authn-mappings: fix stale no-auth test, add OAuth bearer test

- src/client.rs: the make_api_no_auth! macro-contract test used
  AuthNMappingsAPI as its vehicle type, which is no longer accurate now
  that authn_mappings.rs uses make_api!. Swapped to ApplicationSecurityAPI
  (ASM WAF custom rules), which is still genuinely no-auth today.
- Added test_authn_mappings_list_accepts_oauth_bearer_token, which
  configures access_token only (no API/APP keys) and asserts the
  Authorization: Bearer header is sent -- the prior tests all used
  test_config's defaults (access_token: None), so the make_api_no_auth! ->
  make_api! change wasn't actually exercised by any test.

Author: srosenthal-dd

src/client.rs

@@ -697,11 +697,11 @@ mod tests {
     /// Same coverage for the no-auth variant. Asserts the UA is overridden
     /// AND that no `Authorization` header leaks through, even when a bearer
     /// token exists in the config — that's the contract of `make_api_no_auth!`.
+    /// Uses `ApplicationSecurityAPI` (ASM WAF custom rules), which is still a
+    /// genuinely no-auth production call site as of this test.
     #[tokio::test]
     async fn test_make_api_no_auth_sends_pup_user_agent() {
-        use datadog_api_client::datadogV2::api_authn_mappings::{
-            AuthNMappingsAPI, ListAuthNMappingsOptionalParams,
-        };
+        use datadog_api_client::datadogV2::api_application_security::ApplicationSecurityAPI;
         let _lock = lock_env().await;
         let mut server = mockito::Server::new_async().await;
         let mock = server
@@ -719,10 +719,8 @@ mod tests {
         // Set a token so the Authorization-absent assertion meaningfully
         // exercises that `make_api_no_auth!` actively suppresses bearer.
         cfg.access_token = Some("test-bearer-token".into());
-        let api: AuthNMappingsAPI = crate::make_api_no_auth!(AuthNMappingsAPI, &cfg);
-        let resp = api
-            .list_authn_mappings(ListAuthNMappingsOptionalParams::default())
-            .await;
+        let api: ApplicationSecurityAPI = crate::make_api_no_auth!(ApplicationSecurityAPI, &cfg);
+        let resp = api.list_application_security_waf_custom_rules().await;
         assert!(
             resp.is_ok(),
             "make_api_no_auth! request leaked Authorization or wrong UA: {:?}",

src/commands/authn_mappings.rs

@@ -115,6 +115,38 @@ mod tests {
         std::env::remove_var("DD_TOKEN_STORAGE");
     }
 
+    #[tokio::test]
+    async fn test_authn_mappings_list_accepts_oauth_bearer_token() {
+        let _lock = lock_env().await;
+        std::env::set_var("DD_TOKEN_STORAGE", "file");
+        let mut server = mockito::Server::new_async().await;
+        let mut cfg = test_config(&server.url());
+        // Simulate OAuth-only auth: bearer token configured, no API/APP keys.
+        cfg.api_key = None;
+        cfg.app_key = None;
+        cfg.access_token = Some("oauth-bearer-token".into());
+        std::env::remove_var("DD_API_KEY");
+        std::env::remove_var("DD_APP_KEY");
+
+        let _mock = server
+            .mock("GET", mockito::Matcher::Any)
+            .match_header("Authorization", "Bearer oauth-bearer-token")
+            .with_status(200)
+            .with_header("content-type", "application/json")
+            .with_body(r#"{"data":[]}"#)
+            .create_async()
+            .await;
+
+        let result = super::list(&cfg).await;
+        assert!(
+            result.is_ok(),
+            "authn mappings list with OAuth bearer failed: {:?}",
+            result.err()
+        );
+        cleanup_env();
+        std::env::remove_var("DD_TOKEN_STORAGE");
+    }
+
     #[tokio::test]
     async fn test_authn_mappings_list_error() {
         let _lock = lock_env().await;