ZLIB_BUILD_EXAMPLES OFF"
+        "BUILD_TESTING OFF")
+if(zlib_ADDED)
+    set_target_properties(zlib PROPERTIES EXCLUDE_FROM_ALL TRUE)
+    set_target_properties(zlibstatic PROPERTIES EXCLUDE_FROM_ALL TRUE)
+    # Create ZLIB::ZLIB alias if it doesn't exist
+    if(NOT TARGET ZLIB::ZLIB)
+        if(TARGET zlib)
+            add_library(ZLIB::ZLIB ALIAS zlib)
+        elseif(TARGET zlibstatic)
+            add_library(ZLIB::ZLIB ALIAS zlibstatic)
+        endif()
+    endif()
+endif()
+
+# fmt
+CPMAddPackage(
+    URI "gh:fmtlib/fmt#11.1.3"
+    OPTIONS "FMT_HEADER_ONLY OFF"
+)
+
+# spdlog
+CPMAddPackage(
+    URI "gh:gabime/spdlog@1.15.3"
+    OPTIONS
+        "SPDLOG_BUILD_TESTS OFF"
+        "SPDLOG_BUILD_EXAMPLE OFF"
+        "SPDLOG_FMT_EXTERNAL ON"
+)
+
+# yaml-cpp
+CPMAddPackage(
+    URI "gh:jbeder/yaml-cpp#aa8d4e4750ec9fe9f8cc680eb90f1b15955c817e"
+    OPTIONS
+        "YAML_CPP_BUILD_TESTS OFF"
+        "YAML_CPP_BUILD_TOOLS OFF"
+        "YAML_CPP_BUILD_CONTRIB OFF"
+)
+
+# stx
+CPMAddPackage("gh:Klebert-Engineering/stx@1.0.0")
+
+# httplib
+CPMAddPackage(
+    URI "gh:yhirose/cpp-httplib@0.15.3"
+    OPTIONS
+        "HTTPLIB_USE_CERTS_FROM_MACOSX_KEYCHAIN OFF"
+        "HTTPLIB_INSTALL OFF"
+)
+
+# OpenSSL
+set (OPENSSL_VERSION openssl-3.5.2)
+CPMAddPackage("gh:klebert-engineering/openssl-cmake@1.0.0")
+
+# pybind11 (only needed when building wheels)
+if(ZSWAG_BUILD_WHEELS)
+    CPMAddPackage("gh:pybind/pybind11@2.13.6")
+endif()
+
+# python-cmake-wheel (only needed when building wheels)
+if(ZSWAG_BUILD_WHEELS)
+    CPMAddPackage("gh:Klebert-Engineering/python-cmake-wheel@1.0.1")
+endif()
+
+# keychain
+if(ZSWAG_KEYCHAIN_SUPPORT)
+    CPMAddPackage("gh:hrantzsch/keychain@1.3.1")
+endif()
+
+# Catch2 (for testing)
+if(ZSWAG_ENABLE_TESTING)
+    CPMAddPackage(
+        URI "gh:catchorg/Catch2@3.8.1"
+        OPTIONS
+            "CATCH_INSTALL_DOCS OFF"
+            "CATCH_INSTALL_EXTRAS OFF"
+    )
+endif()
+
+# zserio-cmake-helper
+set(ZSERIO_VERSION "2.16.1")
+CPMAddPackage("gh:Klebert-Engineering/zserio-cmake-helper@1.1.4")
+# Add zserio C++ runtime target
+if(NOT TARGET ZserioCppRuntime)
+    add_zserio_cpp_runtime()
+endif()
+
+# =============================================================================
+# Configure httplib with OpenSSL and zlib support
+# =============================================================================
+
+if (TARGET httplib)
+    target_compile_definitions(httplib INTERFACE CPPHTTPLIB_OPENSSL_SUPPORT)
+    target_link_libraries(httplib INTERFACE OpenSSL::SSL OpenSSL::Crypto ZLIB::ZLIB)
+endif()
+
+# =============================================================================
+# Configure python-cmake-wheel integration
+# =============================================================================
+
+if(ZSWAG_BUILD_WHEELS AND python-cmake-wheel_ADDED)
+    set(CMAKE_MODULE_PATH "${python-cmake-wheel_SOURCE_DIR}" ${CMAKE_MODULE_PATH})
+    
+    if(NOT TARGET wheel)
+        set(Python3_FIND_STRATEGY LOCATION)
+        include(python-wheel)
+        set(WHEEL_DEPLOY_DIRECTORY "${ZSWAG_DEPLOY_DIR}/wheel")
+    endif()
+endif()

