feat: Hide authentication from unauthenticated openapi curl examples - #1397
Merged
andreaangiolillo merged 8 commits intoJul 28, 2026
Merged
Conversation
…examples
## Proposed changes
Update the curl code sample generation in
`tools/foas/openapi/filter/code_sample.go` so that endpoints which do not
require authentication no longer expose authentication flags in their examples.
An operation is treated as unauthenticated when it overrides the global
security with an empty set (`security: []`). For those endpoints a single
`curl` sample is emitted without `--user "${PUBLIC_KEY}:${PRIVATE_KEY}" --digest`
(digest) and without `--header "Authorization: Bearer ${ACCESS_TOKEN}"`
(service account).
For authenticated operations the Service Account and Digest samples are now
gated on the security schemes the operation actually supports, so an endpoint
that only references one scheme gets only that sample. Operations that do not
override the global security keep emitting both samples as before.
The request-building portion shared by every curl variant was extracted into a
`curlRequestSuffix` helper; the generated output for the existing samples is
unchanged.
_Jira ticket:_ CLOUDP-428048
## Checklist
- [ ] I have signed the [MongoDB CLA](https://www.mongodb.com/legal/contributor-agreement)
- [x] I have added tests that prove my fix is effective or that my feature works
### Changes to Spectral
- [ ] I have read the [README](../tools/spectral/README.md) file for Spectral Updates
andreaangiolillo
changed the title
andreaangiolillo
marked this pull request as ready for review
July 28, 2026 12:11
andreaangiolillo
requested review from
andmatei,
andreaangiolillo,
drinkbird,
matt-condon,
saisundar,
wtrocki and
yelizhenden-mdb
July 28, 2026 12:11
andreaangiolillo
enabled auto-merge (squash)
July 28, 2026 13:03
andreaangiolillo
deleted the
sage-bot/CLOUDP-428048/sage-CLOUDP-428048-1785162451972
branch
July 28, 2026 13:37
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Proposed changes
Jira ticket: CLOUDP-428048
This pull request refactors how cURL code samples are generated for OpenAPI endpoints, improving maintainability and adding logic to distinguish between authenticated and unauthenticated endpoints. It introduces a helper function to centralize cURL command construction and updates the code to emit different code samples based on endpoint authentication requirements. Comprehensive tests are added to cover new behaviors.
Refactoring and Code Simplification:
appendCurlMethodSource, reducing code duplication and simplifying the code sample generation process. [1] [2]newCurlCodeSamplesForOperationfor unauthenticated endpoints,newServiceAccountCurlCodeSamplesForOperationandnewDigestCurlCodeSamplesForOperationfor authenticated endpoints.Authentication-based Code Sample Selection:
isEndpointUnAuthenticatedfunction to determine if an endpoint requires authentication, based on the absence of 401 and 403 responses.Testing Enhancements:
These changes improve the maintainability of the code sample generator and ensure that users receive appropriate example commands depending on endpoint authentication requirements.
Checklist