feat: API key and HTTP basic authentication support

[halotukozak]

Summary

• Add SecurityScheme sealed interface model (Bearer, ApiKey with header/query, Basic)
• Extend SpecParser to extract securitySchemes from OpenAPI spec and resolve global security references
• Dynamic applyAuth() generation in ApiClientBaseGenerator — conditional logic per scheme type
• Security-aware constructor params in ClientGenerator — backward-compatible (token for single Bearer)
• Wire spec files through JustworksSharedTypesTask for end-to-end security scheme generation
• Lightweight SpecParser.parseSecuritySchemes() method for shared types task — avoids full spec re-parse

Test plan

• SpecParserSecurityTest — 8 tests for scheme extraction (bearer, apiKey header/query, basic, filtering)
• ApiClientBaseGeneratorTest — 24 tests including dynamic applyAuth for all scheme types
• ClientGeneratorTest — 28 tests including security-aware constructors
• JustworksPluginFunctionalTest — 2 functional tests for on-disk ApiClientBase with security
• Backward compatibility: specs without security produce unchanged output

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Adds first-class OpenAPI security scheme support (API key + HTTP Basic, alongside Bearer/backward-compat) to the parsing and codegen pipeline, and wires Gradle plugin shared-type generation to reflect spec-defined authentication.

Changes:

• Introduces SecurityScheme / ApiKeyLocation in the core model and parses global securitySchemes + security usage from OpenAPI.
• Generates auth-aware ApiClientBase.applyAuth() and security-aware client constructors (with backward-compat behavior for legacy Bearer-only usage).
• Updates Gradle plugin to feed spec files into shared type generation; adds extensive unit + functional tests.

Reviewed changes

Copilot reviewed 13 out of 13 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
plugin/src/main/kotlin/com/avsystem/justworks/gradle/JustworksSharedTypesTask.kt	Adds specFiles input and parses specs to drive shared ApiClientBase auth generation.
plugin/src/main/kotlin/com/avsystem/justworks/gradle/JustworksPlugin.kt	Wires each spec into the shared types task for security scheme extraction.
plugin/src/functionalTest/kotlin/com/avsystem/justworks/gradle/JustworksPluginFunctionalTest.kt	Functional coverage for security-aware vs backward-compatible ApiClientBase.
core/src/test/resources/security-schemes-spec.yaml	Fixture spec covering Bearer/apiKey/header+query/basic.
core/src/test/kotlin/com/avsystem/justworks/core/parser/SpecParserSecurityTest.kt	Unit tests for security scheme extraction/filtering.
core/src/test/kotlin/com/avsystem/justworks/core/gen/ClientGeneratorTest.kt	Constructor generation tests for various security scheme sets.
core/src/test/kotlin/com/avsystem/justworks/core/gen/ApiClientBaseGeneratorTest.kt	Tests for generated constructor params and applyAuth() body per scheme.
core/src/main/kotlin/com/avsystem/justworks/core/parser/SpecParser.kt	Extracts referenced security schemes from components + global security requirements.
core/src/main/kotlin/com/avsystem/justworks/core/model/ApiSpec.kt	Adds SecurityScheme model and ApiSpec.securitySchemes.
core/src/main/kotlin/com/avsystem/justworks/core/gen/Names.kt	Adds BASE64_CLASS for Basic auth generation.
core/src/main/kotlin/com/avsystem/justworks/core/gen/CodeGenerator.kt	Passes security schemes into shared-type generation.
core/src/main/kotlin/com/avsystem/justworks/core/gen/ClientGenerator.kt	Generates security-aware constructors and super-calls.
core/src/main/kotlin/com/avsystem/justworks/core/gen/ApiClientBaseGenerator.kt	Generates scheme-dependent auth params + dynamic applyAuth() implementation.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[github-actions]

Coverage Report

Overall Project	95.52% -0.7%	🍏
Files changed	91.82%	🍏

File	Coverage
Names.kt	100%	🍏
ArrowHelpers.kt	100%	🍏
ApiClientBaseGenerator.kt	100%	🍏
ClientGenerator.kt	99.64%	🍏
ApiSpec.kt	97.96%	🍏
ApiResponseGenerator.kt	92.99%	🍏
SpecParser.kt	92% -2.6%	❌
Issue.kt	90%	🍏
CodeGenerator.kt	85.16% -6.25%	❌

[Copilot]

Pull request overview

Copilot reviewed 17 out of 17 changed files in this pull request and generated 6 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[MattK97]

The parameter name derivation (scheme.name.toCamelCase() + suffix) is duplicated between buildAuthConstructorParams() and buildApplyAuth(). Consider extracting a
helper like SecurityScheme.paramName(): List so the mapping lives in one place

[MattK97]

Seems kinda fragile, if there will be two schemes with same name but with different config it will pick first one

[MattK97]

Nit: can we use is type check as we are using for headerScheme checks?

[halotukozak]

but later the cast would be required

 if (querySchemes.isNotEmpty()) {
            builder.beginControlFlow("url")
            for (scheme in querySchemes) {
                scheme as SecurityScheme.ApiKey
                val paramName = scheme.paramNames()
                builder.addStatement(
                    "parameters.append(%S, $paramName())",
                    scheme.parameterName,
                )
            }
            builder.endControlFlow()
        }