test: add Xquik OpenAPI fixture and fix apiKey auth

[kriptoburak]

Summary

• Add a compact OpenAPI 3.1 fixture derived from Xquik's public search endpoint.
• Verify the fixture compiles into MCP operations with dual authentication, query enums, and response schemas.
• Preserve an apiKey security component's identity separately from its HTTP wire name.
• Invalidate cached operation models after the serialized security model changes.

Independent Repository Fix

OpenAPI permits a security component key such as apiKey to differ from its wire name such as x-api-key. The compiler previously discarded the wire name, so runtime requests could send the credential through the wrong header. This repair preserves both values, uses the component key for environment lookup, uses the declared name on the request, and reconstructs normalized security requirements with the component key.

Validation

• npm run check
• npm run build
• npm test (34 passing)
• npm run smoke
• npm audit --audit-level=critical (0 vulnerabilities)

Xquik is an independent third-party service. Not affiliated with X Corp. "Twitter" and "X" are trademarks of X Corp.

[cursor]

PR Summary

Medium Risk
Changes authentication env var naming, OAuth2 client-credentials resolution, and compile cache invalidation; misconfiguration could break API calls until env vars are aligned with scheme keys.

Overview
Extends OpenAPI security scheme compilation and runtime auth beyond the new Xquik 3.1 fixture.

Compiler: SecurityScheme gains a key (components map name) separate from name (e.g. apiKey header X-API-Key). OAuth2 tokenUrl and scopes are read only from the client credentials flow, with scope normalization and guards so other flows are not mixed in.

HTTP: Env lookups for tokens and OAuth2 client credentials use scheme.key and the same authScopes tag prefix as other auth (not hard-coded MCP_OPENAPI_). OAuth token cache keys include envPrefix.

Cache: CACHE_FORMAT_VERSION bumps 2 → 7 so stale compiled-operation caches are dropped.

Tests: OAuth2 compiler cases, scoped OAuth2 HTTP test, Xquik YAML fixture, and integration test for dual auth, query enums, and response schemas.

^{Reviewed by Cursor Bugbot for commit b8bb04f. Bugbot is set up for automated code reviews on this repo. Configure here.}

[devin-ai-integration]

Devin Review found 2 potential issues.

[kriptoburak]

Addressed the two Devin readability notes in f3424f4 by documenting that the fixture goes through loadOpenApiDocument() for reference dereferencing and that Xquik uses apiKey as both the public scheme name and OpenAPI scheme type.

Validation after the update:

• npm run check
• npm test

[kriptoburak]

Addressed the current Devin finding by preserving the OpenAPI security-scheme key separately from the API key wire name. The compiler now keeps the scheme key for credential lookup and OpenAPI reconstruction while using X-API-Key for the generated API key header.

Validation:

• npm run check
• npm test
• git diff --check
• changed-diff public-safety scan

[devin-ai-integration]

Devin Review found 2 new potential issues.

[kriptoburak]

Addressed the new Devin OAuth2 prefix finding in 162af2b by passing the resolved auth scope env prefix into the client-credentials lookup and keying the token cache by prefix. This keeps custom prefixes such as TWITTER_ consistent with the rest of auth handling.

Validation:

• npm run check
• npm test
• git diff --check
• changed-diff public-safety scan

[devin-ai-integration]

Devin Review found 3 new potential issues.

[kriptoburak]

Addressed the Cursor compile-cache finding in c33df15 by bumping the compile cache format version so existing cached operation models cannot preserve stale auth metadata after the SecurityScheme.key change.

Validation:

• npm run check
• npm test
• git diff --check
• changed-diff public-safety scan

[kriptoburak]

Addressed the Cursor compile-cache finding in c33df15 by bumping the compile cache format version so existing cached operation models cannot preserve stale auth metadata after the SecurityScheme.key change.

Validation:

• npm run check
• npm test
• git diff --check
• changed-diff public-safety scan

[kriptoburak]

Addressed the latest Devin OAuth2 flow finding in c6ba934 by reading tokenUrl and scopes from standard OpenAPI OAuth2 flows, preferring clientCredentials, and bumping the compile cache format to avoid stale operation models. Added compiler coverage for the extracted flow metadata.

Validation:

• npm run check
• npm test
• git diff --check
• changed-diff public-safety scan

[kriptoburak]

Addressed the latest Cursor OAuth2 flow finding in 6b2d089 by continuing past scopes-only flows until a token URL is found, while retaining scopes as fallback metadata when no flow exposes a token URL. Bumped the compile cache format again and added regression coverage for a scopes-only flow before a token-bearing flow.

Validation:

• npm run check
• npm test
• git diff --check
• changed-diff public-safety scan

[kriptoburak]

Addressed the latest Cursor OAuth2 scopes finding in d809061 by scanning all standard flows before returning auth metadata. The compiler now keeps the first token URL by priority and uses same-flow scopes or a fallback scope map when the token-bearing flow omits one. Bumped the compile cache format again and added regression coverage for token-flow scope fallback.

Validation:

• npm run check
• npm test
• git diff --check
• changed-diff public-safety scan

[devin-ai-integration]

Devin Review found 4 new potential issues.

[kriptoburak]

Addressed the latest Cursor OAuth2 grant finding in b8bb04f by limiting compiled token acquisition metadata to the clientCredentials flow, matching the runtime client_credentials grant. Non-client-credentials token URLs are now ignored so auth-code/password endpoints are not used for client-credentials token requests.

Validation:

• npm run check
• npm test
• git diff --check
• changed-diff public-safety scan

[kriptoburak]

Repair pass complete at a23d880. I rebased onto current main, added the requested apiKey key-versus-wire-name runtime regression, normalized the cache format version, replied to every review note, and resolved all addressed threads. Local validation is green: typecheck, build, 38 tests, smoke test, and dependency audit with 0 vulnerabilities.

[kriptoburak]

Repair published as 2411640. I rebuilt the PR on current main as 1 signed commit and removed the unrelated OAuth expansion. The focused change adds the current Xquik OpenAPI 3.1 regression and fixes the independent apiKey component-key versus wire-name defect for all OpenAPI specs. Validation is green: typecheck, build, 34 tests, smoke test, dependency audit, diff check, and public-link verification.