From 5c5f13eee68bf9d50f3896e4c7fa66430900c6c7 Mon Sep 17 00:00:00 2001 From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> Date: Thu, 21 May 2026 12:46:10 +0000 Subject: [PATCH 1/4] fix(cli): preserve per-endpoint security when auth-schemes defined without auth key Co-Authored-By: will.kendall@buildwithfern.com --- .../openapi-to-ir/src/3.1/OpenAPIConverter.ts | 22 +++++++++++++++---- ...fix-auth-schemes-per-endpoint-security.yml | 6 +++++ .../lazy-fern-workspace/src/OSSWorkspace.ts | 13 ++++++++--- 3 files changed, 34 insertions(+), 7 deletions(-) create mode 100644 packages/cli/cli/changes/unreleased/fix-auth-schemes-per-endpoint-security.yml diff --git a/packages/cli/api-importers/openapi-to-ir/src/3.1/OpenAPIConverter.ts b/packages/cli/api-importers/openapi-to-ir/src/3.1/OpenAPIConverter.ts index 5ce9244fd4ad..78e48f8ff467 100644 --- a/packages/cli/api-importers/openapi-to-ir/src/3.1/OpenAPIConverter.ts +++ b/packages/cli/api-importers/openapi-to-ir/src/3.1/OpenAPIConverter.ts @@ -152,9 +152,23 @@ export class OpenAPIConverter extends AbstractSpecConverter [scheme.key, scheme.docs])); - this.convertAuthOverrides(descriptions, this.context.authOverrides); - return; + if (this.context.authOverrides.auth != null) { + const descriptions = new Map(openApiSchemes.map((scheme) => [scheme.key, scheme.docs])); + this.convertAuthOverrides(descriptions, this.context.authOverrides); + return; + } + + if (this.context.authOverrides["auth-schemes"] != null) { + const schemeNames = Object.keys(this.context.authOverrides["auth-schemes"]); + if (schemeNames.length > 0) { + const descriptions = new Map(openApiSchemes.map((scheme) => [scheme.key, scheme.docs])); + this.convertAuthOverrides(descriptions, { + ...this.context.authOverrides, + auth: { any: schemeNames } + }); + return; + } + } } if (openApiSchemes.length > 0) { @@ -393,7 +407,7 @@ export class OpenAPIConverter extends AbstractSpecConverter | null | undefined; - if (parsed != null && parsed["auth"] != null) { + if (parsed != null && (parsed["auth"] != null || parsed["auth-schemes"] != null)) { return { auth: parsed["auth"] as RawSchemas.WithAuthSchema["auth"], ...(parsed["auth-schemes"] != null From fcb720a44209fb5e61a7efb3c2fe8c40ffd2836d Mon Sep 17 00:00:00 2001 From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> Date: Thu, 21 May 2026 13:20:12 +0000 Subject: [PATCH 2/4] fix: address review - honor override file auth with auth-schemes, add AsyncAPI parallel handling Co-Authored-By: will.kendall@buildwithfern.com --- .../asyncapi-to-ir/src/AsyncAPIConverter.ts | 17 ++++++++++++++- .../lazy-fern-workspace/src/OSSWorkspace.ts | 21 ++++++++++--------- 2 files changed, 27 insertions(+), 11 deletions(-) diff --git a/packages/cli/api-importers/asyncapi-to-ir/src/AsyncAPIConverter.ts b/packages/cli/api-importers/asyncapi-to-ir/src/AsyncAPIConverter.ts index ed929b9c00f4..3d730848e88e 100644 --- a/packages/cli/api-importers/asyncapi-to-ir/src/AsyncAPIConverter.ts +++ b/packages/cli/api-importers/asyncapi-to-ir/src/AsyncAPIConverter.ts @@ -165,8 +165,23 @@ export class AsyncAPIConverter extends AbstractSpecConverter 0) { + effectiveOverrides = { + ...this.context.authOverrides, + auth: { any: schemeNames } + }; + } + } + const overrideAuth = convertApiAuth({ - rawApiFileSchema: this.context.authOverrides, + rawApiFileSchema: effectiveOverrides, casingsGenerator: this.context.casingsGenerator }); diff --git a/packages/cli/workspace/lazy-fern-workspace/src/OSSWorkspace.ts b/packages/cli/workspace/lazy-fern-workspace/src/OSSWorkspace.ts index b0c6c99d5a49..c89d2c441ce7 100644 --- a/packages/cli/workspace/lazy-fern-workspace/src/OSSWorkspace.ts +++ b/packages/cli/workspace/lazy-fern-workspace/src/OSSWorkspace.ts @@ -570,23 +570,24 @@ export class OSSWorkspace extends BaseOpenAPIWorkspace { return this.createWorkspaceWithSpecsOverride({ context }, specsOverride, settings); } - // If auth is not in generators.yml and not in settings, try to read it from the spec's overrides files + // If auth is not in generators.yml and not in settings, try to read it from the spec's overrides files. + // When only auth-schemes is in generators.yml (no auth key), still check override files for auth. let effectiveSettings = settings; - if ( - this.generatorsConfiguration?.api?.auth == null && - this.generatorsConfiguration?.api?.