fix(request): no dangling ? on empty query strings; feat(auth): doc-level OCI env var indirections

internal/anysdk/auth_dto.go

@@ -43,6 +43,13 @@ type AuthDTO interface {
 	GetAuthStyle() int
 	GetAccountID() string
 	GetAccountIDEnvVar() string
+	GetOciTenancyOCIDEnvVar() string
+	GetOciUserOCIDEnvVar() string
+	GetOciFingerprintEnvVar() string
+	GetOciPrivateKeyEnvVar() string
+	GetOciPrivateKeyPathEnvVar() string
+	GetOciPassphraseEnvVar() string
+	GetOciRegionEnvVar() string
 }
 
 type standardAuthDTO struct {
@@ -76,6 +83,50 @@ type standardAuthDTO struct {
 	AuthStyle          int              `json:"auth_style" yaml:"auth_style"`
 	AccoountID         string           `json:"account_id" yaml:"account_id"`
 	AccountIDEnvVar    string           `json:"account_id_env_var" yaml:"account_id_var"`
+	// OCI signing (oci_signing_v1) doc-level env var indirections: a provider
+	// doc may ship default env var names so that a populated environment
+	// needs no runtime auth context at all. Only indirections are accepted
+	// at doc level - literal credential values belong exclusively in the
+	// runtime auth context.
+	// Key naming: every property carries an OCI reference at the operator
+	// surface (tenancy_ocid/user_ocid via "ocid", the rest via an oci_
+	// prefix) so generic terms (fingerprint, private key, passphrase) stay
+	// available to other auth types without collision.
+	OciTenancyOCIDEnvVar    string `json:"tenancy_ocid_envvar,omitempty" yaml:"tenancy_ocid_envvar,omitempty"`
+	OciUserOCIDEnvVar       string `json:"user_ocid_envvar,omitempty" yaml:"user_ocid_envvar,omitempty"`
+	OciFingerprintEnvVar    string `json:"oci_fingerprint_envvar,omitempty" yaml:"oci_fingerprint_envvar,omitempty"`
+	OciPrivateKeyEnvVar     string `json:"oci_private_key_envvar,omitempty" yaml:"oci_private_key_envvar,omitempty"`
+	OciPrivateKeyPathEnvVar string `json:"oci_private_key_path_envvar,omitempty" yaml:"oci_private_key_path_envvar,omitempty"`
+	OciPassphraseEnvVar     string `json:"oci_passphrase_envvar,omitempty" yaml:"oci_passphrase_envvar,omitempty"`
+	OciRegionEnvVar         string `json:"oci_region_envvar,omitempty" yaml:"oci_region_envvar,omitempty"`
+}
+
+func (qt standardAuthDTO) GetOciTenancyOCIDEnvVar() string {
+	return qt.OciTenancyOCIDEnvVar
+}
+
+func (qt standardAuthDTO) GetOciUserOCIDEnvVar() string {
+	return qt.OciUserOCIDEnvVar
+}
+
+func (qt standardAuthDTO) GetOciFingerprintEnvVar() string {
+	return qt.OciFingerprintEnvVar
+}
+
+func (qt standardAuthDTO) GetOciPrivateKeyEnvVar() string {
+	return qt.OciPrivateKeyEnvVar
+}
+
+func (qt standardAuthDTO) GetOciPrivateKeyPathEnvVar() string {
+	return qt.OciPrivateKeyPathEnvVar
+}
+
+func (qt standardAuthDTO) GetOciPassphraseEnvVar() string {
+	return qt.OciPassphraseEnvVar
+}
+
+func (qt standardAuthDTO) GetOciRegionEnvVar() string {
+	return qt.OciRegionEnvVar
 }
 
 func (qt standardAuthDTO) GetAccountID() string {

internal/anysdk/operation_store.go

@@ -1735,14 +1735,21 @@ func (op *standardOpenAPIOperationStore) parameterize(prov Provider, parentDoc S
 	// TODO: clean up
 	sv = strings.TrimSuffix(sv, "/")
 	path := replaceSimpleStringVars(fmt.Sprintf("%s%s", sv, op.OperationRef.extractPathItem()), pathParams)
-	u, err := url.Parse(fmt.Sprintf("%s?%s", path, q.Encode()))
-	if strings.Contains(path, "?") {
-		if len(q) > 0 {
-			u, err = url.Parse(fmt.Sprintf("%s&%s", path, q.Encode()))
-		} else {
-			u, err = url.Parse(path)
-		}
-	}
+	// Never emit a dangling "?" for an empty query: url.Parse records it as
+	// ForceQuery and reproduces it on the wire, and signature schemes that
+	// cover (request-target) then fail against servers that normalise the
+	// request line before verification (OCI 401 NotAuthenticated on every
+	// no-query body verb).
+	encodedQuery := q.Encode()
+	rawURL := path
+	if encodedQuery != "" {
+		separator := "?"
+		if strings.Contains(path, "?") {
+			separator = "&"
+		}
+		rawURL = fmt.Sprintf("%s%s%s", path, separator, encodedQuery)
+	}
+	u, err := url.Parse(rawURL)
 	if err != nil {
 		return nil, err
 	}

pkg/authsurface/surface.go

@@ -33,4 +33,11 @@ type AuthDTO interface {
 	GetAuthStyle() int
 	GetAccountID() string
 	GetAccountIDEnvVar() string
+	GetOciTenancyOCIDEnvVar() string
+	GetOciUserOCIDEnvVar() string
+	GetOciFingerprintEnvVar() string
+	GetOciPrivateKeyEnvVar() string
+	GetOciPrivateKeyPathEnvVar() string
+	GetOciPassphraseEnvVar() string
+	GetOciRegionEnvVar() string
 }