fix(auth): suppress the client authenticator on security:[] operations

An operation declared `security: []` is explicitly unauthenticated, but the
generated api method passed nil/null as the auth argument, so base_api's
`auth || client_authenticator` fallback re-acquired the client credential and
attached it. That leaked the credential to endpoints the spec marks
unauthenticated — including the testEcho* operations, which reflect the request
back.

Introduce a no-auth sentinel that security:[] operations pass instead of nil.
base_api now resolves three states: the sentinel suppresses auth (no fallback),
nil falls back to the client authenticator (unchanged), and an explicit
authenticator is used as a per-call override (unchanged). Applied uniformly
across all 12 SDKs with a security-none parity test and a secured-still-works
guard. Existing tests that exercised auth through a security:[] op were
repointed at a secured op.

Author: mridang

src/main/java/io/github/mridang/codegen/generators/php/BetterPHPCodegen.java

@@ -283,6 +283,7 @@ protected List<SupportingFileSpec> getSupportingFileSpecs() {
             new SupportingFileSpec("servers.mustache", invokerFolder, "Servers.php"),
             new SupportingFileSpec("base_api.mustache", apiFolder, "BaseApi.php"),
             new SupportingFileSpec("authenticator.mustache", Path.of(SRC_BASE_PATH, "Auth").toString(), "Authenticator.php"),
+            new SupportingFileSpec("auth/no_auth.mustache", Path.of(SRC_BASE_PATH, "Auth").toString(), "NoAuth.php"),
             new SupportingFileSpec("composer.mustache", "", "composer.json"),
             new SupportingFileSpec("phpstan_neon.mustache", "", "phpstan.neon"),
             new SupportingFileSpec("rector.mustache", "", "rector.php"),

src/main/resources/templates/csharp/api/api.mustache

@@ -449,7 +449,13 @@ public class {{classname}} : BaseApi
     the last consume fires once only for two-or-more declared types. }}
 {{#consumes}}{{#-last}}{{^-first}}                requestContentType ?? "{{vendorExtensions.op.effectiveConsumes}}",{{/-first}}{{#-first}}                "{{vendorExtensions.op.effectiveConsumes}}",{{/-first}}{{/-last}}{{/consumes}}{{^consumes}}                "{{vendorExtensions.op.effectiveConsumes}}",{{/consumes}}
                 {{#returnType}}typeof({{{returnType}}}){{/returnType}}{{^returnType}}null{{/returnType}},
-                {{#hasAuthMethods}}options?.Auth{{/hasAuthMethods}}{{^hasAuthMethods}}null{{/hasAuthMethods}}
+{{! Auth argument (Wave A2). A secured operation passes the optional per-call
+    override (options?.Auth) — null there means "no override", so BaseApi falls
+    back to the client-level authenticator. An operation with NO auth methods
+    (security: []) is explicitly unauthenticated: pass the NoAuth sentinel so
+    BaseApi suppresses the client-level authenticator and attaches no credential
+    (passing null here would WRONGLY re-acquire it and leak the credential). }}
+                {{#hasAuthMethods}}options?.Auth{{/hasAuthMethods}}{{^hasAuthMethods}}NoAuth.Instance{{/hasAuthMethods}}
             )
             .ConfigureAwait(false);
     }

src/main/resources/templates/csharp/authenticator.mustache

@@ -48,3 +48,34 @@ public interface IAuthenticator
         return [];
     }
 }
+
+/// <summary>
+/// Sentinel authenticator marking an operation as explicitly unauthenticated
+/// (an operation declared <c>security: []</c> in the spec).
+///
+/// This is one of the three auth states resolved by <c>BaseApi</c>: passing
+/// <see cref="NoAuth.Instance"/> as the per-call authenticator suppresses the
+/// client-level authenticator entirely, so no credential is attached. A
+/// <see langword="null"/> authenticator, by contrast, means "no per-call
+/// override" and falls back to the client-level authenticator; a real
+/// authenticator is used as a per-call override.
+///
+/// It is identity-compared (reference equality against
+/// <see cref="Instance"/>) inside the generated client and never returns any
+/// header, query parameter, or cookie, so even if it were ever applied it
+/// would contribute no credential. It is internal to the generated client;
+/// callers never construct or see it.
+/// </summary>
+internal sealed class NoAuth : IAuthenticator
+{
+    /// <summary>The single shared no-auth sentinel instance.</summary>
+    public static readonly NoAuth Instance = new();
+
+    private NoAuth() { }
+
+    /// <inheritdoc />
+    public string GetHost() => "";
+
+    /// <inheritdoc />
+    public Dictionary<string, string> GetAuthHeaders() => [];
+}

