fix: make anonymous security alternatives optional

[kriptoburak]

Summary

• Detect empty security requirements in client auth types.
• Make auth params partial when an operation allows anonymous access beside API key auth.
• Add API key fixture coverage for optional security.

Validation

• Diff whitespace check passed.
• Full TypeScript test run blocked locally because the machine has 1.9 GiB free and npm install failed with ENOSPC before dependencies finished installing.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 57b0a700-2cec-40cf-9e93-b04e1146de38

📥 Commits

Reviewing files that changed from the base of the PR and between 5e8b840 and 39f6134.

📒 Files selected for processing (1)

• packages/fets/src/client/types.ts

🚧 Files skipped from review as they are similar to previous changes (1)

• packages/fets/src/client/types.ts

---

📝 Walkthrough

Summary by CodeRabbit

• Bug Fixes

  • Improved handling of endpoints that support both authenticated and anonymous access, so requests behave correctly when credentials aren’t required.
  • Refined how OpenAPI security alternatives are interpreted when anonymous access is allowed.

• Tests

  • Expanded client tests to cover an unauthenticated request path in addition to the existing API-key case.
  • Updated OpenAPI fixtures to reflect optional/anonymous security alternatives.

Walkthrough

This PR adds type-level handling for anonymous security alternatives in OAS security params, and updates a fixture and test to exercise the unauthenticated security path.

Changes

Anonymous Security Type Resolution

Layer / File(s)	Summary
Anonymous security detection and conditional DeepPartial packages/fets/src/client/types.ts	Adds HasAnonymousSecurityAlternative, extracts the prior security-ref resolution into OASSecurityParamsBySecurityRefBase, and conditionally applies DeepPartial<> when an anonymous alternative is present.
Fixture and test coverage for anonymous security path packages/fets/tests/client/fixtures/example-apiKey-header-oas.ts, packages/fets/tests/client/apiKey-test.ts	Adds an empty object to the /me security array and a follow-up client['/me'].get() call without an explicit API key header.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Poem

A bunny peeks at keys anew,
With empty paths in schema too,
DeepPartial dances, soft and light,
One extra hop to prove it right,
Hop hop—types glow in moonlit view. 🐇

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	It clearly matches the main change: detecting anonymous security alternatives and making auth params optional when they exist.
Description check	✅ Passed	It accurately describes the type changes, fixture update, and validation notes in the diff.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 ESLint

If the error stems from missing dependencies, add them to the package.json file. For unrecoverable errors (e.g., due to private dependencies), disable the tool in the CodeRabbit configuration.

packages/fets/src/client/types.ts

Oops! Something went wrong! :(

ESLint: 10.6.0

TypeError [ERR_IMPORT_ATTRIBUTE_MISSING]: Module "file:///.eslintrc.json?mtime=1783029430903" needs an import attribute of "type: json"
at validateAttributes (node:internal/modules/esm/assert:88:15)
at defaultLoadSync (node:internal/modules/esm/load:164:3)
at #loadAndMaybeBlockOnLoaderThread (node:internal/modules/esm/loader:776:12)
at #loadSync (node:internal/modules/esm/loader:796:49)
at ModuleLoader.load (node:internal/modules/esm/loader:762:26)
at ModuleLoader.loadAndTranslate (node:internal/modules/esm/loader:504:31)
at #getOrCreateModuleJobAfterResolve (node:internal/modules/esm/loader:555:36)
at afterResolve (node:internal/modules/esm/loader:603:52)
at ModuleLoader.getOrCreateModuleJob (node:internal/modules/esm/loader:609:12)
at node:internal/modules/esm/loader:628:32

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[ardatan]

Is it possible to create a seperate isolated file as a reproduction instead of modifying the existing ones?

[Copilot]

Pull request overview

This PR updates the TypeScript client type generation so that OpenAPI operations with an explicit anonymous security alternative (security: [{} , ...]) no longer require auth parameters, while also extending the existing API key fixture to cover this case.

Changes:

• Add detection for empty (anonymous) security requirement objects in security arrays and make the derived auth params optional for those operations.
• Extend the API key header OpenAPI fixture to include an anonymous security alternative.
• Add a client call in the API key type test to validate that /me can be invoked without auth params when anonymous access is allowed.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
packages/fets/src/client/types.ts	Adds HasAnonymousSecurityAlternative and wraps derived security params in DeepPartial when an empty security requirement is present.
packages/fets/tests/client/fixtures/example-apiKey-header-oas.ts	Updates fixture security to include {} as an anonymous alternative.
packages/fets/tests/client/apiKey-test.ts	Adds a call to /me without params to ensure optional-security typing is accepted.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.