{zswag-1.9.1.dev6 → zswag-1.9.2.dev21}/libs/httpcl/include/httpcl/http-settings.hpp

@@ -46,6 +46,16 @@ struct Config
         std::string keychain;
     };
 
+    struct OAuth2 {
+        std::string clientId;
+        std::string clientSecret;
+        std::string clientSecretKeychain;
+        std::string tokenUrlOverride; // optional
+        std::string refreshUrlOverride; // optional
+        std::string audience; // optional
+        std::vector<std::string> scopesOverride; // optional
+    };
+
     std::optional<std::string> scope;
     std::regex urlPattern;
     std::string urlPatternString;
@@ -53,6 +63,7 @@ struct Config
     std::map<std::string, std::string> cookies;
     std::optional<BasicAuthentication> auth;
     std::optional<Proxy> proxy;
+    std::optional<OAuth2> oauth2;
     std::optional<std::string> apiKey;
     Headers headers;
     Query query;

{zswag-1.9.1.dev6 → zswag-1.9.2.dev21}/libs/httpcl/src/http-settings.cpp

@@ -180,6 +180,25 @@ YAML::Node configToNode(Config const& config) {
     if (config.apiKey)
         result["api-key"] = *config.apiKey;
 
+    if (config.oauth2) {
+        YAML::Node oauth2Node;
+        if (!config.oauth2->clientId.empty())
+            oauth2Node["clientId"] = config.oauth2->clientId;
+        if (!config.oauth2->clientSecret.empty())
+            oauth2Node["clientSecret"] = config.oauth2->clientSecret;
+        if (!config.oauth2->clientSecretKeychain.empty())
+            oauth2Node["clientSecretKeychain"] = config.oauth2->clientSecretKeychain;
+        if (!config.oauth2->tokenUrlOverride.empty())
+            oauth2Node["tokenUrl"] = config.oauth2->tokenUrlOverride;
+        if (!config.oauth2->refreshUrlOverride.empty())
+            oauth2Node["refreshUrl"] = config.oauth2->refreshUrlOverride;
+        if (!config.oauth2->audience.empty())
+            oauth2Node["audience"] = config.oauth2->audience;
+        if (!config.oauth2->scopesOverride.empty())
+            oauth2Node["scopes"] = config.oauth2->scopesOverride;
+        result["oauth2"] = oauth2Node;
+    }
+
     return result;
 }
 
@@ -221,6 +240,27 @@ Config configFromNode(YAML::Node const& node)
     if (auto apiKey = node["api-key"])
         conf.apiKey = apiKey.as<std::string>();
 
+    if (auto oauth2Node = node["oauth2"]) {
+        Config::OAuth2 oauth2;
+        if (auto v = oauth2Node["clientId"])
+            oauth2.clientId = v.as<std::string>();
+        if (auto v = oauth2Node["clientSecret"])
+            oauth2.clientSecret = v.as<std::string>();
+        if (auto v = oauth2Node["clientSecretKeychain"])
+            oauth2.clientSecretKeychain = v.as<std::string>();
+        if (auto v = oauth2Node["tokenUrl"])
+            oauth2.tokenUrlOverride = v.as<std::string>();
+        if (auto v = oauth2Node["refreshUrl"])
+            oauth2.refreshUrlOverride = v.as<std::string>();
+        if (auto v = oauth2Node["audience"])
+            oauth2.audience = v.as<std::string>();
+        if (auto v = oauth2Node["scope"]) {
+            for (auto const& scope : v)
+                oauth2.scopesOverride.emplace_back(scope.as<std::string>());
+        }
+        conf.oauth2 = oauth2;
+    }
+
     return conf;
 }
 }
@@ -520,5 +560,23 @@ Config& Config::operator |= (Config const& other) {
         proxy = other.proxy;
     if (other.apiKey)
         apiKey = other.apiKey;
+    if (other.oauth2) {
+        if (!oauth2)
+            oauth2.emplace();
+        if (!other.oauth2->clientId.empty())
+            oauth2->clientId = other.oauth2->clientId;
+        if (!other.oauth2->clientSecretKeychain.empty())
+            oauth2->clientSecretKeychain = other.oauth2->clientSecretKeychain;
+        if (!other.oauth2->clientSecret.empty())
+            oauth2->clientSecret = other.oauth2->clientSecret;
+        if (!other.oauth2->tokenUrlOverride.empty())
+            oauth2->tokenUrlOverride = other.oauth2->tokenUrlOverride;
+        if (!other.oauth2->refreshUrlOverride.empty())
+            oauth2->refreshUrlOverride = other.oauth2->refreshUrlOverride;
+        if (!other.oauth2->audience.empty())
+            oauth2->audience = other.oauth2->audience;
+        if (!other.oauth2->scopesOverride.empty())
+            oauth2->scopesOverride = other.oauth2->scopesOverride;
+    }
     return *this;
 }