src/main/resources/templates/csharp/base_api.mustache

@@ -79,7 +79,18 @@ public abstract class BaseApi
     {
         ArgumentNullException.ThrowIfNull(queryParams);
         ArgumentNullException.ThrowIfNull(headerParams);
-        IAuthenticator? effectiveAuth = auth ?? Authenticator;
+        /* Three-state auth resolution (the no-auth sentinel disambiguates the
+           two meanings null used to carry):
+             - auth is the NoAuth sentinel  -> the operation is explicitly
+               unauthenticated (security: []); apply NO credential and do NOT
+               fall back to the client authenticator;
+             - auth is null                 -> no per-call override on a secured
+               operation; fall back to the client-level authenticator;
+             - auth is any real authenticator -> per-call override; use it.
+           Identity (reference) comparison against NoAuth.Instance is what
+           distinguishes the sentinel from a real authenticator. */
+        IAuthenticator? effectiveAuth =
+            ReferenceEquals(auth, NoAuth.Instance) ? null : (auth ?? Authenticator);
         string url;
         if (path.StartsWith("http://", StringComparison.Ordinal) || path.StartsWith("https://", StringComparison.Ordinal))
         {

src/main/resources/templates/csharp/test/BaseApiTest.mustache

@@ -920,4 +920,92 @@ public class BaseApiTest
             null, ["application/json"], "application/json", perCallAuth);
         Assert.Equal("per-call-token", client.CapturedHeaders["X-Client-Auth"]);
     }
+
+    // ── Wave A2: client auth suppressed on security:[] operations ──
+
+    // SECURITY-NONE: an operation declared `security: []` is unauthenticated.
+    // Even when the client is configured WITH an authenticator that would
+    // attach an Authorization header, an api-key header, an api-key query
+    // parameter, and an auth cookie, none of those may appear on the outbound
+    // request for such an operation — otherwise the client credential leaks
+    // (e.g. to a request-reflecting echo endpoint). getPetById is declared
+    // `security: []` in the spec, so the api method passes the NoAuth sentinel
+    // and BaseApi suppresses the client-level authenticator entirely.
+    [Fact]
+    public async Task SecurityNoneOperationSuppressesClientAuthenticator()
+    {
+        var client = new CapturingApiClient();
+        var clientAuth = new TestAuthenticator(
+            headers: new Dictionary<string, string>
+            {
+                { "Authorization", "Bearer client-secret" },
+                { "api-key", "client-api-key" },
+            },
+            queryParams: new Dictionary<string, string> { { "api_key", "client-api-key" } },
+            cookies: new Dictionary<string, string> { { "session", "client-cookie" } });
+        var config = new Configuration("http://localhost");
+        var api = new PetApi(client, config, clientAuth);
+
+        try
+        {
+            // getPetById is security:[]; the captured request is what matters.
+            await api.GetPetByIdAsync(42L);
+        }
+        catch (Exception)
+        {
+            // The {} response body does not deserialize to a Pet; the request
+            // is already captured by the time deserialization fails.
+        }
+
+        Assert.False(client.CapturedHeaders.ContainsKey("Authorization"),
+            "security:[] operation must NOT carry the client Authorization header");
+        Assert.False(client.CapturedHeaders.ContainsKey("api-key"),
+            "security:[] operation must NOT carry the client api-key header");
+        Assert.False(client.CapturedHeaders.ContainsKey("Cookie"),
+            "security:[] operation must NOT carry the client auth cookie");
+        Assert.DoesNotContain("api_key=", client.CapturedUrl!.ToString());
+    }
+
+    // SECURED (Wave A1 guard against over-suppression): a secured operation
+    // with a configured client authenticator and NO per-call override must
+    // STILL attach the credential. addPet is secured, so the api method passes
+    // the per-call override (null here), and BaseApi falls back to the
+    // client-level authenticator.
+    [Fact]
+    public async Task SecuredOperationStillAppliesClientAuthenticator()
+    {
+        var client = new CapturingApiClient();
+        var clientAuth = new TestAuthenticator(
+            headers: new Dictionary<string, string> { { "Authorization", "Bearer client-secret" } });
+        var config = new Configuration("http://localhost");
+        var api = new PetApi(client, config, clientAuth);
+
+        var pet = new PetstoreClient.Models.Pet { Name = "Rex", PhotoUrls = ["http://example/p.png"] };
+        try
+        {
+            await api.AddPetAsync(pet);
+        }
+        catch (Exception)
+        {
+            // Captured request is asserted regardless of response shape.
+        }
+
+        Assert.True(client.CapturedHeaders.ContainsKey("Authorization"),
+            "secured operation with a client authenticator must still send the credential");
+        Assert.Equal("Bearer client-secret", client.CapturedHeaders["Authorization"]);
+    }
+
+    // The NoAuth sentinel is distinct from null and from any real authenticator,
+    // is identity-comparable, and never contributes a credential.
+    [Fact]
+    public void NoAuthSentinelIsSingletonAndCarriesNoCredential()
+    {
+        Assert.Same(NoAuth.Instance, NoAuth.Instance);
+        // GetQueryParams/GetCookieParams are default interface methods, callable
+        // only through the IAuthenticator type, not the concrete NoAuth.
+        IAuthenticator noAuth = NoAuth.Instance;
+        Assert.Empty(noAuth.GetAuthHeaders());
+        Assert.Empty(noAuth.GetQueryParams());
+        Assert.Empty(noAuth.GetCookieParams());
+    }
 }

