fix: make anonymous security alternatives optional

[ardatan]

Summary

• Detect empty security requirements ({}) so auth params are optional when anonymous access is allowed
• Dedicated fixture/test (optional-apiKey-test.ts) instead of changing the existing API key examples

Based on #3959 by @kriptoburak, rebased on current master and updated per review feedback.

Test plan

• npm run ts:check
• CI green

[coderabbitai]

Warning

Review limit reached

@ardatan, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 23 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 84b101bb-770a-406f-934e-60b6fa238be4

📥 Commits

Reviewing files that changed from the base of the PR and between e3be332 and b354c1c.

📒 Files selected for processing (4)

• .changeset/optional-anonymous-security.md
• packages/fets/src/client/types.ts
• packages/fets/tests/client/fixtures/example-optional-apiKey-header-oas.ts
• packages/fets/tests/client/optional-apiKey-test.ts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

🚀 Snapshot Release (alpha)

The latest changes of this PR are available as alpha on npm (based on the declared changesets):

Package	Version	Info
fets	0.8.9-alpha-20260807162100-b354c1c5540f45e4eae91516b54e492ed5ca8a48	npm ↗︎ unpkg ↗︎

[github-actions]

💻 Website Preview

The latest changes are available as preview in: https://pr-4081.fets-3ku.pages.dev

[github-actions]

✅ Benchmark Results

     ✓ no_errors{server:node-http,mode:no-schema}
     ✓ expected_result{server:node-http,mode:no-schema}
     ✓ no_errors{server:node-http,mode:json-schema}
     ✓ expected_result{server:node-http,mode:json-schema}
     ✓ no_errors{server:uWebSockets,mode:no-schema}
     ✓ expected_result{server:uWebSockets,mode:no-schema}
     ✓ no_errors{server:uWebSockets,mode:json-schema}
     ✓ expected_result{server:uWebSockets,mode:json-schema}

     checks......................................: 100.00% ✓ 872996      ✗ 0     
     data_received...............................: 79 MB   661 kB/s
     data_sent...................................: 55 MB   462 kB/s
     http_req_blocked............................: avg=1.5µs    min=701ns    med=1.31µs   max=287.38µs p(90)=1.81µs   p(95)=2.44µs  
     http_req_connecting.........................: avg=1ns      min=0s       med=0s       max=197.16µs p(90)=0s       p(95)=0s      
     http_req_duration...........................: avg=195.79µs min=129.76µs med=185.95µs max=12.92ms  p(90)=214.47µs p(95)=223.31µs
       { expected_response:true }................: avg=195.79µs min=129.76µs med=185.95µs max=12.92ms  p(90)=214.47µs p(95)=223.31µs
     ✓ { server:node-http,mode:json-schema }.....: avg=205.22µs min=144.84µs med=194.76µs max=8.43ms   p(90)=222.35µs p(95)=230.57µs
     ✓ { server:node-http,mode:no-schema }.......: avg=198.81µs min=131.73µs med=186µs    max=12.92ms  p(90)=215.9µs  p(95)=226.57µs
     ✓ { server:uWebSockets,mode:json-schema }...: avg=193.75µs min=132.13µs med=185.59µs max=9.89ms   p(90)=211.28µs p(95)=218.68µs
     ✓ { server:uWebSockets,mode:no-schema }.....: avg=186.18µs min=129.76µs med=177.93µs max=8.99ms   p(90)=203.53µs p(95)=211.33µs
     http_req_failed.............................: 0.00%   ✓ 0           ✗ 436498
     http_req_receiving..........................: avg=24.86µs  min=10.33µs  med=24.03µs  max=2.74ms   p(90)=31.6µs   p(95)=33.76µs 
     http_req_sending............................: avg=8.42µs   min=4.34µs   med=7.75µs   max=1.58ms   p(90)=11.64µs  p(95)=13.36µs 
     http_req_tls_handshaking....................: avg=0s       min=0s       med=0s       max=0s       p(90)=0s       p(95)=0s      
     http_req_waiting............................: avg=162.5µs  min=99.89µs  med=152.63µs max=12.84ms  p(90)=178.66µs p(95)=186.43µs
     http_reqs...................................: 436498  3637.440377/s
     iteration_duration..........................: avg=269.88µs min=189.88µs med=259.06µs max=13.11ms  p(90)=293.42µs p(95)=304.97µs
     iterations..................................: 436498  3637.440377/s
     vus.........................................: 1       min=1         max=1   
     vus_max.....................................: 2       min=2         max=2   

[Copilot]

Pull request overview

This PR updates the fets client type generation so that when an OpenAPI operation’s security array includes an anonymous alternative ({}), the generated auth-related request params become optional (reflecting that callers may omit credentials). It also adds targeted fixture/test coverage and a changeset entry for the patch release.

Changes:

• Add type-level detection for an anonymous {} security requirement and make the derived auth params optional in that case.
• Add a dedicated fixture + compile-time client usage test covering optional API key auth via anonymous security alternative.
• Add a changeset documenting the behavior change as a patch.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File	Description
packages/fets/src/client/types.ts	Detects {} in security alternatives and makes derived auth params optional via DeepPartial when anonymous access is allowed.
packages/fets/tests/client/optional-apiKey-test.ts	Adds a compile-time client usage test demonstrating that auth params are optional when security includes {}.
packages/fets/tests/client/fixtures/example-optional-apiKey-header-oas.ts	Adds an OpenAPI fixture with security: [{}, { apiKey: [] }] to represent optional authentication.
.changeset/optional-anonymous-security.md	Documents the patch change for release notes/versioning.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.