Rust sdk: Basic/oauth/bearer/api_key auth unused

Dig-Doug commented 2 years ago

Preflight checklist

[X] I could not find a solution in the existing issues, docs, nor discussions.
[X] I agree to follow this project's Code of Conduct.
[X] I have read and am following this repository's Contribution Guidelines.
[ ] This issue affects my Ory Cloud project.
[X] I have joined the Ory Community Slack.
[x] I am signed up to the Ory Security Patch Newsletter.

Describe the bug

It seems like the auth related fields are completely unused. Is that expected?

Reproducing the bug

https://github.com/ory/sdk/blob/96841c725b680744240710d8e1aa78dd42a5e24c/clients/keto/rust/src/apis/configuration.rs#L19

Relevant log output

No response

Relevant configuration

No response

Version

HEAD

On which operating system are you observing this issue?

No response

In which environment are you deploying?

No response

Additional Context

A workaround is to specify the auth tokens as default headers while initialing the reqwest client.

aeneasr commented 2 years ago

It appears that those are indeed not used. Keto does not have HTTP Authorization built in - if you deploy it yourself and introduce some type of HTTP Authorization it might be required to generate the client yourself and adjust it to your security mechanisms. Unfortunately the SDK can't cover all of the different ways authorization can be done :/

Or did I misread your issue?

Dig-Doug commented 2 years ago

The main thing I want to flag is that these options are confusing because they don't work.

Looking at the generated code, it seems like the client could use the authorization config values when building the request here via the reqwest option. Alternatively, removing those fields would eliminate the confusion too.

aeneasr commented 2 years ago

That makes sense - the problem here is the openapi-generator which is apparently introducing these structs even if they're not used. The repository is: https://github.com/OpenAPITools/openapi-generator

So unfortunately we can't manually remove these definitions as they will be overwritten immediately once the automation runs. If you want, you can open an issue upstream at https://github.com/OpenAPITools/openapi-generator or see if there's any options in there that would help improve the generated code here :)

ory / sdk