mirror of
https://github.com/mvanhorn/cli-printing-press.git
synced 2026-09-14 15:38:08 +08:00
Trevin Chow
75ad9cdbde
* feat(cli): infer auth from spec description when securitySchemes missing Third-tier fallback in the auth detection pipeline: when both selectSecurityScheme and inferQueryParamAuth produce nothing, scan info.description for auth keywords. Bifurcates by keyword type: - Bearer keywords (bearer, access token, auth token) → bearer_token with _TOKEN env var suffix - API-key keywords (api key, api_key, sk_live_, cal_live_) → api_key with _API_KEY env var suffix Includes negation guard: skips matches near "not", "no", "without", "unnecessary", "optional" to avoid false positives on descriptions like "does not require Bearer authentication". Adds Auth.Inferred bool field to AuthConfig so downstream templates can annotate inferred auth. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * feat(cli): annotate inferred auth in config and doctor templates config.go.tmpl: adds a Go comment above the env var block when Auth.Inferred is true, so developers reading the generated code know auth was guessed from the spec description. doctor.go.tmpl: reports inferred auth as WARN with "inferred (configured — verify this is correct)" or "inferred (not configured)" with a hint to set the env var. This makes the inference visible at runtime (doctor output), not just in source code. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix(cli): scorer recognizes inferred auth when securitySchemes absent evaluateAuthProtocol returned unscored when SecurityRequirements was empty. Since inference fires precisely when securitySchemes are absent, inferred-auth CLIs were always unscored — contradicting R6. Now checks config.go for os.Getenv patterns as a fallback signal. If env var support exists without securitySchemes, scores based on what the CLI actually has: env var support (+4), auth header in client (+3), inferred annotation (+1). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix(cli): scorer auth detection, word-boundary negation, doctor hint Three fixes from Codex review: 1. Scorer: check for auth-specific env var patterns (_API_KEY, _TOKEN) instead of any os.Getenv. The BASE_URL env var is always present and was causing genuinely unauthenticated CLIs to score auth points. 2. Negation: use word-boundary matching so "Notion" doesn't falsely trigger the "no" negation check. Checks char before/after the negation word for space, comma, period, or string boundary. 3. Doctor: hints user to verify both header and env var for inferred auth, since the header defaults to Authorization which may be wrong for APIs expecting X-API-Key or similar. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix(cli): scorer uses inferred marker not env vars, extract custom header names Two fixes from Codex adversarial review: 1. Scorer: use "Auth inferred" comment in config.go as the discriminator, not env var name patterns. inferQueryParamAuth also produces _API_KEY env vars for query-param auth — scoring those as inferred header auth penalized correct query-param implementations. Now only scores the inferred path when the explicit marker is present. 2. Header detection: scan description for common custom header names (X-Api-Key, X-Auth-Token, X-Access-Token) before defaulting to Authorization. A spec saying "send your API key in X-Api-Key" now produces Header="X-Api-Key" instead of the wrong "Authorization". Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * feat(skills): pre-generation auth enrichment from research intelligence When sniff/crowd-sniff produces a spec with no auth but Phase 1 research found auth signals (MCP source, research brief, user confirmation), the skill now enriches the spec YAML before running generate — not after. This ensures all templates (config, client, doctor, auth, README) produce correct auth from the start, instead of the old approach that patched only config.go post-generation and missed doctor checks, client headers, README sections, and auth command setup. The post-generation auth check remains as a safety net for cases where enrichment was missed. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix(cli): scan past negated keyword matches, score custom auth headers Two fixes from Codex review: 1. Parser: findUnnegated() scans ALL occurrences of a keyword, not just the first. "sandbox does not require bearer, but production uses a bearer token" now correctly infers auth from the second mention. 2. Scorer: recognize custom auth headers (X-Api-Key, X-Auth-Token, X-Access-Token) alongside Authorization when scoring inferred auth. Without this, CLIs with correctly inferred custom-header auth were under-scored. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * test(cli): add scorer and precedence tests for auth inference Fills test coverage gaps identified during dogfood: Scorer tests (3): - Inferred auth with marker → scored (not N/A) - Query-param auth without marker → stays unscored (not penalized) - Inferred auth with custom header X-Api-Key → scored Parser precedence tests (2): - Explicit securitySchemes wins over description keywords (gmail.yaml) - Query-param auth (tier 2) wins over description (tier 3) when both could match — tier 2 returns api_key/query, not bearer_token/header Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
32 lines
733 B
YAML
32 lines
733 B
YAML
openapi: "3.0.0"
|
|
info:
|
|
title: Bearer Auth API
|
|
version: "1.0.0"
|
|
description: >
|
|
This API uses Bearer token authentication. Include your API key in
|
|
the Authorization header as a Bearer token. Get your key from the
|
|
dashboard at https://example.com/settings/api-keys.
|
|
servers:
|
|
- url: https://api.example.com/v1
|
|
paths:
|
|
/v1/users:
|
|
get:
|
|
operationId: getUsers
|
|
summary: List users
|
|
responses:
|
|
"200":
|
|
description: OK
|
|
/v1/users/{id}:
|
|
get:
|
|
operationId: getUser
|
|
summary: Get user by ID
|
|
parameters:
|
|
- name: id
|
|
in: path
|
|
required: true
|
|
schema:
|
|
type: string
|
|
responses:
|
|
"200":
|
|
description: OK
|