[BUG] bearerAuth security scheme not resulting in access_token being used to create Authorization header.

JonathanNathanson commented 4 months ago

Bug Report Checklist

[x] Have you provided a full/minimal spec to reproduce the issue?
[x] Have you validated the input using an OpenAPI validator (example)?
[x] Have you tested with the latest master to confirm the issue still exists?
[x] Have you searched for related issues/PRs?
[x] What's the actual output vs expected output?
[ ] [Optional] Sponsorship to speed up the bug fix or feature request (example)

Description

Having generated a Python client from an OpenAPI spec including the following securityscheme:

  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT

It is not possible to use the access_token configuration parameter in the resulting client. Passing it to openapi_client.Configuration on instantiation, or adding it to the instantiated object, does not result in the Authorization header being passed in requests.

openapi-generator version

7.3.0

OpenAPI declaration file content or url

  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT

Generation Details

docker run --rm \
  -v ${PWD}:/local openapitools/openapi-generator-cli generate \
  -i /local/myspecification.yaml \
  -g python \
  -o /local/client

Steps to reproduce

"""Testing the OpenAPI client."""

import openapi_client
from openapi_client.rest import ApiException
from pprint import pprint

configuration = openapi_client.Configuration(
    host="https://myapi.com/v2.5.6"
    access_token="my_token"
)

configuration.debug = True

configuration.access_token = "my_token"

with openapi_client.ApiClient(
    configuration,
) as api_client:
    api_instance = openapi_client.DefaultApi(api_client)

    try:
        api_response = api_instance.get_building_by_id(20)
        pprint(api_response)
    except ApiException as e:
        print("Exception when calling DefaultApi->get_building_by_id: %s\n" % e)

Debug output:

send: b'GET /v2.5.6/buildings/20 HTTP/1.1\r\nHost: myapi.com\r\nAccept-Encoding: identity\r\nAccept: application/json\r\nUser-Agent: OpenAPI-Generator/1.0.0/python\r\n\r\n'

Related issues/PRs

But stated fix of setting saccess_token after instantiation of the configuration class doesn't appear to work. And the issue says it was fixed in v6. Indeed, configuration.py in the generated code does seem to include the requisite fixes:

self.access_token = access_token
        """Access token
        """

...

    def auth_settings(self):
        """Gets Auth Settings dict for api client.

        :return: The Auth Settings information dict.
        """
        auth = {}
        if self.access_token is not None:
            auth['bearerAuth'] = {
                'type': 'bearer',
                'in': 'header',
                'format': 'JWT',
                'key': 'Authorization',
                'value': 'Bearer ' + self.access_token
            }
        return auth

Suggest a fix

I can't seem to trace down the code which is ignoring the auth_settings. There appears to be no other code that references auth['bearerAuth'].

fa0311 commented 4 months ago

Are these included in the schema file?

security:
- bearerAuth: []

I can't seem to trace down the code which is ignoring the auth_settings. There appears to be no other code that references auth['bearerAuth']

Probably does not generate auth['bearerAuth'] even when configured correctly. Instead, these are generated:

# ./api/default_api.py
def _get_building_by_id_serialize(
        self,
        _request_auth,
        _content_type,
        _headers,
        _host_index,
) -> RequestSerialized:
        ...
        _auth_settings: List[str] = [
            'bearerAuth'
        ]

JonathanNathanson commented 3 months ago

Yes, the scehma includes.

security:
- bearerAuth: []

So is the behaviour I'm witnessing expected? How should I use an access_token? Currently the workaround is to set the header manually.

lostiniceland commented 2 months ago

We are seing this issue as well. The client generator for Java - Spring - Webclient is not adding any "authorizations" event though they are defined. Due to this we cannot call apiClient.setBearerTocken(...)

As workaround we have to use apiClient.addDefaultHeader("Authorization", ....)

OpenAPITools / openapi-generator