Skip to content

feat(dart-dio): add methods to remove auth tokens in api client#23386

Merged
wing328 merged 1 commit intoOpenAPITools:masterfrom
nopjar:master
Apr 1, 2026
Merged

feat(dart-dio): add methods to remove auth tokens in api client#23386
wing328 merged 1 commit intoOpenAPITools:masterfrom
nopjar:master

Conversation

@nopjar
Copy link
Copy Markdown
Contributor

@nopjar nopjar commented Mar 28, 2026

There is currently no way to easily remove a previously set auth token. Adding these methods will provide a convenient way to 'revoke' tokens.

Design-Choice:
Adding those new methods is a better alternative as just making the values of existing methods nullable, as e.g. #setBasicAuth(String, String, String) has two value parameters, which then would have to be checked for nullability and special handling would be required if only one value is null. This would result in a less clear API. By adding new methods following the naming #removeXY(String) no ambiguity is added and a clear API is kept.

Output was tested and is working as expected.

Mentions as this only targets Dart code (like required in the PR checklist): @jaumard @josh-burton @amondnet @sbu-WBT @kuhnroyal @agilob @ahmednfwela

PR checklist

  • Read the contribution guidelines.
  • Pull Request title clearly describes the work in the pull request and Pull Request description provides details about how to validate the work. Missing information here may result in delayed response from the community.
  • Run the following to build the project and update samples:
    ./mvnw clean package || exit
    ./bin/generate-samples.sh ./bin/configs/*.yaml || exit
    ./bin/utils/export_docs_generators.sh || exit
    
    (For Windows users, please run the script in WSL)
    Commit all changed files.
    This is important, as CI jobs will verify all generator outputs of your HEAD commit as it would merge with master.
    These must match the expectations made by your contribution.
    You may regenerate an individual generator by passing the relevant config(s) as an argument to the script, for example ./bin/generate-samples.sh bin/configs/java*.
    IMPORTANT: Do NOT purge/delete any folders/files (e.g. tests) when regenerating the samples as manually written tests may be removed.
  • File the PR against the correct branch: master (upcoming 7.x.0 minor release - breaking changes with fallbacks), 8.0.x (breaking changes without fallbacks)
  • If your PR solves a reported issue, reference it using GitHub's linking syntax (e.g., having "fixes #123" present in the PR description)
  • If your PR is targeting a particular programming language, @mention the technical committee members, so they are more likely to review the pull request.

Summary by cubic

Added removal methods for auth credentials in dart-dio API clients so apps can revoke tokens/keys at runtime without recreating the client.

  • New Features
    • removeOAuthToken(name) removes tokens from OAuthInterceptor.
    • removeBearerAuth(name) removes tokens from BearerAuthInterceptor.
    • removeBasicAuth(name) removes credentials from BasicAuthInterceptor.
    • removeApiKey(name) removes keys from ApiKeyAuthInterceptor.
    • Regenerated samples/openapi3 dart-dio clients to include these methods.

Written for commit 21ee2e0. Summary will update on new commits.

Copy link
Copy Markdown
Contributor

@cubic-dev-ai cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No issues found across 8 files

@wing328
Copy link
Copy Markdown
Member

wing328 commented Mar 31, 2026

There is currently no way to easily remove a previously set auth token. Adding these methods will provide a convenient way to 'revoke' tokens.

for other clients, if the token is set to empty string or null, the auth header or query parameter won't be set.

is dart client behaving the same way?

@nopjar
Copy link
Copy Markdown
Contributor Author

nopjar commented Mar 31, 2026

There is currently no way to easily remove a previously set auth token. Adding these methods will provide a convenient way to 'revoke' tokens.

for other clients, if the token is set to empty string or null, the auth header or query parameter won't be set.

is dart client behaving the same way?

It seems to be not like it. Neither in the Code (Looking at e.g. BearerAuthInterceptor) nor when testing it with setting the token to an empty string (null is not possible as the parameter type is not nullable):

REQUEST DATA: GET /v1/user, headers=[user-agent:"Dart/3.11 (dart:io)", accept-encoding:"gzip", authorization:"Bearer", host:"localhost:8082"]]

Looking at the Design-Choice in the PR, a behavior that is similar to other clients would imho make methods like the setBasicAuth which has two parameters more difficult and less intuitive.

@wing328
Copy link
Copy Markdown
Member

wing328 commented Apr 1, 2026

👌 understood

we can give this a try for sure

There is currently no way to easily remove a previously set auth token.
Adding these methods will provide a convenient way to 'revoke' tokens.

Design-Choice:
Adding those new methods is a better alternative as just making the values of existing methods nullable, as e.g. #setBasicAuth(String, String, String) has two value parameters, which then would have to be checked for nullability and special handling would be required if only one value is null.
This would result in a less clear API. By adding new methods following the naming #removeXY(String) no ambiguity is added and a clear API is kept.
@nopjar nopjar requested a review from wing328 April 1, 2026 16:34
@wing328 wing328 added this to the 7.22.0 milestone Apr 1, 2026
@wing328 wing328 merged commit aaa957d into OpenAPITools:master Apr 1, 2026
26 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants