From 1e9b364f5858db0036b692bcd6e58d3230394e8b Mon Sep 17 00:00:00 2001 From: Chirag Aggarwal Date: Mon, 4 May 2026 16:50:38 +0530 Subject: [PATCH 1/2] feat(specs): include union of auth headers in every platform's securityDefinitions Each platform spec previously declared only the auth headers referenced by endpoints in that platform's surface. The unified web SDK now exposes a single Client class with cross-platform auth factories (fromSession, fromCookie, fromDevKey, etc.), which means an SDK generator targeting one platform still needs setter generation for headers that other platforms expose. The web SDK currently papers over this with a webClientHeaders augmentation in the SDK generator. Add the missing securityDefinitions entries directly so every platform spec carries the union, removing the need for SDK-side augmentation: - client: + Cookie (for SSR cookie forwarding) - server: + Cookie, DevKey - console: + Session, DevKey Per-endpoint security requirements continue to be filtered per platform as before; only the securityDefinitions registry expands to declare schemes that exist API-wide. SDKs that iterate the registry to emit auth setters now produce the union without per-SDK fallback code. --- src/Appwrite/Platform/Tasks/Specs.php | 30 +++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) diff --git a/src/Appwrite/Platform/Tasks/Specs.php b/src/Appwrite/Platform/Tasks/Specs.php index 82020b05b1..92f1f3d3f5 100644 --- a/src/Appwrite/Platform/Tasks/Specs.php +++ b/src/Appwrite/Platform/Tasks/Specs.php @@ -163,6 +163,12 @@ class Specs extends Action 'description' => 'Your secret dev API key', 'in' => 'header', ], + 'Cookie' => [ + 'type' => 'apiKey', + 'name' => 'Cookie', + 'description' => 'The user cookie to authenticate with. Used by SDKs that forward an incoming Cookie header in server-side runtimes.', + 'in' => 'header', + ], 'ImpersonateUserId' => [ 'type' => 'apiKey', 'name' => 'X-Appwrite-Impersonate-User-Id', @@ -219,6 +225,18 @@ class Specs extends Action 'description' => 'The user agent string of the client that made the request', 'in' => 'header', ], + 'DevKey' => [ + 'type' => 'apiKey', + 'name' => 'X-Appwrite-Dev-Key', + 'description' => 'Your secret dev API key', + 'in' => 'header', + ], + 'Cookie' => [ + 'type' => 'apiKey', + 'name' => 'Cookie', + 'description' => 'The user cookie to authenticate with. Used by SDKs that forward an incoming Cookie header in server-side runtimes.', + 'in' => 'header', + ], 'ImpersonateUserId' => [ 'type' => 'apiKey', 'name' => 'X-Appwrite-Impersonate-User-Id', @@ -275,6 +293,18 @@ class Specs extends Action 'description' => 'The user cookie to authenticate with', 'in' => 'header', ], + 'Session' => [ + 'type' => 'apiKey', + 'name' => 'X-Appwrite-Session', + 'description' => 'The user session to authenticate with', + 'in' => 'header', + ], + 'DevKey' => [ + 'type' => 'apiKey', + 'name' => 'X-Appwrite-Dev-Key', + 'description' => 'Your secret dev API key', + 'in' => 'header', + ], 'ImpersonateUserId' => [ 'type' => 'apiKey', 'name' => 'X-Appwrite-Impersonate-User-Id', From e81ae6774576afebfae8cc114bfa5eaf26937e16 Mon Sep 17 00:00:00 2001 From: Chirag Aggarwal Date: Mon, 4 May 2026 16:53:22 +0530 Subject: [PATCH 2/2] fix(specs): align console Cookie description with client/server --- src/Appwrite/Platform/Tasks/Specs.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/Appwrite/Platform/Tasks/Specs.php b/src/Appwrite/Platform/Tasks/Specs.php index 92f1f3d3f5..c8120bd017 100644 --- a/src/Appwrite/Platform/Tasks/Specs.php +++ b/src/Appwrite/Platform/Tasks/Specs.php @@ -290,7 +290,7 @@ class Specs extends Action 'Cookie' => [ 'type' => 'apiKey', 'name' => 'Cookie', - 'description' => 'The user cookie to authenticate with', + 'description' => 'The user cookie to authenticate with. Used by SDKs that forward an incoming Cookie header in server-side runtimes.', 'in' => 'header', ], 'Session' => [