Two security scheme shapes stop generation entirely. Neither is exotic, and neither needs to be fatal.
openIdConnect and mutualTLS
components:
securitySchemes:
oidc:
type: openIdConnect
openIdConnectUrl: https://issuer.example.com/.well-known/openid-configuration
$ go run . generate --spec spec.yaml --out ./out
Error: analyzing spec: unsupported security scheme type "openIdConnect" for "oidc"
No client at all. Any API fronted by Keycloak, Auth0, or Entra declares its schemes this way, so the whole spec is unusable over one declaration the generated code barely has to act on: at the transport level an OIDC scheme is a bearer token in an Authorization header, which is a scheme this generator already emits for type: http, scheme: bearer.
mutualTLS hits the same default branch (internal/analyzer/security.go:54). There the client cannot do anything useful, since the certificate is configured on the transport, but that argues for generating a client without an auth provider for that scheme rather than for refusing the spec.
Capitalized http scheme
components:
securitySchemes:
auth:
type: http
scheme: Bearer
Error: analyzing spec: unsupported http scheme "Bearer" for security scheme "auth"
The comparison at internal/analyzer/security.go:33-40 is case-sensitive. RFC 7235 defines auth scheme names as case-insensitive, and specs in the wild capitalize this constantly. strings.ToLower on the scheme before the switch fixes it.
Suggested behavior
openIdConnect: treat as bearer, and keep openIdConnectUrl on the IR for a doc comment naming the issuer.
mutualTLS: generate the client, no auth provider, since the transport handles it.
- Unknown scheme type or unknown
http scheme: still generate, still no provider for that scheme. Refusing a whole spec over one scheme the caller may not even be using is the harshest possible response.
- Lowercase the
http scheme before matching.
Two security scheme shapes stop generation entirely. Neither is exotic, and neither needs to be fatal.
openIdConnect and mutualTLS
No client at all. Any API fronted by Keycloak, Auth0, or Entra declares its schemes this way, so the whole spec is unusable over one declaration the generated code barely has to act on: at the transport level an OIDC scheme is a bearer token in an Authorization header, which is a scheme this generator already emits for
type: http, scheme: bearer.mutualTLShits the samedefaultbranch (internal/analyzer/security.go:54). There the client cannot do anything useful, since the certificate is configured on the transport, but that argues for generating a client without an auth provider for that scheme rather than for refusing the spec.Capitalized http scheme
The comparison at internal/analyzer/security.go:33-40 is case-sensitive. RFC 7235 defines auth scheme names as case-insensitive, and specs in the wild capitalize this constantly.
strings.ToLoweron the scheme before the switch fixes it.Suggested behavior
openIdConnect: treat as bearer, and keepopenIdConnectUrlon the IR for a doc comment naming the issuer.mutualTLS: generate the client, no auth provider, since the transport handles it.httpscheme: still generate, still no provider for that scheme. Refusing a whole spec over one scheme the caller may not even be using is the harshest possible response.httpscheme before matching.