src/main/resources/templates/dart/api/api.mustache

@@ -443,7 +443,13 @@ class {{classname}} extends BaseApi {
       contentType: '{{vendorExtensions.op.effectiveConsumes}}',
 {{/vendorExtensions.op.hasMultipleConsumes}}
       returnType: '{{#returnType}}{{{.}}}{{/returnType}}',
-      auth: {{#hasAuthMethods}}auth{{/hasAuthMethods}}{{^hasAuthMethods}}null{{/hasAuthMethods}},
+      {{! security-none suppression: an operation without auth methods is }}
+      {{! declared `security: []` and must NOT inherit the client-level }}
+      {{! authenticator. Pass the `noAuth` sentinel (not `null`, which means }}
+      {{! "fall back to the client authenticator") so base_api suppresses auth }}
+      {{! entirely. A secured op passes its per-call override (`auth`, possibly }}
+      {{! null for "use the client credential") unchanged. }}
+      auth: {{#hasAuthMethods}}auth{{/hasAuthMethods}}{{^hasAuthMethods}}noAuth{{/hasAuthMethods}},
 {{#returnType}}
 {{#returnTypeIsPrimitive}}
 {{#isMap}}

src/main/resources/templates/dart/authenticator.mustache

@@ -25,3 +25,41 @@ abstract class Authenticator {
   /// Returns cookie parameters to include for authentication.
   Map<String, String> cookieParams();
 }
+
+/// Internal no-auth marker for operations declared `security: []` in the spec.
+///
+/// Such operations are explicitly unauthenticated: the client-level
+/// authenticator must NOT be applied to them. A plain `null` cannot express
+/// this because `null` already means "no per-call override — fall back to the
+/// client authenticator". This dedicated sentinel type makes the request path
+/// distinguish three states by identity:
+///
+///   - [noAuth]                     -> suppress auth entirely (security: [])
+///   - `null`                       -> fall back to the client authenticator
+///   - any other [Authenticator]    -> per-call override
+///
+/// It is identity-comparable via the [noAuth] singleton and contributes no
+/// headers, query params, or cookies. Callers never construct or see it; the
+/// generated operation methods pass [noAuth] for unauthenticated operations.
+class NoAuthAuthenticator implements Authenticator {
+  const NoAuthAuthenticator._();
+
+  @override
+  String host() => '';
+
+  @override
+  Map<String, String> authHeaders() => const {};
+
+  @override
+  Future<Map<String, String>> authHeadersAsync() async => const {};
+
+  @override
+  Map<String, String> queryParams() => const {};
+
+  @override
+  Map<String, String> cookieParams() => const {};
+}
+
+/// The single no-auth sentinel instance. Identity-compared in the request path
+/// to suppress authentication for `security: []` operations.
+const Authenticator noAuth = NoAuthAuthenticator._();

src/main/resources/templates/dart/base_api.mustache

@@ -66,7 +66,19 @@ class BaseApi {
     if (queryParams != null) {
       allQueryParams.addAll(queryParams);
     }
-    final effectiveAuth = auth ?? _authenticator;
+    /* Three-state auth resolution (security-none suppression):
+     *   - auth IS the `noAuth` sentinel -> the operation is declared
+     *     `security: []`; apply NO authentication. Do NOT fall back to the
+     *     client-level authenticator (that would re-acquire and leak the
+     *     client credential on an unauthenticated endpoint).
+     *   - auth is null (no per-call override) -> fall back to the
+     *     client-level `_authenticator` (a secured op uses the configured
+     *     credential). UNCHANGED Wave A1 behavior.
+     *   - auth is any other Authenticator -> use it as a per-call override.
+     * The sentinel is compared by identity so it can never collide with a
+     * real authenticator. */
+    final Authenticator? effectiveAuth =
+        identical(auth, noAuth) ? null : (auth ?? _authenticator);
     if (effectiveAuth != null) {
       allQueryParams.addAll(effectiveAuth.queryParams());
     }

src/main/resources/templates/dart/test/base_api_test.mustache

@@ -238,7 +238,10 @@ void main() {
             config: config,
             authenticator: auth);
 
