fix(python-flask, python-aiohttp): generated tests send apiKey under keyParamName in its declared location

KH
1d ago
+153-13

The generated controller tests for python-flask and python-aiohttp send every apiKey security scheme as a header named after the scheme, e.g. 'apikey_query': 'special-key'. This ignores both keyParamName (the actual header/query/cookie name) and the key's location. Operations protected by a query or cookie API key, or by a header key whose name differs from the scheme name, therefore fail their generated test with 401 "No authorization token provided". I didn't find an existing issue for this.

Changes

  • Header keys are sent as '{{keyParamName}}': 'special-key'.
  • Query keys are appended to the test's query_string (flask) / params (aiohttp), after the regular query parameters. The combined list is computed in AbstractPythonConnexionServerCodegen as the x-test-query-string vendor extension, so an operation with only a query API key also gets one.
  • Cookie keys are merged into a single Cookie header. On Connexion 2 (Werkzeug), the default test client drops a manually set Cookie header, so only those operations use self.app.test_client(use_cookies=False).
  • Operations without API keys generate exactly as before. OAuth, Basic and Bearer are unchanged.

Verification

  • A new test in AbstractPythonConnexionServerCodegenTest uses a spec with header, query and cookie API keys, including an operation with several at once. It fails without the change. Python*Test / AbstractPython*Test pass, including forbiddenapis.
  • The generated tests were run against Connexion 2.14.2 (flask), Connexion 3.3.0 (flask, useConnexion3) and aiohttp. All 5 pass in each; before the change, the cookie and query cases got 401.
  • bin/generate-samples.sh bin/configs/python*.yaml: no diff, since the petstore samples only use a header key named like its scheme.

Out of scope, noticed while testing:

  • python-blueplanet's test template doesn't send API keys at all.
  • The aiohttp test template's Basic value is 'BasicZm9vOmJhcg==', with the space missing.

PR checklist

  • Read the contribution guidelines.
  • Run the following to build the project and update samples: 
    ./mvnw clean package || exit
./bin/generate-samples.sh ./bin/configs/*.yaml || exit
./bin/utils/export_docs_generators.sh || exit
    Regenerated all bin/configs/python*.yaml samples: no diff. Generator options and docs are unchanged.
  • If your PR is targeting a particular programming language, @mention the technical committee members, so they are more likely to review the pull request.

cc @cbornet @tomplus @krjakbrjak @fa0311 (Python technical committee)

Parts of this change were drafted with AI coding assistants (Devin, Claude Code) and reviewed and verified by me.

šŸ¤– Generated with Claude Code

Summary by cubic

Fixes generated controller tests for python-flask and python-aiohttp so API key security schemes are sent under their keyParamName in the declared location (header, query, or cookie). Previously all API keys were sent as headers named after the scheme, so operations secured by query or cookie keys failed their generated tests with 401.

  • Header keys now use the wire name keyParamName; query keys are appended to the query-string list; cookie keys are merged into a single Cookie header on the test client.
  • Operations with no API keys, and OAuth/Basic/Bearer auth, generate exactly as before.
  • Flask tests for cookie keys opt into a use_cookies=False test client, since Werkzeug's default client drops manually set Cookie headers.
  • Adds a regression test covering header, query, and cookie keys, including one operation secured by all three.