Skip to content

Support cookie-backed API key security inference#3910

Merged
raphael merged 3 commits into
goadesign:v3from
CaliLuke:fix-3909-cookie-apikey-security
Mar 15, 2026
Merged

Support cookie-backed API key security inference#3910
raphael merged 3 commits into
goadesign:v3from
CaliLuke:fix-3909-cookie-apikey-security

Conversation

@CaliLuke

Copy link
Copy Markdown
Contributor

Summary

  • make HTTP security key inference consider request cookies in addition to params, headers, and body
  • add a regression test covering cookie-backed API key inference, OpenAPI v2/v3 output, and generated HTTP transport code

Testing

  • go test ./expr ./http/codegen/...

Fixes #3909

@raphael raphael left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Look great! thank you for the PR. I left a couple of minor comments that would be good to address before we can merge this in.

// IsSecurityParameter returns true if the given HTTP transport element is used
// by one of the endpoint security schemes and should therefore not be emitted
// again as a regular OpenAPI parameter.
func IsSecurityParameter(endpoint *expr.HTTPEndpointExpr, in, name string) bool {

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Might be better to keep this private, this is probably not something that the openapi package should expose.

Comment thread http/codegen/openapi/v2/builder.go Outdated
}

func paramsFromExpr(params *expr.MappedAttributeExpr, path string) []*Parameter {
return paramsFromExprForEndpoint(nil, params, path)

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can we avoid this wrapping? I don't know why LLMs insist in making these :)

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

they have their quirks! I also made a small amendment to AGENTS.md in the same commit to attempt avoiding the same type of behavior in the future.

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Awesome, thank you!

@raphael raphael merged commit 4021283 into goadesign:v3 Mar 15, 2026
7 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Support native cookie-backed APIKeySecurity for HTTP/OpenAPI

2 participants