OpenAPITools / OpenAPITools/openapi-generator

[BUG][cpp-qt-client] OAuth code block emitted multiple times when multiple OAuth2 security schemes are defined

Open
#23,011 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Java
Stars
26.8k
Forks
7.7k
PR merge metrics
PR metrics pending

Description

Bug Report Checklist
  • Have you provided a full/minimal spec to reproduce the issue?
  • Have you validated the input using an OpenAPI validator?
  • Have you tested with the latest master to confirm the issue still exists?
  • Have you searched for related issues/PRs?
  • What's the actual output vs expected output?
Description

When an OpenAPI spec defines multiple OAuth2 security schemes as alternatives at the global level, the cpp-qt-client generator emits the OAuth authentication code block once per scheme, causing C++ compilation errors due to variable redefinition.

For example, if the spec has:

security:
  - oauth_realm_a: []
  - oauth_realm_b: []

The generator loops over authMethods and emits the OAuth setup code twice in the same function scope, redeclaring variables like scope and token.

openapi-generator version

Tested on:

  • 7.15.0
  • 7.20.0

Both exhibit the same behavior.

OpenAPI declaration file content or url

Minimal reproducible example:

openapi: 3.0.4
info:
  title: Test API
  version: 1.0.0
servers:
  - url: http://localhost:8080/api
security:
  - oauth_primary: []
  - oauth_secondary: []

paths:
  /test:
    get:
      operationId: testEndpoint
      responses:
        "200":
          description: OK

components:
  securitySchemes:
    oauth_primary:
      type: oauth2
      description: Primary OAuth server
      flows:
        authorizationCode:
          authorizationUrl: http://localhost/auth/primary/authorize
          tokenUrl: http://localhost/auth/primary/token
          scopes: {}
    oauth_secondary:
      type: oauth2
      description: Secondary OAuth server
      flows:
        authorizationCode:
          authorizationUrl: http://localhost/auth/secondary/authorize
          tokenUrl: http://localhost/auth/secondary/token
          scopes: {}
Generation Details
openapi-generator-cli generate -g cpp-qt-client -i test-api.yaml -o generated/
Steps to reproduce
  1. Create the YAML file above
  2. Generate cpp-qt-client code
  3. Attempt to compile the generated code
Actual Output

The generated OAIDefaultApi.cpp contains duplicate code blocks:

void OAIDefaultApi::testEndpoint() {
    // ... request setup ...
    
    // First OAuth block (oauth_primary)
    _OauthMethod = 2;
    _implicitFlow.unlink();
    _credentialFlow.unlink();
    _passwordFlow.unlink();
    _authFlow.link();
    QStringList scope;                              // <-- First declaration
    auto token = _authFlow.getToken(scope.join(" ")); // <-- First declaration
    // ... more code ...

    // Second OAuth block (oauth_secondary)  
    _OauthMethod = 2;
    _implicitFlow.unlink();
    _credentialFlow.unlink();
    _passwordFlow.unlink();
    _authFlow.link();
    QStringList scope;                              // <-- ERROR: redefinition
    auto token = _authFlow.getToken(scope.join(" ")); // <-- ERROR: redefinition
    // ... more code ...

Compilation errors:

error C2086: 'QStringList scope': redefinition
error C2371: 'token': redefinition; different basic types
Expected Output

Only one OAuth code block should be generated. Since the security schemes are alternatives (OR logic), the client only needs to support one OAuth flow at runtime.

Related issues/PRs
  • #22954 - Related feature request to disable OAuth generation entirely

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the cpp-qt-client generator and reproduce the issue using the provided YAML and generation command. Inspect the generated OAIDefaultApi.cpp and compare output for multiple alternative OAuth2 schemes. Done means the generated client contains only one OAuth code block and compiles without scope or token redefinition errors.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
tooling
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
52/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.