[TheGreatAxios]

Summary

• A custom endpoint can set auth: "none" and skip the API key.
• That path sends no Authorization header, including through createSystemOneAdapter.
• Official and gateway endpoints still require a key and still send the bearer credential.

Verification

• bun run check exited 0 (42 tests on the amended commit).
• Review of c4755e2 found no defects.

Fixes CL-9939

[linear-code]

CL-9939

[corbits-triage]

Triage: Pass

No changes needed from you. A maintainer will review this pull request.

[TheGreatAxios]

Review · Trust

Custom endpoints may set auth: "none" and send no API key. Official and gateway endpoints still require one.

Findings

No blocking trust findings.

• src/schemas.ts:143 — only the custom arm accepts auth: "none". Official and gateway use kind: "'official' | 'gateway'" with "+": "reject", so { kind: "official", auth: "none" } and the gateway twin fail closed. { kind: "custom", auth: "bearer" } does not coerce to "none".
• src/config.ts:99 — "none" is applied only when kind === "custom". The official and gateway return hardcodes auth: "key" (src/config.ts:116), including when endpoint is absent.
• src/evaluate.ts:288 — keyless is only endpoint.auth === "none". That path does not read config.apiKey or the env key, and postEvaluate adds Authorization only for a non-empty apiKey.
• src/adapter.ts:269 — createSystemOneAdapter parses EvaluateConfig before building a request. buildRequest uses the bearer sentinel only when endpoint.auth !== "none" (src/adapter.ts:200).

A custom URL that happens to be the official host is still a custom opt-out. The boundary in this diff is kind, not URL equality.

Coverage note, not a hole: src/evaluate.test.ts rejects auth on official but has no gateway twin. Gateway already shares that schema arm.

[TheGreatAxios]

Review · Request changes

Lets a custom endpoint set auth: "none" and send no API key. Official and gateway endpoints still require one, and any other auth value throws before a request is built.

Findings

The behavior is clean. bun test src/adapter.test.ts src/evaluate.test.ts exited 0 (37 pass). A deleted probe also checked that auth: "none" omits Authorization on evaluate, createSystemOneAdapter, and the factory even when a key is set, and that bearer, None, "", null, and auth: "none" on official or gateway are rejected with no request.

• Commit subjects do not follow CONTRIBUTING.md. Both lack a type, and both end with a period:

  • Allow custom endpoints to opt out of API key auth.
  • Reject invalid adapter endpoint auth before building a request.

  Subjects need a Conventional Commits type, an imperative subject, lowercase after the colon, and 72 characters or fewer. The code does not need another change for this.

[TheGreatAxios]

Review · Follow-up

Commit subjects now follow CONTRIBUTING.md. The diffs are unchanged.

• feat: let custom endpoints opt out of API key auth (50)
• fix: reject invalid adapter endpoint auth before a request (58)

Force-pushed as a2c495a. Patch-ids match the previous commits.

[TheGreatAxios]

Stacked into the 0.4.0 release: #34

This pull is included in that release and must not also be merged. Landing #34 is the only merge into main. Do not close this pull yet.

[TheGreatAxios]

Superseded by the 0.4.0 release, which is merged: #34