{zswag-1.9.1.dev6 → zswag-1.9.2.dev21}/libs/zswag.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: zswag
-Version: 1.9.1.dev6
+Version: 1.9.2.dev21
 Summary: OpenAPI service transport layer for zserio.
 Home-page: https://github.com/klebert-engineering/zswag
 Author: Klebert Engineering
@@ -705,11 +705,13 @@ http-settings:
     basic-auth:  # Basic auth credentials for matching requests.
       user: johndoe
       keychain: keychain-service-string
+      password: cleartext-password  # alternative to keychain
     proxy:      # Proxy settings for matching requests.
       host: localhost
       port: 8888
       user: test
       keychain: ...
+      password: cleartext-password  # alternative to keychain
     cookies:    # Additional Cookies for matching requests.
       key: value
     headers:    # Additional Headers for matching requests.
@@ -717,6 +719,14 @@ http-settings:
     query:      # Additional Query parameters for matching requests.
       key: value
     api-key: value  # API Key as required by OpenAPI config - see description below.
+    oauth2:
+      clientId: my-client-id                               # For OAuth2 client-credentials auth
+      clientSecretKeychain: keychain-service-string        # Prefer a keychain entry over cleartext
+      clientSecret: cleartext-secret                       # discouraged, use keychain
+      tokenUrl: https://issuer.example.com/oauth/token     # optional override; defaults to tokenUrl from OpenAPI
+      refreshUrl: https://issuer.example.com/oauth/token   # optional override; defaults to refreshUrl from OpenAPI, then tokenUrl
+      audience: https://api.example.com/  # Optional (some providers require it)
+      scope: ["orders.read", ...]  # Optional scope override; defaults to OpenAPI setting per operation
 ```
 
 **Note:** For `proxy` configs, the credentials are optional.
@@ -965,10 +975,11 @@ constructor in C++/Python with the relevant detail.
 
 #### Component Support
 
-| Feature            | C++ Client | Python Client | OAServer | zswag.gen |
-| ------------------ | ---------- | ------------- | -------- | --------- |
-| `HTTP Basic-Auth` `HTTP Bearer-Auth` `Cookie API-Key` `Header API-Key` `Query API-Key`  | ✔️ | ✔️ | ✔️(**) | ✔️ |
-| `OpenID Connect` `OAuth2`  | ❌️ | ❌️ | ✔️(**) | ❌️ |
+| Feature                                                                                | C++ Client | Python Client | OAServer | zswag.gen |
+|----------------------------------------------------------------------------------------| ---------- | ------------- | -------- | --------- |
+| `HTTP Basic-Auth` `HTTP Bearer-Auth` `Cookie API-Key` `Header API-Key` `Query API-Key` | ✔️ | ✔️ | ✔️(**) | ✔️ |
+| `OAuth2[clientCredentials]`                                                            | ✔️ | ✔️ | ✔️(**) | ✔️ |
+| `OpenID Connect` `OAuth2[authorizationCode]` `OAuth2[implicit]` `OAuth2[password]`     | ❌️ | ❌️ | ✔️(**) | ❌️ |
 
 **(\*\*)**: The server support for all authentication schemes depends on your
 configuration of the WSGI server (Apache/Nginx/...) which wraps the zswag Flask app.

{zswag-1.9.1.dev6 → zswag-1.9.2.dev21}/libs/zswag.egg-info/SOURCES.txt

@@ -1,5 +1,6 @@
 .clang-format
 .gitignore
+.gitmodules
 CMakeLists.txt
 LICENSE
 README.md
@@ -10,7 +11,6 @@ setup.py
 .github/scripts/validate_version.py
 .github/workflows/build-deploy.yml
 cmake/Dependencies.cmake
-cmake/OpenSSL.cmake
 doc/zswag-architecture.mdj
 doc/zswag-architecture.png
 libs/httpcl/CMakeLists.txt
@@ -60,23 +60,31 @@ libs/zswagcl/include/zswagcl/export.hpp
 libs/zswagcl/include/zswagcl/oaclient.hpp
 libs/zswagcl/include/zswagcl/private/openapi-client.hpp
