chore(api): override default casing for bearer auth scheme #3378
Conversation
📝 WalkthroughWalkthroughUpdates normalize HTTP bearer auth scheme to lowercase across OpenAPI and TSP specs, introduce a LowercaseBearerAuth model and re-alias usages, and regenerate embedded Swagger specs in generated Go files to reflect these spec changes. No control flow or exported Go APIs changed. Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related PRs
Pre-merge checks and finishing touches✅ Passed checks (3 passed)
✨ Finishing touches
🧪 Generate unit tests
Tip 👮 Agentic pre-merge checks are now available in preview!Pro plan users can now enable pre-merge checks in their settings to enforce checklists before merging PRs.
Please see the documentation for more information. Example: reviews:
pre_merge_checks:
custom_checks:
- name: "Undocumented Breaking Changes"
mode: "warning"
instructions: |
Pass/fail criteria: All breaking changes to public APIs, CLI flags, environment variables, configuration keys, database schemas, or HTTP/GraphQL endpoints must be documented in the "Breaking Change" section of the PR description and in CHANGELOG.md. Exclude purely internal or private changes (e.g., code not exported from package entry points or explicitly marked as internal).Please share your feedback with us on this Discord post. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (3)
api/spec/src/auth.tsp (1)
9-28: Lowercase scheme implemented correctly; add a brief note to avoid confusion.No 'scheme: Bearer' occurrences found; only the doc header in api/spec/src/auth.tsp shows "Authorization: Bearer " — add this one‑liner.
* ``` * Authorization: Bearer <token> * ``` + * Note: In OpenAPI the security scheme value must be "bearer" (lowercase), while the HTTP Authorization header scheme token is case-insensitive and commonly shown as "Bearer".api/api.gen.go (1)
20590-20610: Add a tiny CI guard to prevent 'scheme: Bearer' regressions.Verified: no uppercase
scheme: Bearerunder api/; current specs use lowercasescheme: bearer(api/openapi.yaml, api/openapi.cloud.yaml). Add this lint step to CI:#!/bin/bash set -euo pipefail if rg -nP '\bscheme:\s*Bearer\b' api/; then echo 'OpenAPI must use lowercase `scheme: bearer`.' >&2 exit 1 fiapi/openapi.cloud.yaml (1)
23955-23955: Consistent lowercase "bearer" for CloudPortalTokenAuth; LGTM.Matches the above change; keeps specs consistent across auth schemes.
If applicable, mirror format hint:
# under CloudPortalTokenAuth bearerFormat: JWT
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (6)
api/api.gen.go(1 hunks)api/client/go/client.gen.go(1 hunks)api/openapi.cloud.yaml(2 hunks)api/openapi.yaml(1 hunks)api/spec/src/auth.tsp(1 hunks)api/spec/src/cloud/auth.tsp(2 hunks)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (7)
- GitHub Check: Artifacts / Container image
- GitHub Check: Lint
- GitHub Check: Migration Checks
- GitHub Check: Test
- GitHub Check: Code Generators
- GitHub Check: Build
- GitHub Check: Analyze (go)
🔇 Additional comments (7)
api/spec/src/auth.tsp (1)
7-7: Alias preserves public API surface — verified. Search found only expected occurrences: api/spec/src/auth.tsp (friendlyName "BearerAuth") and api/spec/patches/@typespec__http.patch (export list); generated code/runtime reference PortalTokenAuth/PortalTokenAuthScopes (api/api.gen.go, api/openapi.yaml, openmeter/portal/authenticator/authenticator.go). No lingering internal model named "BearerAuth" requiring changes.api/openapi.yaml (1)
24983-24989: LGTM —schemeis correctly lowercasebearer; considerbearerFormatSpec-correct:
scheme: bearerconforms to OAS 3.x.
Optional (if tokens are JWT): addbearerFormat: JWT.
