Detect query-located API keys; drop unrenderable auth strategies

An apiKey with in=query (Viator's legacy ?apiKey=) reached the add flow as a method with a '(query)' label and zero placements — an empty, unfillable card that would register as a no-auth method. Query keys now become real query placements end to end (the invoke layer always knew how to render them). Cookie-located schemes stop producing methods entirely: placements carry header|query only, and a cookie scheme is usually the vendor console's own session, not a mintable credential.

Rhys Sullivan committed 2 months ago

Commit bcaf9e11 parent 12ae0913 files · +83 −21Browse files

Showing the changes to packages/plugins/openapi/src (3 of 3 files). Show all

Unified · Split

3 files

packages/plugins/openapi/src/sdk/derive-auth.test.ts +42 −0
packages/plugins/openapi/src/sdk/derive-auth.ts +24 −11
packages/plugins/openapi/src/sdk/preview.ts +17 −10

packages/plugins/openapi/src/sdk/derive-auth.test.ts+42−0

@@ -71,3 +71,45 @@ describe("detectedAuthenticationTemplates", () => { · 70 unmodified lines
71	).toEqual(["OAuth2 Authorization Code · oauth_app", "OAuth2 Client Credentials · oauth_app"]);	71	).toEqual(["OAuth2 Authorization Code · oauth_app", "OAuth2 Client Credentials · oauth_app"]);
72	});	72	});
73	});	73	});
		74
		75	describe("query-located api keys", () => {
		76	it("a query apiKey preset places the secret in the query string", () => {
		77	const templates = detectedAuthenticationTemplates(
		78	[
		79	{
		80	label: "Legacy-API-key (query)",
		81	headers: {},
		82	secretHeaders: [],
		83	secretQueryParams: ["apiKey"],
		84	},
		85	],
		86	[],
		87	"https://example.com",
		88	);
		89	expect(templates).toHaveLength(1);
		90	const template = templates[0];
		91	expect(template?.kind).toBe("apikey");
		92	expect(template?.kind === "apikey" ? template.placements : []).toEqual([
		93	{ carrier: "query", name: "apiKey" },
		94	]);
		95	});
		96
		97	it("a strategy mixing a header and a query param asks for two inputs", () => {
		98	const templates = detectedAuthenticationTemplates(
		99	[
		100	{
		101	label: "exp-api-key + apiKey (query)",
		102	headers: { "exp-api-key": null },
		103	secretHeaders: ["exp-api-key"],
		104	secretQueryParams: ["apiKey"],
		105	},
		106	],
		107	[],
		108	"https://example.com",
		109	);
		110	const template = templates[0];
		111	const placements = template?.kind === "apikey" ? template.placements : [];
		112	expect(placements.map((placement) => placement.carrier)).toEqual(["header", "query"]);
		113	expect(new Set(placements.map((placement) => placement.variable)).size).toBe(2);
		114	});
		115	});

packages/plugins/openapi/src/sdk/derive-auth.ts+24−11

   preset: HeaderPreset,
   slug: AuthTemplateSlug,
 ): APIKeyAuthentication => {
-  const variables = variablesForHeaders(preset.secretHeaders);
+  const secretQueryParams = preset.secretQueryParams ?? [];
+  // One variable namespace across carriers, so a strategy sending two secrets
+  // (a header and a query param) asks for two distinct inputs.
+  const variables = variablesForHeaders([...preset.secretHeaders, ...secretQueryParams]);
   return {
     slug,
     kind: "apikey",
-    placements: preset.secretHeaders.map((headerName) => {
+    placements: [
-      const prefix = headerPrefix(preset, headerName);
+      ...preset.secretHeaders.map((headerName) => {
-      const variable = variables.get(headerName);
+        const prefix = headerPrefix(preset, headerName);
-      return {
+        const variable = variables.get(headerName);
-        carrier: "header" as const,
+        return {
-        name: headerName,
+          carrier: "header" as const,
-        ...(prefix ? { prefix } : {}),
+          name: headerName,
-        ...(variable ? { variable } : {}),
+          ...(prefix ? { prefix } : {}),
-      };
+          ...(variable ? { variable } : {}),
-    }),
+        };
+      }),
+      ...secretQueryParams.map((paramName) => {
+        const variable = variables.get(paramName);
+        return {
+          carrier: "query" as const,
+          name: paramName,
+          ...(variable ? { variable } : {}),
+        };
+      }),
+    ],
   };
 };

packages/plugins/openapi/src/sdk/preview.ts+17−10

   headers: Schema.Record(Schema.String, Schema.NullOr(Schema.String)),
   /** Which headers should be stored as secrets */
   secretHeaders: Schema.Array(Schema.String),
+  /** Query parameters the strategy sends the secret in (apiKey in=query,
+   *  e.g. Viator's legacy `?apiKey=`). Absent on older stored previews. */
+  secretQueryParams: Schema.optional(Schema.Array(Schema.String)),
 });
 export type HeaderPreset = typeof HeaderPreset.Type;
     const headers: Record<string, string | null> = {};
     const secretHeaders: string[] = [];
+    const secretQueryParams: string[] = [];
     const labelParts: string[] = [];
     for (const scheme of resolved) {
         headers[headerName] = null;
         secretHeaders.push(headerName);
         labelParts.push(scheme.name);
+      } else if (scheme.type === "apiKey" && Option.getOrElse(scheme.in, () => "") === "query") {
+        secretQueryParams.push(Option.getOrElse(scheme.headerName, () => scheme.name));
+        labelParts.push(`${scheme.name} (query)`);
       } else if (scheme.type === "apiKey") {
-        labelParts.push(`${scheme.name} (${Option.getOrElse(scheme.in, () => "unknown")})`);
+        // Cookie (and unknown) locations are not renderable as a stored
+        // method — auth placements carry header|query — and a cookie scheme
+        // is usually the vendor console's own session, not a mintable
+        // credential. Contributing a label here used to produce a method
+        // with zero placements: an empty, unfillable card in the add flow.
+        continue;
       } else if (scheme.type === "oauth2" || scheme.type === "openIdConnect") {
         return [];
       } else {
       }
     }
-    if (Object.keys(headers).length === 0 && resolved.length > 0) {
+    // A strategy in which nothing is renderable (cookie-only, or an exotic
-      return [
+    // scheme type) yields no preset rather than an empty one.
-        HeaderPreset.make({
+    if (secretHeaders.length === 0 && secretQueryParams.length === 0) return [];
-          label: labelParts.join(" + "),
-          headers: {},
-          secretHeaders: [],
-        }),
-      ];
-    }
     return [
       HeaderPreset.make({
         label: labelParts.join(" + "),
         headers,
         secretHeaders,
+        ...(secretQueryParams.length > 0 ? { secretQueryParams } : {}),
       }),
     ];
   });

Detect query-located API keys; drop unrenderable auth strategies

Keyboard shortcuts

General

Issues and pull requests

Issues, pull requests and Inbox

Repository code