fix: send profile auth headers when fetching the OpenAPI spec (supersedes #22) - #23
Merged
Conversation
…nested refs Follow-up to the auth-headers change from PR #22: - headers passed to OpenapiLoader.loadSpec() are sent only to the origins of --openapi-spec and --api-base-url; external $ref documents on any other host are fetched anonymously, so a spec cannot leak profile credentials - the resolve context now carries the auth scope into nested $ref documents, so a root -> A -> B chain behind auth loads instead of failing on B - OpenapiLoader accepts an injectable httpClient; tests use it instead of jest.mock("axios"), as the testing rules require - download failures surface as SpecFetchError with the URL and HTTP status; cli.ts turns 401/403 into a hint naming the auth flags Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This was referenced Sep 4, 2026
Contributor
|
@EvilFreelancer can we release this please? Thanks! |
Owner
Author
|
@itsyoboieltr hi! Try 0.1.21 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Supersedes #22 by @itsyoboieltr and keeps its two commits verbatim, with the original authorship. That change sent the profile credentials (
--api-basic-auth,--api-bearer-token,--custom-headers) with the OpenAPI spec download, so a spec served behind auth could finally be loaded. A cross-review (Codex, Cursor, Coddy, plus a manual reproduction against a local HTTP server) found the issues below, which are fixed on top.Added on top of #22
$refURL, so a spec referencinghttps://evil.example/schema.yamlhanded that host the user'sAuthorizationheader and custom headers. Headers now go only to the origins of--openapi-specand--api-base-url;$refdocuments on any other host are fetched anonymously. Reproduced with two local origins before the fix.$ref.resolveRefrebuilt the resolve context withoutheaders, so aroot -> A -> Bchain behind auth got 401 onB. The context now carries the auth scope through every hop. Reproduced with a three-document chain.OpenapiLoaderaccepts an optionalhttpClient; tests inject a fake instead ofjest.mock("axios"), which the project testing rules forbid. Neither test file patches the axios module any more.SpecFetchErrorwith the URL and HTTP status, andprofiles addprintsFailed to fetch OpenAPI document <url>: HTTP 401. Check --api-basic-auth, --api-bearer-token, or --custom-headers of profile <name>.profiles add --helpnow describes--openapi-specand the auth flags.Verification
npm test: 146 passed (6 new);npm run buildclean.$refarrives without any profile header; a three-hop same-origin chain loads.Known limitation, unchanged by this PR: on a cross-host redirect axios (follow-redirects) drops
Authorizationbut keeps custom headers such asx-api-key.🤖 Generated with Claude Code