fix: address review — fix stale docstrings, restore Accept header, add extra_headers to open_url

- Fix _open_url() docstrings in extensions.py and presets.py that
  incorrectly claimed redirect stripping behavior
- Add extra_headers parameter to open_url() so callers can pass
  additional headers (e.g. Accept) that persist across retries
- Restore Accept: application/vnd.github+json header in
  _fetch_latest_release_tag() via extra_headers

Author: mnriem

src/specify_cli/__init__.py

@@ -1724,7 +1724,11 @@ def _fetch_latest_release_tag() -> tuple[str | None, str | None]:
     from .authentication.http import open_url
 
     try:
-        with open_url(GITHUB_API_LATEST, timeout=5) as resp:
+        with open_url(
+            GITHUB_API_LATEST,
+            timeout=5,
+            extra_headers={"Accept": "application/vnd.github+json"},
+        ) as resp:
             payload = json.loads(resp.read().decode("utf-8"))
             tag = payload.get("tag_name")
             if not isinstance(tag, str) or not tag:

src/specify_cli/authentication/http.py

@@ -30,19 +30,25 @@ def build_request(url: str, extra_headers: dict[str, str] | None = None) -> urll
     return urllib.request.Request(url, headers=headers)
 
 
-def open_url(url: str, timeout: int = 10):
+def open_url(url: str, timeout: int = 10, extra_headers: dict[str, str] | None = None):
     """Open *url*, trying each configured provider's auth on failure.
 
     1. Try each configured provider's auth headers in registry order.
     2. If the request gets a 401 or 403, move to the next provider.
     3. If all providers fail (or none are configured), try unauthenticated.
     4. Any non-auth error is raised immediately.
+
+    *extra_headers* (e.g. ``Accept``) are merged into every attempt.
     """
     providers = configured_providers()
 
+    def _make_req(headers: dict[str, str]) -> urllib.request.Request:
+        if extra_headers:
+            headers = {**headers, **extra_headers}
+        return urllib.request.Request(url, headers=headers)
+
     for provider in providers:
-        headers = provider.auth_headers()
-        req = urllib.request.Request(url, headers=headers)
+        req = _make_req(provider.auth_headers())
         try:
             return urllib.request.urlopen(req, timeout=timeout)  # noqa: S310
         except urllib.error.HTTPError as exc:
@@ -53,5 +59,5 @@ def open_url(url: str, timeout: int = 10):
             raise
 
     # No configured provider worked (or none existed) — try unauthenticated.
-    req = urllib.request.Request(url)
+    req = _make_req({})
     return urllib.request.urlopen(req, timeout=timeout)  # noqa: S310

src/specify_cli/extensions.py

@@ -1554,7 +1554,7 @@ def _make_request(self, url: str):
         return build_request(url)
 
     def _open_url(self, url: str, timeout: int = 10):
-        """Open a URL with provider-based auth, stripping the header on foreign redirects.
+        """Open a URL with provider-based auth, trying each configured provider.
 
         Delegates to :func:`specify_cli.authentication.http.open_url`.
         """

src/specify_cli/presets.py

@@ -1853,7 +1853,7 @@ def _make_request(self, url: str):
         return build_request(url)
 
     def _open_url(self, url: str, timeout: int = 10):
-        """Open a URL with provider-based auth, stripping the header on foreign redirects.
+        """Open a URL with provider-based auth, trying each configured provider.
 
         Delegates to :func:`specify_cli.authentication.http.open_url`.
         """