-        await api.getPetById(1, null);
+        // deletePet is a secured op, so the client-level authenticator's query
+        // params ARE applied. (getPetById is security:[] and now correctly
+        // suppresses the client credential — it can't be used to test forwarding.)
+        await api.deletePet(1, null);
         expect(receivedQuery, contains('api_key=test123'));
       } finally {
         await server.close();
@@ -367,7 +370,8 @@ void main() {
             authenticator: clientAuth);
 
         // No `auth:` passed → falls back to client-level authenticator.
-        await api.getPetById(1, null);
+        // deletePet is a secured op (security:[] ops no longer fall back).
+        await api.deletePet(1, null);
         expect(receivedAuth, equals('Bearer client-level'));
       } finally {
         await server.close();
@@ -448,6 +452,71 @@ void main() {
       }
     });
 
+    /* security-none suppression (WAVE A2): an operation declared `security: []`
+     * in the spec is explicitly unauthenticated. Even when the client is
+     * configured WITH an authenticator, invoking such an operation must NOT
+     * attach the client credential — no Authorization header, no api-key header
+     * or query param, and no auth cookie may reach the wire. This guards
+     * against the cross-cutting bug where a `security: []` op passed `null` as
+     * its auth argument and base_api re-acquired the client authenticator,
+     * leaking the credential (notably to the request-reflecting test ops).
+     * getInventory is declared `security: []`, so it exercises the sentinel
+     * path. The configured authenticator sets a header, a query param, AND a
+     * cookie so all three credential channels are checked. */
+    test('client authenticator is suppressed on a security:[] operation',
+        () async {
+      String? receivedAuth;
+      String? receivedApiKeyHeader;
+      String? receivedCookie;
+      String? receivedQuery;
+      final server = await HttpServer.bind(InternetAddress.loopbackIPv4, 0);
+      server.listen((request) {
+        receivedAuth = request.headers.value('authorization');
+        receivedApiKeyHeader = request.headers.value('api-key');
+        receivedCookie = request.headers.value('cookie');
+        receivedQuery = request.uri.queryParameters['api-key'];
+        request.response
+          ..statusCode = 200
+          ..headers.contentType = ContentType.json
+          ..write('{"available":1}')
+          ..close();
+      });
+
+      try {
+        final config = ConfigurationBuilder()
+            .baseUrl('http://localhost:${server.port}')
+            .build();
+        // Configure ALL three credential channels on the client authenticator.
+        final clientAuth = _BaseApiAuth(
+          headers: {
+            'Authorization': 'Bearer client-secret',
+            'api-key': 'header-key',
+          },
+          query: {'api-key': 'query-key'},
+          cookies: {'session': 'cookie-value'},
+        );
+        final api = StoreApi(
+            apiClient: DefaultApiClient(),
+            config: config,
+            authenticator: clientAuth);
+
+        // getInventory is declared `security: []` → fully unauthenticated.
+        await api.getInventory();
+
+        expect(receivedAuth, isNull,
+            reason:
+                'no Authorization header may be sent on a security:[] op');
+        expect(receivedApiKeyHeader, isNull,
+            reason: 'no api-key header may be sent on a security:[] op');
+        expect(receivedCookie, isNull,
+            reason: 'no auth cookie may be sent on a security:[] op');
+        expect(receivedQuery, isNull,
+            reason: 'no api-key query param may be sent on a security:[] op');
+      } finally {
+        await server.close();
+      }
+    });
+
     test('returns null data for empty 200 response', () async {
       final client = DefaultApiClient();
       final resp = await client.sendRequest(

src/main/resources/templates/elixir/api/api.mustache

@@ -196,9 +196,13 @@ defmodule {{moduleName}}.Api.{{classname}} do
     auth = (options && Map.get(options, :auth)) || Map.get(api, :authenticator)
 {{/hasAuthMethods}}
 {{^hasAuthMethods}}
-    # Operation declared `security: []` — no auth applied even if the
-    # client has a default authenticator configured (OpenAPI 3.0 spec).
-    auth = nil
+    # Operation declared `security: []` — no auth applied even if the client
+    # has a default authenticator configured (OpenAPI 3.0 spec). Pass the
+    # BaseApi no-auth SENTINEL (not nil) so BaseApi suppresses the client
+    # credential instead of falling back to it; nil would re-acquire the
+    # client-level authenticator and leak the credential on this unauthenticated
+    # operation.
+    auth = {{moduleName}}.Api.BaseApi.no_auth()
 {{/hasAuthMethods}}
 {{#pathParams}}
 {{#required}}