["auth-schemes"] == null && - settings?.auth == null - ) { + if (this.generatorsConfiguration?.api?.auth == null && settings?.auth == null) { const specs = await this.getOpenAPISpecsCached({ context }); const authFromOverrides = await getAuthFromOverrideFiles(specs); if (authFromOverrides != null) { + const hasAuthSchemesInGenerators = this.generatorsConfiguration?.api?.["auth-schemes"] != null; effectiveSettings = { ...settings, auth: authFromOverrides.auth as RawSchemas.ApiAuthSchema, - authSchemes: authFromOverrides["auth-schemes"] as Record< - string, - RawSchemas.AuthSchemeDeclarationSchema - > + // Only use override file's auth-schemes if generators.yml doesn't already define them + authSchemes: hasAuthSchemesInGenerators + ? undefined + : (authFromOverrides["auth-schemes"] as Record< + string, + RawSchemas.AuthSchemeDeclarationSchema + >) }; } } From 1de933f33eced207d6cbed67530a978ae7717f6c Mon Sep 17 00:00:00 2001 From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> Date: Thu, 21 May 2026 13:22:21 +0000 Subject: [PATCH 3/4] chore: fix biome formatting Co-Authored-By: will.kendall@buildwithfern.com --- .../api-importers/asyncapi-to-ir/src/AsyncAPIConverter.ts | 5 +---- .../cli/workspace/lazy-fern-workspace/src/OSSWorkspace.ts | 5 +---- 2 files changed, 2 insertions(+), 8 deletions(-) diff --git a/packages/cli/api-importers/asyncapi-to-ir/src/AsyncAPIConverter.ts b/packages/cli/api-importers/asyncapi-to-ir/src/AsyncAPIConverter.ts index 3d730848e88e..62d1bb8b2964 100644 --- a/packages/cli/api-importers/asyncapi-to-ir/src/AsyncAPIConverter.ts +++ b/packages/cli/api-importers/asyncapi-to-ir/src/AsyncAPIConverter.ts @@ -167,10 +167,7 @@ export class AsyncAPIConverter extends AbstractSpecConverter 0) { effectiveOverrides = { diff --git a/packages/cli/workspace/lazy-fern-workspace/src/OSSWorkspace.ts b/packages/cli/workspace/lazy-fern-workspace/src/OSSWorkspace.ts index c89d2c441ce7..302b4b6ccfa8 100644 --- a/packages/cli/workspace/lazy-fern-workspace/src/OSSWorkspace.ts +++ b/packages/cli/workspace/lazy-fern-workspace/src/OSSWorkspace.ts @@ -584,10 +584,7 @@ export class OSSWorkspace extends BaseOpenAPIWorkspace { // Only use override file's auth-schemes if generators.yml doesn't already define them authSchemes: hasAuthSchemesInGenerators ? undefined - : (authFromOverrides["auth-schemes"] as Record< - string, - RawSchemas.AuthSchemeDeclarationSchema - >) + : (authFromOverrides["auth-schemes"] as Record) }; } } From c47a2b79cb2de433ebee040fc2d08b6fe42e29d6 Mon Sep 17 00:00:00 2001 From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> Date: Thu, 21 May 2026 14:30:04 +0000 Subject: [PATCH 4/4] fix: merge top-level auth-schemes into api config and clean up debug logging Co-Authored-By: will.kendall@buildwithfern.com --- .../src/generators-yml/convertGeneratorsConfiguration.ts | 4 ++-- .../cli/workspace/lazy-fern-workspace/src/OSSWorkspace.ts | 1 + 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/packages/cli/configuration-loader/src/generators-yml/convertGeneratorsConfiguration.ts b/packages/cli/configuration-loader/src/generators-yml/convertGeneratorsConfiguration.ts index eaecb95f58d3..f604f853d80e 100644 --- a/packages/cli/configuration-loader/src/generators-yml/convertGeneratorsConfiguration.ts +++ b/packages/cli/configuration-loader/src/generators-yml/convertGeneratorsConfiguration.ts @@ -392,8 +392,8 @@ async function parseApiConfigurationV2Schema({ apiSettings: generatorsYml.APIDefinitionSettings; }): Promise { const partialConfig = { - "auth-schemes": rawConfiguration["auth-schemes"], - ...apiConfiguration + ...apiConfiguration, + "auth-schemes": apiConfiguration["auth-schemes"] ?? rawConfiguration["auth-schemes"] }; if (generatorsYml.isConjureSchema(apiConfiguration.specs)) { diff --git a/packages/cli/workspace/lazy-fern-workspace/src/OSSWorkspace.ts b/packages/cli/workspace/lazy-fern-workspace/src/OSSWorkspace.ts index 302b4b6ccfa8..a17c210b17b1 100644 --- a/packages/cli/workspace/lazy-fern-workspace/src/OSSWorkspace.ts +++ b/packages/cli/workspace/lazy-fern-workspace/src/OSSWorkspace.ts @@ -326,6 +326,7 @@ export class OSSWorkspace extends BaseOpenAPIWorkspace { if (authOverrides == null) { authOverrides = await getAuthFromOverrideFiles(specs); } + const environmentOverrides = this.generatorsConfiguration?.api?.environments != null ? { ...this.generatorsConfiguration?.api }