 libs/zswagcl/include/zswagcl/private/openapi-config.hpp
+libs/zswagcl/include/zswagcl/private/openapi-oauth.hpp
 libs/zswagcl/include/zswagcl/private/openapi-parameter-helper.hpp
 libs/zswagcl/include/zswagcl/private/openapi-parser.hpp
+libs/zswagcl/include/zswagcl/private/openapi-security.hpp
 libs/zswagcl/src/base64.cpp
 libs/zswagcl/src/base64.hpp
 libs/zswagcl/src/oaclient.cpp
 libs/zswagcl/src/openapi-client.cpp
 libs/zswagcl/src/openapi-config.cpp
+libs/zswagcl/src/openapi-oauth.cpp
 libs/zswagcl/src/openapi-parameter-helper.cpp
 libs/zswagcl/src/openapi-parser.cpp
+libs/zswagcl/src/openapi-security.cpp
 libs/zswagcl/test/CMakeLists.txt
 libs/zswagcl/test/src/base64.cpp
 libs/zswagcl/test/src/http-service-format.cpp
 libs/zswagcl/test/src/main.cpp
 libs/zswagcl/test/src/oaclient.cpp
+libs/zswagcl/test/src/oauth2-integration-test.cpp
+libs/zswagcl/test/src/oauth2-test.cpp
 libs/zswagcl/test/src/openapi-parameter-helper.cpp
 libs/zswagcl/test/src/service_client_test.zs
 libs/zswagcl/test/testdata/auth.yaml
 libs/zswagcl/test/testdata/config-template.json
 libs/zswagcl/test/testdata/config-with-auth.json
-libs/zswagcl/test/testdata/dummy.json
+libs/zswagcl/test/testdata/dummy.json
+libs/zswagcl/test/testdata/oauth2-openapi.yaml
+libs/zswagcl/test/testdata/oauth2-settings.yaml

{zswag-1.9.1.dev6 → zswag-1.9.2.dev21}/libs/zswag.egg-info/requires.txt

@@ -1,4 +1,4 @@
-pyzswagcl==1.9.1.dev6
+pyzswagcl==1.9.2.dev21
 connexion~=2.14.2
 requests
 zserio<3.0.0

{zswag-1.9.1.dev6 → zswag-1.9.2.dev21}/libs/zswagcl/CMakeLists.txt

@@ -10,13 +10,17 @@ add_library(zswagcl SHARED
   include/zswagcl/private/openapi-parameter-helper.hpp
   include/zswagcl/private/openapi-parser.hpp
   include/zswagcl/oaclient.hpp
+  include/zswagcl/private/openapi-security.hpp
+  include/zswagcl/private/openapi-oauth.hpp
 
   src/base64.cpp
   src/openapi-client.cpp
   src/openapi-config.cpp
   src/openapi-parameter-helper.cpp
   src/openapi-parser.cpp
-  src/oaclient.cpp)
+  src/openapi-security.cpp
+  src/oaclient.cpp
+  src/openapi-oauth.cpp)
 
 target_link_libraries(zswagcl
   PUBLIC

{zswag-1.9.1.dev6 → zswag-1.9.2.dev21}/libs/zswagcl/include/zswagcl/private/openapi-client.hpp

@@ -5,6 +5,7 @@
 #include "openapi-parser.hpp"
 #include "openapi-config.hpp"
 #include "openapi-parameter-helper.hpp"
+#include "openapi-security.hpp"
 
 #include "httpcl/uri.hpp"
 #include "httpcl/http-client.hpp"
@@ -17,6 +18,7 @@ class OpenAPIClient
 public:
     OpenAPIConfig config_;
     httpcl::Config httpConfig_;
+    AuthRegistry authHandlers_;
 
     OpenAPIClient(OpenAPIConfig config,
                   httpcl::Config httpConfig,

{zswag-1.9.1.dev6 → zswag-1.9.2.dev21}/libs/zswagcl/include/zswagcl/private/openapi-config.hpp

@@ -21,46 +21,45 @@ struct OpenAPIConfig
         Header
     };
 
-    struct SecurityScheme {
-        std::string id;
-        explicit SecurityScheme(std::string id);
-        virtual ~SecurityScheme() = default;
-        virtual bool checkOrApply(httpcl::Config& config, std::string& err) const = 0;
+    enum class SecuritySchemeType {
+        HttpBasic,
+        HttpBearer,
+        ApiKeyQuery,
+        ApiKeyHeader,
+        ApiKeyCookie,
+        OAuth2ClientCredentials
     };
 
+    struct SecurityScheme
+    {
+        SecuritySchemeType type;
+        std::string oauthTokenUrl; // For oauth2
+        std::string oauthRefreshUrl; // For oauth2
+        std::map<std::string, std::string> oauthScopes; // Scope -> Description
+        std::string apiKeyName; // Header/Query/Cookie name
+        std::string id; // Scheme name for introspection/debugging
+    };
     using SecuritySchemePtr = std::shared_ptr<SecurityScheme>;
 
     /**
-     * Security Scheme References
