fix(elixir): apply configured authenticator instead of silently dropping it

BaseApi read the authenticator's auth_headers/query_params/cookie_params as
struct fields gated on Map.has_key?, but every authenticator exposes them as
behaviour callbacks, not struct keys. The guard was always false, so a
configured Bearer/api-key/cookie credential never reached the wire and every
authenticated call went out unauthenticated. Dispatch the callbacks through the
authenticator's module (function_exported?-guarded), keeping a plain-map
fast-path for map-shaped auth.

Add a real-struct auth-applied regression test (and a configured-authenticator
guard) to all 12 SDK test suites; the other 11 already applied auth correctly.

Author: mridang

src/main/resources/templates/csharp/test/Api/PetApiTest.mustache

@@ -535,6 +535,30 @@ public class PetApiTest
         Assert.Equal("Bearer per-call-token", client.CapturedHeaders["Authorization"]);
     }
 
+    [Fact]
+    public async Task TestConfiguredAuthenticatorIsAppliedToSecuredOperation()
+    {
+        // AUTH-APPLIED regression guard (Wave A1): a configured BearerAuthenticator
+        // must actually be applied to a SECURED operation's outbound request. This
+        // mirrors the Elixir bug where a configured authenticator was silently
+        // dropped and the request went out unauthenticated. Construct a client with
+        // a real BearerAuthenticator (not a raw default header), issue a request
+        // through the secured AddPet operation, and assert the wire request carried
+        // the Authorization credential.
+        var client = new HeaderCapturingApiClient();
+        var config = Configuration.Builder()
+            .BaseUrl("http://localhost")
+            .Build();
+        var api = new PetApi(client, config);
+        var authenticator = new BearerAuthenticator("http://localhost", "applied-token");
+
+        var pet = new Pet("AppliedDog", new HashSet<string> { "http://example.com/p.jpg" }) { Id = 1L };
+        await api.AddPetAsync(pet, new AddPetOptions { Auth = authenticator });
+
+        Assert.True(client.CapturedHeaders.ContainsKey("Authorization"));
+        Assert.Equal("Bearer applied-token", client.CapturedHeaders["Authorization"]);
+    }
+
     [Fact]
     public async Task TestAddPetUsesConfiguredCredentialsWhenAuthOmitted()
     {

src/main/resources/templates/dart/test/base_api_test.mustache

@@ -407,6 +407,47 @@ void main() {
       }
     });
 
+    /* auth-applied (WAVE A1 regression guard): a CONFIGURED authenticator
+     * supplied to the client must actually be applied to a SECURED request —
+     * the outbound call must carry the credential on the wire. This is the
+     * fleet-wide guard against the Elixir bug where a configured authenticator
+     * was silently dropped. Here a real BearerAuthenticator is configured on
+     * the client, a secured operation (addPet) is invoked, and we assert the
+     * outgoing Authorization header carried the bearer token. */
+    test('configured authenticator is applied to a secured request', () async {
+      String? receivedAuth;
+      final server = await HttpServer.bind(InternetAddress.loopbackIPv4, 0);
+      server.listen((request) {
+        receivedAuth = request.headers.value('authorization');
+        request.response
+          ..statusCode = 200
+          ..headers.contentType = ContentType.json
+          ..write('{"id":1,"name":"Fido","photoUrls":[]}')
+          ..close();
+      });
+
+      try {
+        final config = ConfigurationBuilder()
+            .baseUrl('http://localhost:${server.port}')
+            .build();
+        final api = PetApi(
+            apiClient: DefaultApiClient(),
+            config: config,
+            authenticator: BearerAuthenticator(
+                host: 'http://localhost:${server.port}',
+                token: 'secret-token'));
+
+        await api.addPet(Pet(name: 'Fido', photoUrls: <String>{}),
+            const AddPetOptions());
+
+        expect(receivedAuth, equals('Bearer secret-token'),
+            reason:
+                'configured authenticator must reach the wire on a secured op');
+      } finally {
+        await server.close();
+      }
+    });
+
     test('returns null data for empty 200 response', () async {
       final client = DefaultApiClient();
       final resp = await client.sendRequest(

src/main/resources/templates/elixir/base_api.mustache

@@ -75,10 +75,9 @@ defmodule {{moduleName}}.Api.BaseApi do
     effective_auth = auth || Map.get(state, :authenticator)
 
     query_params =
-      if effective_auth && is_map(effective_auth) && Map.has_key?(effective_auth, :query_params) do
-        Map.merge(query_params, effective_auth.query_params)
-      else
-        query_params
+      case auth_credentials(effective_auth, :query_params) do
+        nil -> query_params
+        params -> Map.merge(query_params, params)
       end
 
