can't use SkipRequestBodyEncodeDecode and authentification at the same time

[zig]

I get the error 'HTTP endpoint request body must be empty when using SkipRequestBodyEncodeDecode but not all method payload attributes are mapped to headers and params. Make sure to define Headers and Params as needed.' when using goa gen.

However all my method payload attributes are mapped, one of them is an API key (in header) declared with 'APIKey', but seem to be ignored in this check.

[zig]

OK I found I can use 'Header' to map the APIKey payload, but it seems that it should not have been necessary.

[raphael]

Some APIs use query string parameters for API keys so Goa can't assume it is a header.

[zig]

OK, but if I don't specify anything, it does automatically use a header. However the check in SkipRequestBodyEncodeDecode does not consider it was mapped in this case.

[raphael]

Ah sorry I had missed the point about the default behavior. That is indeed inconsistent - reopening :)

[raphael]

I tried to reproduce this issue but wasn't able to, the following works as expected:

package design

import . "goa.design/goa/v3/dsl"

// APIKeyAuth defines a security scheme that uses API keys.
var APIKeyAuth = APIKeySecurity("api_key", func() {
	Description("Secures endpoint by requiring an API key.")
})

var _ = Service("foo", func() {
	Method("bar", func() {
		Security(APIKeyAuth)
		Payload(func() {
			APIKey("api_key", "key")
		})
		HTTP(func() {
			POST("/")
			SkipRequestBodyEncodeDecode()
		})
	})
})

If you are still seeing the issue can you please provide a design that reproduces it?

[zig]

Hi, it took me a bit of time to understand, to reproduce the issue, the Security statement must be made at the Service level, not Method

package design

import . "goa.design/goa/v3/dsl"

// APIKeyAuth defines a security scheme that uses API keys.
var APIKeyAuth = APIKeySecurity("api_key", func() {
	Description("Secures endpoint by requiring an API key.")
})

var _ = Service("foo", func() {
	Security(APIKeyAuth)
	Method("bar", func() {
		Payload(func() {
			APIKey("api_key", "key")
		})
		HTTP(func() {
			POST("/")
			SkipRequestBodyEncodeDecode()
		})
	})
})

[raphael]

Thanks for the repro! This is fixed by #3359