fix: only send X-API-Key from RefreshDataset when a key is configured

RefreshDataset set the header unconditionally, so a client with no key
configured sent an empty X-API-Key. Auth middleware reads that as a
supplied-but-invalid credential rather than as an absent one, which is
the same bug just fixed in Search: client.go, nsql.go, status.go and
active_queries.go all guard the header, and these were the two callers
that did not.

TestRefreshDatasetApiKeyHeader asserts the header is absent, not empty,
when no key is set. It needs no live runtime, so it joins the allowlist
the Windows CI job runs natively.

Author: lukekim

.github/workflows/go.yml

@@ -41,7 +41,7 @@ jobs:
       # runtime install + integration tests to WSL (see the WSL steps below).
       - name: Unit tests (Windows native)
         if: matrix.os == 'windows-latest'
-        run: go test -v -run 'TestUserAgent|TestPrependedUserAgent|TestInferArrowType|TestAppendValueToBuilder|TestComprehensiveArrowTypes|TestParamType|TestTypedParamInference|TestExtendedArrowTypes|TestSearch|TestNsql|TestListActiveQueries|TestCancelActiveQuery|TestActiveQueryStartedAt' ./...
+        run: go test -v -run 'TestUserAgent|TestPrependedUserAgent|TestInferArrowType|TestAppendValueToBuilder|TestComprehensiveArrowTypes|TestParamType|TestTypedParamInference|TestExtendedArrowTypes|TestSearch|TestNsql|TestListActiveQueries|TestCancelActiveQuery|TestActiveQueryStartedAt|TestRefreshDatasetApiKeyHeader' ./...
 
       - name: Install Spice (https://install.spiceai.org) (Linux)
         if: matrix.os == 'ubuntu-latest' || matrix.os == 'macos-latest'

datasets.go

@@ -43,9 +43,14 @@ func (c *SpiceClient) RefreshDataset(ctx context.Context, dataset string, opts *
 
 	req = req.WithContext(c.traceHttpRequest(ctx, "RefreshDataset", req))
 
-	req.Header.Set("X-API-Key", c.apiKey)
 	req.Header.Set("Content-Type", "application/json")
 	req.Header.Set("user-agent", c.userAgent)
+	// Only send the key when there is one — an empty X-API-Key reads as a
+	// supplied-but-invalid credential to auth middleware, which is different
+	// from omitting the header. Matches IsSpiceReady in client.go.
+	if c.apiKey != "" {
+		req.Header.Set("X-API-Key", c.apiKey)
+	}
 
 	resp, err := c.httpClient.Do(req)
 	if err != nil {

datasets_test.go

@@ -2,6 +2,8 @@ package gospice
 
 import (
 	"context"
+	"net/http"
+	"net/http/httptest"
 	"testing"
 	"time"
 )
@@ -44,3 +46,47 @@ func TestLocalRuntimeDatasetRefresh(t *testing.T) {
 		}
 	})
 }
+
+func TestRefreshDatasetApiKeyHeader(t *testing.T) {
+	// An empty X-API-Key is not the same as no X-API-Key: auth middleware can
+	// read the former as a supplied-but-invalid credential.
+	tests := []struct {
+		name   string
+		apiKey string
+		want   string
+	}{
+		{name: "no key omits the header", apiKey: "", want: ""},
+		{name: "key is sent", apiKey: "test-app|test-key", want: "test-app|test-key"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			var got string
+			var present bool
+
+			server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				_, present = r.Header["X-Api-Key"]
+				got = r.Header.Get("X-API-Key")
+				w.WriteHeader(http.StatusCreated)
+			}))
+			t.Cleanup(server.Close)
+
+			spice := NewSpiceClient()
+			if err := WithHttpAddress(server.URL)(spice); err != nil {
+				t.Fatalf("error setting http address: %v", err)
+			}
+			spice.apiKey = tt.apiKey
+
+			if err := spice.RefreshDataset(context.Background(), "app_messages", nil); err != nil {
+				t.Fatalf("unexpected error: %v", err)
+			}
+
+			if tt.want == "" && present {
+				t.Error("X-API-Key should be absent when no key is configured")
+			}
+			if got != tt.want {
+				t.Errorf("X-API-Key = %q, want %q", got, tt.want)
+			}
+		})
+	}
+}