     query_string = build_query_string(query_params)
@@ -94,50 +93,49 @@ defmodule {{moduleName}}.Api.BaseApi do
     headers = Map.merge(headers, header_params)
 
     headers =
-      if effective_auth && is_map(effective_auth) && Map.has_key?(effective_auth, :auth_headers) do
-        Map.merge(headers, effective_auth.auth_headers)
-      else
-        headers
+      case auth_credentials(effective_auth, :auth_headers) do
+        nil -> headers
+        auth_headers -> Map.merge(headers, auth_headers)
       end
 
     headers =
-      if effective_auth && is_map(effective_auth) && Map.has_key?(effective_auth, :cookie_params) do
-        cookies = effective_auth.cookie_params
-
-        if map_size(cookies) > 0 do
-          # RFC 6265 — don't URL-encode cookie name/value; most cookie
-          # parsers don't URL-decode, so `=` (base64 padding) would
-          # arrive as literal `%3D` and break JWT/session cookies.
-          # Validate and pass through raw instead.
-          cookie_str = Enum.map_join(cookies, "; ", fn {k, v} ->
-            name = to_string(k)
-            value = to_string(v)
-            unless name =~ ~r/\A[A-Za-z0-9!#$%&'*+\-.^_`|~]+\z/ do
-              raise ArgumentError,
-                    "Cookie name '#{name}' contains characters forbidden by RFC 6265"
-            end
-            unless value =~ ~r/\A[!\x23-\x2B\x2D-\x3A\x3C-\x5B\x5D-\x7E]*\z/ do
-              raise ArgumentError,
-                    "Cookie value for '#{name}' contains characters forbidden by RFC 6265"
-            end
-            "#{name}=#{value}"
-          end)
+      case auth_credentials(effective_auth, :cookie_params) do
+        nil ->
+          headers
 
-          existing = Map.get(headers, "Cookie")
+        cookies ->
+          if map_size(cookies) > 0 do
+            # RFC 6265 — don't URL-encode cookie name/value; most cookie
+            # parsers don't URL-decode, so `=` (base64 padding) would
+            # arrive as literal `%3D` and break JWT/session cookies.
+            # Validate and pass through raw instead.
+            cookie_str = Enum.map_join(cookies, "; ", fn {k, v} ->
+              name = to_string(k)
+              value = to_string(v)
+              unless name =~ ~r/\A[A-Za-z0-9!#$%&'*+\-.^_`|~]+\z/ do
+                raise ArgumentError,
+                      "Cookie name '#{name}' contains characters forbidden by RFC 6265"
+              end
+              unless value =~ ~r/\A[!\x23-\x2B\x2D-\x3A\x3C-\x5B\x5D-\x7E]*\z/ do
+                raise ArgumentError,
+                      "Cookie value for '#{name}' contains characters forbidden by RFC 6265"
+              end
+              "#{name}=#{value}"
+            end)
 
-          cookie_value =
-            if existing do
-              "#{existing}; #{cookie_str}"
-            else
-              cookie_str
-            end
+            existing = Map.get(headers, "Cookie")
 
-          Map.put(headers, "Cookie", cookie_value)
-        else
-          headers
-        end
-      else
-        headers
+            cookie_value =
+              if existing do
+                "#{existing}; #{cookie_str}"
+              else
+                cookie_str
+              end
+
+            Map.put(headers, "Cookie", cookie_value)
+          else
+            headers
+          end
       end
 
     headers = {{moduleName}}.TraceContextUtil.inject_trace_context(headers)
@@ -248,6 +246,42 @@ defmodule {{moduleName}}.Api.BaseApi do
     end
   end
 
+  # Resolve an authenticator's credentials for the given behaviour callback
+  # (:auth_headers, :query_params, or :cookie_params). Authenticators are
+  # {{moduleName}}.Auth.Authenticator behaviours: the credential providers are
+  # CALLBACK FUNCTIONS on the authenticator's module, not data fields on the
+  # struct, so they are dispatched through `effective_auth.__struct__.<cb>/1`
+  # (guarded by `function_exported?/3`, mirroring how `send_request` and the
+  # client's `set_api_client` are invoked). Returns nil when there is no
+  # authenticator or it does not implement the callback, so callers can skip
+  # the merge entirely. Reading these as struct fields would silently drop the
+  # credential — every real authenticator defstruct holds only its secret
+  # material (e.g. [:host, :token]), never an :auth_headers key.
+  defp auth_credentials(effective_auth, callback)
+       when is_map(effective_auth) and is_atom(callback) do
+    case effective_auth do
+      %{__struct__: mod} ->
+        # Real authenticators are behaviour structs: the credential providers
+        # are CALLBACK FUNCTIONS on the module, dispatched via the struct's
+        # module (guarded so a struct that doesn't implement the callback
+        # simply contributes nothing).
+        if function_exported?(mod, callback, 1) do
+          apply(mod, callback, [effective_auth])
+        else
+          nil
+        end
+
+      plain_map ->
+        # Plain-map fast-path: a map-shaped auth carries its credentials as
+        # data fields keyed by the callback name (e.g. %{auth_headers: %{...}}).
+        # Supported for lightweight/ad-hoc auth injection alongside the
+        # behaviour-struct form above.
+        Map.get(plain_map, callback)
+    end
+  end
+
+  defp auth_credentials(_effective_auth, _callback), do: nil
+
   defp throw_api_error(response) do
     code = response.status_code
     msg = "API returned status code #{code}"

src/main/resources/templates/elixir/test/api/pet_api_test.mustache

@@ -501,6 +501,29 @@ defmodule {{moduleName}}.Api.PetApiTest do
     Agent.stop(name)
   end
 
+  # auth-struct-reaches-wire (regression guard for the Elixir auth-drop bug):
+  # a REAL behaviour-struct authenticator (not a plain map) must have its
+  # credential applied to the outbound request. The previous BaseApi read
+  # `auth_headers` as a struct FIELD via `Map.has_key?`, which is always false
+  # for a behaviour struct (the credential providers are callback FUNCTIONS),
+  # so every configured authenticator was silently dropped. This pins the fix:
+  # the credential is dispatched through the struct's module and reaches the
+  # wire. A plain-map fixture (used by the tests above for override/fallback
+  # logic) would NOT catch this bug, so this case uses the generated struct.
+  test "configured BearerAuthenticator struct applies its credential to the wire" do
+    {:ok, name} = HeaderCapturingApiClient.start()
+    config = {{moduleName}}.Configuration.new(base_url: "http://localhost")
+    bearer = {{moduleName}}.Auth.BearerAuthenticator.new("http://localhost", "real-struct-token")
+    api = {{moduleName}}.Api.PetApi.new(HeaderCapturingApiClient, config, bearer)
+
+    {:ok, _result} = {{moduleName}}.Api.PetApi.delete_pet_with_http_info(api, 1)
+
+    headers = HeaderCapturingApiClient.captured_headers(name)
+    assert headers["Authorization"] == "Bearer real-struct-token"
+
+    Agent.stop(name)
+  end
+
   # binary-request-body-fidelity: setPetAvatar declares a request body of
   # type:string format:binary with declared Content-Type image/jpeg. The raw
   # bytes must reach the wire UNCHANGED — never JSON-marshaled into an int-array

src/main/resources/templates/elixir/test/base_api_test.mustache

@@ -809,17 +809,28 @@ defmodule {{moduleName}}.Api.BaseApiTest do
     end
   end
 
+  # A real authenticator: the credential providers are behaviour CALLBACKS
+  # (def auth_headers/1 ...), never struct data fields. base_api must dispatch
+  # through the module to read them; a struct that merely *names* fields
+  # :auth_headers/:query_params/:cookie_params would mask the dispatch bug.
   defmodule MapAuth do
-    defstruct [:auth_headers, :query_params, :cookie_params]
+    use {{moduleName}}.Auth.BaseAuthenticator
+
+    defstruct [:header_value]
+
+    @impl true
+    def host(%__MODULE__{} = self), do: self.header_value
+
+    # The credential provider is a behaviour CALLBACK, not a struct field.
+    # query_params/1 and cookie_params/1 fall back to the BaseAuthenticator
+    # defaults (%{}), mirroring the real BearerAuthenticator.
+    @impl true
+    def auth_headers(%__MODULE__{} = self), do: %{"X-Auth" => self.header_value}
   end
 
   test "client-level authenticator is used when no :auth opt is supplied" do
     {:ok, name} = AuthCapturingApiClient.start()
-    client_auth = %MapAuth{
-      auth_headers: %{"X-Auth" => "from-client"},
-      query_params: %{},
-      cookie_params: %{}
-    }
+    client_auth = %MapAuth{header_value: "from-client"}
     config = {{moduleName}}.Configuration.new(base_url: "http://localhost")
     state = %{config: config, api_client: AuthCapturingApiClient, authenticator: client_auth}
 
