[Java][native] Add ability to add header to specific calls

[inemtsev]

The need for this change is that we need to be able to set the bearer Token per request (for Java native library option), we would like to reuse ApiClient (because recreating it is expensive), but bearer token needs to change. We can achieve this by attaching a specific headers for specific requests, and reusing the same ApiClient.

For example:

var apiClient = new ApiClient(); // reuse this instance across requests
apiClient.setRequestInterceptor(builder -> 
    builder.header("X-API-Key", "your-api-key-here")
);

var authClient = new AuthClient(apiClient); // create new one every use
authClient.sendUserData(userData, mapOfSpecialTokens);

var walletClient = new WalletClient(apiClient); // create new one every use
walletClient.sendWalletData(walletRequest, otherMapOfHeaders);

Related issue: #21487

PR checklist

• Read the contribution guidelines.
• Pull Request title clearly describes the work in the pull request and Pull Request description provides details about how to validate the work. Missing information here may result in delayed response from the community.
• Run the following to build the project and update samples:

  ./mvnw clean package || exit
  ./bin/generate-samples.sh ./bin/configs/*.yaml || exit
  ./bin/utils/export_docs_generators.sh || exit
  

  (For Windows users, please run the script in WSL)
  Commit all changed files.
  This is important, as CI jobs will verify all generator outputs of your HEAD commit as it would merge with master.
  These must match the expectations made by your contribution.
  You may regenerate an individual generator by passing the relevant config(s) as an argument to the script, for example ./bin/generate-samples.sh bin/configs/java*.
  IMPORTANT: Do NOT purge/delete any folders/files (e.g. tests) when regenerating the samples as manually written tests may be removed.
• File the PR against the correct branch: master (upcoming 7.x.0 minor release - breaking changes with fallbacks), 8.0.x (breaking changes without fallbacks)
• If your PR is targeting a particular programming language, @mention the technical committee members, so they are more likely to review the pull request.

[inemtsev]

Can you please take a look?

@bbdouglas @sreeshas @jfiala @lukoyanov @cbornet @jeff9finger @karismann @Zomzog @lwlee2608 @martin-mfg

[wing328]

Thanks for the PR but your commit (as shown in the Commits tab) is not linked to your Github account, which means this PR won't count as your contribution in https://github.com/OpenAPITools/openapi-generator/graphs/contributors.

Let me know if you need help fixing it.

Ref: https://github.com/OpenAPITools/openapi-generator/wiki/FAQ#how-can-i-update-commits-that-are-not-linked-to-my-github-account

[Mattias-Sehlstedt]

Hi @inemtsev,

Instead of instantiating new objects, would an approach similar to this be possible? Where the bearer is instead injected with a supplier, and the type of supplier can determine whether the token is reused for each invocation or if it is uniquely generated/fetched each time?

[inemtsev]

Hi @inemtsev,

Instead of instantiating new objects, would an approach similar to this be possible? Where the bearer is instead injected with a supplier, and the type of supplier can determine whether the token is reused for each invocation or if it is uniquely generated/fetched each time?

This is an interesting approach, but in our case the token is almost always unique. For example a BFF API takes a user token of our customers and fans-out requests to downstream services. One of these downstream APIs needs this token passed on to them to do a secure operation. So basically the token is fairly unique across requests.

[inemtsev]

@wing328 Thanks for the headsup. I think I fixed the emails now and regenerated the samples. Can you please help target the correct release branch?

[inemtsev]

@wing328 @chameleon82 @Mattias-Sehlstedt I've made the solution more flexible, so that devs can add any needed header per request. Can you please review?

[inemtsev]

@bgong-mdsol @jo1gi Can you please review as well?

[inemtsev]

PR is ready for review 🚀 🚀

[inemtsev]

Hi @martin-mfg @wing328 @welandaz @marcel-huber-ptv

Can you please review this PR?

[inemtsev]

@wing328 Updated as per suggestions ✅

[inemtsev]

@wing328 Do you think we can squeeze this one for next release? My team will need this change in a couple of weeks.

[wing328]

yes, i think so

if no further feedback, i'll merge it over the weekend

thanks for the contribution

[verhasi]

Hi @inemtsev,
Instead of instantiating new objects, would an approach similar to this be possible? Where the bearer is instead injected with a supplier, and the type of supplier can determine whether the token is reused for each invocation or if it is uniquely generated/fetched each time?

This is an interesting approach, but in our case the token is almost always unique. For example a BFF API takes a user token of our customers and fans-out requests to downstream services. One of these downstream APIs needs this token passed on to them to do a secure operation. So basically the token is fairly unique across requests.

Hi @inemtsev ,

It is still not clear for me why is not viable the use of the Supplier. It is called before each request to supply the bearer token and it is up to your supplier to provide unique/specific one for each request. Could you please elaborate?

[inemtsev]

Hi @inemtsev,
Instead of instantiating new objects, would an approach similar to this be possible? Where the bearer is instead injected with a supplier, and the type of supplier can determine whether the token is reused for each invocation or if it is uniquely generated/fetched each time?

This is an interesting approach, but in our case the token is almost always unique. For example a BFF API takes a user token of our customers and fans-out requests to downstream services. One of these downstream APIs needs this token passed on to them to do a secure operation. So basically the token is fairly unique across requests.

Hi @inemtsev ,

It is still not clear for me why is not viable the use of the Supplier. It is called before each request to supply the bearer token and it is up to your supplier to provide unique/specific one for each request. Could you please elaborate?

The token in this case is tied to the parameters being sent in the request (it's a multiuser environment), so it makes sense for it to be passed (as a parameter/header instead of a Supplier). Also, this change opens up the possibility of settings various other headers on-demand also

[verhasi]

Hi @inemtsev,
Instead of instantiating new objects, would an approach similar to this be possible? Where the bearer is instead injected with a supplier, and the type of supplier can determine whether the token is reused for each invocation or if it is uniquely generated/fetched each time?

This is an interesting approach, but in our case the token is almost always unique. For example a BFF API takes a user token of our customers and fans-out requests to downstream services. One of these downstream APIs needs this token passed on to them to do a secure operation. So basically the token is fairly unique across requests.

Hi @inemtsev ,
It is still not clear for me why is not viable the use of the Supplier. It is called before each request to supply the bearer token and it is up to your supplier to provide unique/specific one for each request. Could you please elaborate?

The token in this case is tied to the parameters being sent in the request (it's a multiuser environment), so it makes sense for it to be passed (as a parameter/header instead of a Supplier). Also, this change opens up the possibility of settings various other headers on-demand also

It makes sense. Generally speaking you need a context to supply the token. The best practice in the industry is to store the context in a thread local variable.