+     * Security Scheme References by operations.
      *
      * Disjunctive normal form ([A [AND B]+][ OR C [AND D]+]+) of required
      * security schemes. An empty vector is used to encode that no auth
      * scheme is required.
      */
-    using SecurityAlternatives = std::vector<std::vector<SecuritySchemePtr>>;
+    struct SecurityRequirement
+    {
+        SecuritySchemePtr scheme;
+        // For each operation, a subset of scopes may be defined which are required for it.
+        std::vector<std::string> scopes;
+    };
+    using SecurityAlternative = std::vector<SecurityRequirement>;
+    using SecurityAlternatives = std::vector<SecurityAlternative>;
 
     /**
      * Supported Authentication Schemes
      */
-    struct BasicAuth : public SecurityScheme {
-        explicit BasicAuth(std::string id);
-        bool checkOrApply(httpcl::Config& config, std::string& err) const override;
-    };
-    struct BearerAuth : public SecurityScheme {
-        explicit BearerAuth(std::string id);
-        bool checkOrApply(httpcl::Config& config, std::string& err) const override;
-    };
-    struct APIKeyAuth : public SecurityScheme {
-        explicit APIKeyAuth(std::string id, ParameterLocation location, std::string keyName);
-        bool checkOrApply(httpcl::Config& config, std::string& err) const override;
-        ParameterLocation location = ParameterLocation::Header;
-        std::string keyName;
-    };
-    struct CookieAuth : public SecurityScheme {
-        explicit CookieAuth(std::string id, std::string cookieName);
-        bool checkOrApply(httpcl::Config& config, std::string& err) const override;
-        std::string cookieName;
-    };
 
     struct Parameter {
         ParameterLocation location = ParameterLocation::Query;

zswag-1.9.2.dev21/libs/zswagcl/include/zswagcl/private/openapi-oauth.hpp

@@ -0,0 +1,60 @@
+#pragma once
+
+#include "openapi-security.hpp"
+
+namespace zswagcl
+{
+
+class OAuth2ClientCredentialsHandler final : public ISecurityHandler
+{
+public:
+    bool satisfy(
+        const OpenAPIConfig::SecurityRequirement& req,
+        AuthContext const& ctx,
+        std::string& mismatchReason) override;
+
+private:
+    // OAuth2 grant type constants
+    static constexpr const char* GRANT_TYPE_CLIENT_CREDENTIALS = "client_credentials";
+    static constexpr const char* GRANT_TYPE_REFRESH_TOKEN = "refresh_token";
+    
+    struct TokenKey
+    {
+        std::string tokenUrl, clientId, audience, scopeKey;
+        bool operator==(const TokenKey& o) const
+        {
+            return tokenUrl == o.tokenUrl && clientId == o.clientId && audience == o.audience &&
+                scopeKey == o.scopeKey;
+        }
+    };
+
+    struct TokenKeyHash
+    {
+        size_t operator()(const TokenKey& k) const
+        {
+            std::hash<std::string> H;
+            return H(k.tokenUrl) ^ H(k.clientId) ^ H(k.audience) ^ H(k.scopeKey);
+        }
+    };
+
+    struct MintedToken
+    {
+        std::string accessToken;
+        std::string refreshToken;  // may be empty (most CC flows don’t return one)
+        std::chrono::steady_clock::time_point expiresAt;
+    };
+
+    std::shared_mutex m_;
+    std::unordered_map<TokenKey, MintedToken, TokenKeyHash> cache_;
+
+    // Method for both token fetch and refresh requests
+    MintedToken requestToken(
+        AuthContext const& httpCtx,
+        const httpcl::Config::OAuth2& oauthConfig,
+        const std::string& resolvedTokenUrl,
+        const std::string& grantType,
+        const std::vector<std::string>& resolvedScopes = {},
+        const std::string& refreshToken = "");
+};
+
+}  // namespace zswagcl