@@ -833,16 +844,8 @@ defmodule {{moduleName}}.Api.BaseApiTest do
 
   test "per-call :auth overrides client-level authenticator" do
     {:ok, name} = AuthCapturingApiClient.start()
-    client_auth = %MapAuth{
-      auth_headers: %{"X-Auth" => "from-client"},
-      query_params: %{},
-      cookie_params: %{}
-    }
-    per_call_auth = %MapAuth{
-      auth_headers: %{"X-Auth" => "from-call"},
-      query_params: %{},
-      cookie_params: %{}
-    }
+    client_auth = %MapAuth{header_value: "from-client"}
+    per_call_auth = %MapAuth{header_value: "from-call"}
     config = {{moduleName}}.Configuration.new(base_url: "http://localhost")
     state = %{config: config, api_client: AuthCapturingApiClient, authenticator: client_auth}
 
@@ -854,6 +857,86 @@ defmodule {{moduleName}}.Api.BaseApiTest do
     Agent.stop(name)
   end
 
+  # AUTH-APPLIED (Wave A1): a configured authenticator must actually be applied
+  # to a SECURED request. This is the regression guard for the Elixir bug where
+  # base_api read auth_headers/query_params/cookie_params as struct DATA FIELDS
+  # gated on Map.has_key?/2 — but those are behaviour CALLBACK FUNCTIONS on the
+  # authenticator's module, so the guard was always false and the credential was
+  # silently dropped. The test drives the real production path: a genuine
+  # authenticator struct ({{moduleName}}.Auth.BearerAuthenticator /
+  # {{moduleName}}.Auth.ApiKeyAuthenticator, whose providers are def callbacks,
+  # NOT a struct that merely names :auth_headers fields) configured on the API
+  # instance, issuing a secured operation (POST /pet), and asserting the
+  # outbound request actually carried the credential.
+
+  defmodule AuthAppliedCapturingApiClient do
+    @behaviour {{moduleName}}.ApiClient
+    use Agent
+
+    def start do
+      name = :"#{__MODULE__}-#{System.unique_integer([:positive])}"
+      {:ok, _pid} = Agent.start_link(fn -> %{headers: %{}, url: ""} end, name: name)
+      Process.put(__MODULE__, name)
+      {:ok, name}
+    end
+
+    def captured(name), do: Agent.get(name, & &1)
+
+    @impl true
+    def send_request(_method, url, headers, _body) do
+      name = Process.get(__MODULE__)
+      Agent.update(name, fn _ -> %{headers: headers, url: url} end)
+      {{! Empty body deserializes to nil for the "Pet" return type, so the }}
+      {{! secured operation completes without tripping required-field decode. }}
+      %{{moduleName}}.ApiHttpResponse{status_code: 200, body: "", headers: %{"Content-Type" => "application/json"}}
+    end
+  end
+
+  test "configured Bearer authenticator is applied to a secured operation" do
+    {:ok, name} = AuthAppliedCapturingApiClient.start()
+    config = {{moduleName}}.Configuration.new(base_url: "http://localhost")
+
+    authenticator =
+      {{moduleName}}.Auth.BearerAuthenticator.new("http://localhost", "secret-token-123")
+
+    api = {{moduleName}}.Api.PetApi.new(AuthAppliedCapturingApiClient, config, authenticator)
+
+    pet = %{{moduleName}}.Models.Pet{name: "rex", photo_urls: []}
+    _result = {{moduleName}}.Api.PetApi.add_pet(api, pet)
+
+    captured = AuthAppliedCapturingApiClient.captured(name)
+
+    assert captured.headers["Authorization"] == "Bearer secret-token-123",
+      "Configured Bearer authenticator must add the Authorization header to the secured request, got: #{inspect(captured.headers)}"
+
+    Agent.stop(name)
+  end
+
+  test "configured api-key authenticator is applied to a secured operation" do
+    {:ok, name} = AuthAppliedCapturingApiClient.start()
+    config = {{moduleName}}.Configuration.new(base_url: "http://localhost")
+
+    authenticator =
+      {{moduleName}}.Auth.ApiKeyAuthenticator.new(
+        "http://localhost",
+        "X-API-Key",
+        "key-value-456",
+        :header
+      )
+
+    api = {{moduleName}}.Api.PetApi.new(AuthAppliedCapturingApiClient, config, authenticator)
+
+    pet = %{{moduleName}}.Models.Pet{name: "rex", photo_urls: []}
+    _result = {{moduleName}}.Api.PetApi.add_pet(api, pet)
+
+    captured = AuthAppliedCapturingApiClient.captured(name)
+
+    assert captured.headers["X-API-Key"] == "key-value-456",
+      "Configured api-key authenticator must add the api-key header to the secured request, got: #{inspect(captured.headers)}"
+
+    Agent.stop(name)
+  end
+
   # Per-op server override (item #5)
 
   defmodule UrlCapturingApiClient do