Walkthrough

Refactors ApiToken and OAuth token handling in ApiClient to resolve a conflict where ApiToken credentials were incorrectly set in DefaultHeaders and rejected by validation. Introduces centralized token retrieval via GetAuthenticationTokenAsync and updates header construction logic to apply authorization tokens at request time rather than modifying DefaultHeaders, with comprehensive test coverage for ApiToken, OAuth, and no-credential scenarios.

Changes

Sequence Diagram(s)

sequenceDiagram
    actor User
    participant Config as Configuration
    participant Client as ApiClient
    participant Auth as GetAuthenticationToken
    participant Build as BuildHeaders
    participant HTTP as HTTP Request

    Note over Client,HTTP: Before: Token in DefaultHeaders (FAILED)
    User->>Config: Create with ApiToken
    activate Config
    Config->>Client: new ApiClient(config)
    activate Client
    Client->>Client: DefaultHeaders.Add("Authorization", ...)
    Client->>Config: Validate
    activate Config
    Config-->>Config: ❌ Reserved header in DefaultHeaders
    Config-->>Client: Exception
    deactivate Config
    Client-->>User: Crash
    deactivate Client
    deactivate Config

    Note over Client,HTTP: After: Token applied at request time (FIXED)
    User->>Config: Create with ApiToken
    activate Config
    Config->>Client: new ApiClient(config)
    activate Client
    Client->>Config: Validate
    activate Config
    Config-->>Client: ✓ Valid (DefaultHeaders clean)
    deactivate Config
    Client-->>User: Success
    deactivate Client
    
    User->>Client: SendRequest
    activate Client
    Client->>Auth: GetAuthenticationTokenAsync
    activate Auth
    Auth-->>Client: Bearer token
    deactivate Auth
    Client->>Build: BuildHeaders(authToken)
    activate Build
    Build-->>Client: Merged headers<br/>(DefaultHeaders + Auth + Custom)
    deactivate Build
    Client->>HTTP: POST with Authorization header
    HTTP-->>Client: Response
    deactivate Client

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

• Focus areas requiring attention:
  • src/OpenFga.Sdk/ApiClient/ApiClient.cs: Verify the precedence logic in BuildHeaders (DefaultHeaders → Auth token → Per-request headers) correctly handles all credential scenarios and doesn't inadvertently override user headers.
  • Token retrieval flow in GetAuthenticationTokenAsync: Ensure OAuth error handling properly raises FgaApiAuthenticationError and doesn't break existing retry logic.
  • Constructor removal of DefaultHeaders modification for ApiToken: Confirm this change doesn't affect backward compatibility or break dependent code paths.
  • Case-insensitive dictionary usage in BuildHeaders: Verify HTTP header name handling is compliant across platforms.
  • Test file src/OpenFga.Sdk.Test/ApiClient/ApiClientTests.cs: Review mock HTTP handler setup and assertion counts to ensure tests exercise all code paths and edge cases (e.g., OAuth token refresh, concurrent requests).

Pre-merge checks and finishing touches

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

_{Comment @coderabbitai help to get the list of available commands and usage tips.}