Repo-wide scan couldn't be completed in sandbox (ripgrep: "No files were searched"); verify locally that there are no otherscheme: Beareroccurrences.api/api.gen.go (1)
20549-20920: LGTM: regenerated Swagger blob only; normalization verified.No functional Go changes. Verified no uppercase "Bearer" in specs; normalized "scheme: bearer" found at api/openapi.cloud.yaml:23946, api/openapi.cloud.yaml:23955, and api/openapi.yaml:24986. "LowercaseBearerAuth" not present outside TypeSpec sources.
api/openapi.cloud.yaml (1)
23946-23946: Lowercase "bearer" is correct per OpenAPI — verified.No occurrences of
scheme: Beareror"scheme": "Bearer"were found; OpenAPI/spec files usescheme: bearer(api/openapi.cloud.yaml — lines ~23946 & 23955; api/openapi.yaml — line ~24986; api/spec/src/auth.tsp).
Optional: addbearerFormat: JWTunder CloudTokenAuth/CloudPortalTokenAuth if these tokens are JWTs.api/client/go/client.gen.go (1)
43586-43959: Data-only swagger blob update — verify 'scheme: bearer' decoded correctly.Generated refresh looks fine; sandbox verification failed with "/dev/fd/63". Run the local verifier below and confirm no securitySchemes of type "http" use non-lowercase schemes (e.g. "Bearer"). File: api/client/go/client.gen.go (lines ~43586-43959).
# Run from repo root (requires python3) python3 - <<'PY' import re, sys, base64, gzip, json try: import yaml except Exception: yaml = None def extract(path): s = open(path, encoding='utf-8', errors='ignore').read() m = re.search(r'var\s+swaggerSpec\s*=\s*\[\]string\s*{\s*(.*?)\s*}\s*', s, re.S) if not m: return None segs = re.findall(r'"((?:[^"\\]|\\.)*)"', m.group(1)) if not segs: return None blob = ''.join(segs) raw = base64.b64decode(blob) for fn in (gzip.decompress,): try: return fn(raw) except Exception: pass try: import zlib return zlib.decompress(raw) except Exception: return raw def load_doc(b): text = b.decode('utf-8', errors='replace') try: return json.loads(text) except Exception: if yaml: return yaml.safe_load(text) raise paths = sys.argv[1:] or ['api/client/go/client.gen.go'] rc = 0 for p in paths: doc = extract(p) if doc is None: print(f"[skip] {p}: cannot extract swaggerSpec") rc = 1 continue try: spec = load_doc(doc) except Exception as e: print(f"[fail] {p}: could not parse spec: {e}") rc = 1 continue comps = (spec or {}).get('components', {}).get('securitySchemes', {}) or {} bad = [] ok = [] for name, val in comps.items(): if isinstance(val, dict) and val.get('type') == 'http': sch = val.get('scheme') if sch == 'bearer': ok.append(name) else: bad.append((name, sch)) print(f"==> {p}") print("HTTP schemes lowercased:", sorted(ok)) if bad: print("Non-lowercase http schemes found:", bad) rc = 1 sys.exit(rc) PYapi/spec/src/cloud/auth.tsp (2)
7-7: Lowercase bearer for CloudTokenAuth — LGTM (verified)LowercaseBearerAuth is defined; no remaining
is BearerAuthoccurrences; OpenAPI hasscheme: bearerand CloudTokenAuth resolves tohttp/bearerin api/openapi.cloud.yaml.
19-19: Lowercase bearer for CloudPortalTokenAuth — OpenAPI updated; runtime not verifiedOpenAPI: confirmed — api/openapi.cloud.yaml shows CloudPortalTokenAuth with type: http and scheme: bearer (around lines 23953–23955).
Runtime: verification incomplete — repo search returned "No files were searched" and a regex quoting error when re-running checks; cannot confirm middleware/token parser accepts "Authorization: Bearer ..." case-insensitively. Run this locally to verify runtime handling:
#!/bin/bash set -euo pipefail echo "1) Confirm OpenAPI (CloudPortalTokenAuth):" rg -n -C2 'CloudPortalTokenAuth' api/openapi*.yaml || true rg -n -C2 'scheme: bearer' api/openapi*.yaml || true echo echo "2) Search for Authorization/Bearer usage (case-insensitive):" rg -n -i -C3 'authorization|bearer' --hidden -uu --glob '!node_modules/**' || true echo echo "3) Search for code that lowercases or prefix-checks bearer (JS/TS/Go/Python):" rg -n -i -C3 'toLowerCase\(|strings\.ToLower\(|tolower\(|startsWith\(|HasPrefix\(' --hidden -uu --glob '!node_modules/**' || true
2 participants
Summary by CodeRabbit
Bug Fixes
Chores