Skip to content

openIdConnect specs and capitalized http schemes fail generation instead of producing a client #62

Description

@giraffesyo

Two security scheme shapes stop generation entirely. Neither is exotic, and neither needs to be fatal.

openIdConnect and mutualTLS

components:
  securitySchemes:
    oidc:
      type: openIdConnect
      openIdConnectUrl: https://issuer.example.com/.well-known/openid-configuration
$ go run . generate --spec spec.yaml --out ./out
Error: analyzing spec: unsupported security scheme type "openIdConnect" for "oidc"

No client at all. Any API fronted by Keycloak, Auth0, or Entra declares its schemes this way, so the whole spec is unusable over one declaration the generated code barely has to act on: at the transport level an OIDC scheme is a bearer token in an Authorization header, which is a scheme this generator already emits for type: http, scheme: bearer.

mutualTLS hits the same default branch (internal/analyzer/security.go:54). There the client cannot do anything useful, since the certificate is configured on the transport, but that argues for generating a client without an auth provider for that scheme rather than for refusing the spec.

Capitalized http scheme

components:
  securitySchemes:
    auth:
      type: http
      scheme: Bearer
Error: analyzing spec: unsupported http scheme "Bearer" for security scheme "auth"

The comparison at internal/analyzer/security.go:33-40 is case-sensitive. RFC 7235 defines auth scheme names as case-insensitive, and specs in the wild capitalize this constantly. strings.ToLower on the scheme before the switch fixes it.

Suggested behavior

  • openIdConnect: treat as bearer, and keep openIdConnectUrl on the IR for a doc comment naming the issuer.
  • mutualTLS: generate the client, no auth provider, since the transport handles it.
  • Unknown scheme type or unknown http scheme: still generate, still no provider for that scheme. Refusing a whole spec over one scheme the caller may not even be using is the harshest possible response.
  • Lowercase the http scheme before matching.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions