OpenAPIGenerator upgrade to v7.16.0 - [2] Added new mustache templates #1208

Kwok-he-Chu · 2025-11-18T15:52:59Z

PR-2 of #1204

Description

This PR introduces the mustache.templates needed for the upgrade of the OpenApiGenerator to v7.16.0 used in the Adyen sdk-automation to generate .NET models & services from the Adyen OpenAPI Specifications.

Removed the old templates

gemini-code-assist

Code Review

This pull request is a significant upgrade, replacing old templates with new ones for the generichost library to support OpenAPI Generator v7.16.0. The changes are extensive and introduce a new structure for C# code generation. My review of the new mustache templates has identified a few critical and high-severity issues related to null handling, incorrect logic in authentication flows, and attempts to instantiate abstract classes. These could lead to runtime exceptions or unexpected behavior in the generated code. I've provided detailed feedback and code suggestions to improve the robustness and correctness of the new templates.

templates-v7/csharp/libraries/generichost/HostConfiguration.mustache

gemini-code-assist · 2025-11-18T15:57:04Z

templates-v7/csharp/libraries/generichost/HttpSigningConfiguration.mustache

+            catch (global::System.FormatException)
+            {
+                StringReader str = new StringReader(pvkstr);
+
+                //-------- read PEM encryption info. lines and extract salt -----
+                if (!str.ReadLine(){{nrt!}}.StartsWith("Proc-Type: 4,ENCRYPTED"))  // TODO: what do we do here if ReadLine is null?
+                    return null;
+
+                String saltline = str.ReadLine(){{nrt!}};  // TODO: what do we do here if ReadLine is null?
+                if (!saltline.StartsWith("DEK-Info: DES-EDE3-CBC,"))
+                    return null;
+
+                String saltstr = saltline.Substring(saltline.IndexOf(",") + 1).Trim();
+                byte[] salt = new byte[saltstr.Length / 2];
+                for (int i = 0; i < salt.Length; i++)
+                    salt[i] = Convert.ToByte(saltstr.Substring(i * 2, 2), 16);
+
+                if (!(str.ReadLine() == ""))
+                    return null;
+
+                //------ remaining b64 data is encrypted RSA key ----
+                String encryptedstr = str.ReadToEnd();
+
+                try
+                {   //should have b64 encrypted RSA key now
+                    binkey = Convert.FromBase64String(encryptedstr);
+                }
+                catch (global::System.FormatException)
+                {   //data is not in base64 format
+                    return null;
+                }
+
+                // TODO: what do we do here if keyPassPhrase is null?
+                byte[] deskey = GetEncryptedKey(salt, keyPassPhrase{{nrt!}}, 1, 2);    // count=1 (for OpenSSL implementation); 2 iterations to get at least 24 bytes
+                if (deskey == null)
+                    return null;
+
+                //------ Decrypt the encrypted 3des-encrypted RSA private key ------
+                byte[]{{nrt?}} rsakey = DecryptKey(binkey, deskey, salt); //OpenSSL uses salt value in PEM header also as 3DES IV
+
+                return rsakey;
+            }


This catch block has several potential NullReferenceException issues and lacks proper error handling for encrypted keys without a passphrase.

str.ReadLine() can return null, but the null-forgiving operator (!) is used, which can lead to a crash. You should use null-conditional access (?.).

If an encrypted key is provided without a keyPassPhrase, the code will crash at line 450. There should be a check for a null keyPassPhrase before attempting to decrypt the key.

I suggest refactoring this block for safer null handling and clearer error reporting.

catch (global::System.FormatException) { StringReader str = new StringReader(pvkstr); //-------- read PEM encryption info. lines and extract salt ----- if (str.ReadLine()?.StartsWith("Proc-Type: 4,ENCRYPTED") != true) return null; String saltline = str.ReadLine(); if (saltline?.StartsWith("DEK-Info: DES-EDE3-CBC,") != true) return null; String saltstr = saltline.Substring(saltline.IndexOf(",") + 1).Trim(); byte[] salt = new byte[saltstr.Length / 2]; for (int i = 0; i < salt.Length; i++) salt[i] = Convert.ToByte(saltstr.Substring(i * 2, 2), 16); if (!(str.ReadLine() == "")) return null; //------ remaining b64 data is encrypted RSA key ---- String encryptedstr = str.ReadToEnd(); try { //should have b64 encrypted RSA key now binkey = Convert.FromBase64String(encryptedstr); } catch (global::System.FormatException) { //data is not in base64 format return null; } if (keyPassPhrase == null) throw new ArgumentException("A passphrase is required for an encrypted private key.", nameof(keyPassPhrase)); byte[] deskey = GetEncryptedKey(salt, keyPassPhrase, 1, 2); // count=1 (for OpenSSL implementation); 2 iterations to get at least 24 bytes if (deskey == null) return null; //------ Decrypt the encrypted 3des-encrypted RSA private key ------ byte[]{{nrt?}} rsakey = DecryptKey(binkey, deskey, salt); //OpenSSL uses salt value in PEM header also as 3DES IV return rsakey; }

This template is used in two test files, I've removed them here

gemini-code-assist · 2025-11-18T15:57:04Z

templates-v7/csharp/libraries/generichost/WebhookHandler.mustache

+        /// <inheritdoc/>
+        public bool IsValidHmacSignature(string json, string hmacSignature)
+        {
+            return {{packageName}}.{{corePackageName}}.Utilities.HmacValidatorUtility.IsHmacSignatureValid(hmacSignature, _adyenHmacKey, json);
+        }


The current implementation of IsValidHmacSignature has a critical flaw: it uses the _adyenHmacKey field which is never initialized, causing HMAC validation to always use a null key.

To fix this and follow best practices, I recommend the following changes:

Store the provider: In the {{apiName}}Handler constructor, store the injected ITokenProvider<HmacKeyToken> in a private readonly field (e.g., _hmacKeyProvider).

Make validation async: Change IsValidHmacSignature to be an async method (e.g., IsValidHmacSignatureAsync) in both the {{interfacePrefix}}{{apiName}}Handler interface and the {{apiName}}Handler class. This is crucial to avoid blocking on I/O when retrieving the key.

Implement async logic: In the new async method, await the key from _hmacKeyProvider.GetAsync() and then perform the validation.

This approach ensures correct, non-blocking HMAC validation.

Gemini reviews this template as if it was C# code, but this would generate the constructor with the HmacKey using the correct ITokenProvider<>,

public {{apiName}}Handler({{packageName}}.{{apiName}}.{{clientPackage}}.JsonSerializerOptionsProvider jsonSerializerOptionsProvider, ITokenProvider<HmacKeyToken> hmacKeyProvider = null) { JsonSerializerOptionsProvider = jsonSerializerOptionsProvider; }

Resolved: The WebhookHandler is acting as a service-class (we only suffix it with -Handler because we call it the same in the other Adyen Libraries), developers can decide to call this function -> if no ADYEN_HMAC_KEY is provided, the application would still start.

gemini-code-assist · 2025-11-18T15:57:04Z

templates-v7/csharp/auth/OAuthAuthenticator.mustache

+                default:
+                    break;


The default case in this switch statement does nothing, which means if an unsupported OAuthFlow is provided, the _grantType field will remain uninitialized. This will likely cause a null value to be sent in the token request later. It's better to throw an exception for unsupported flows to fail early and clearly.

default: throw new NotSupportedException($"The OAuth flow '{flow}' is not supported.");

This mustache template is unused

@gcatanese Q: Do we leave this in? I've only included it for completeness as part of the v7 generator upgrade

IMO I'd keep only if it already existed in the project and you are just moving things. If this is coming in from the upgrade, then I'd remove.

templates-v7/csharp/libraries/generichost/HttpSigningConfiguration.mustache

Remove unused templates ApiTests, DependencyInjectionTests #1208 (comment)

Kwok-he-Chu · 2025-11-20T10:37:06Z

@gcatanese The mustache templates include the generated templates for the classes in the /Core-folder, these templates can be removed (e.g. Options.mustache template etc.)

…grade

Remove old mustache templates

templates-v7/csharp/libraries/generichost/ApiResponse`1.mustache

galesky-a · 2025-11-28T15:34:39Z

templates-v7/csharp/libraries/generichost/ValidateRegex.mustache

@@ -0,0 +1,7 @@
+// {{{name}}} ({{{dataType}}}) pattern


There are two files with this name now and they are slightly different. Do we need both?

This version is the most similar to the original

galesky-a · 2025-11-28T15:41:31Z

templates-v7/csharp/libraries/generichost/BearerToken.mustache

@@ -0,0 +1,41 @@
+\// <auto-generated>


Is this formatting ok?

galesky-a · 2025-11-28T16:00:55Z

templates-v7/csharp/libraries/generichost/DateOnlyNullableJsonConverter.mustache

+                if (DateOnly.TryParseExact(value, format, CultureInfo.InvariantCulture, DateTimeStyles.AdjustToUniversal | DateTimeStyles.AssumeUniversal, out DateOnly result))
+                    return result;
+
+            throw new NotSupportedException();


I think this is out of sync with the generated file

galesky-a · 2025-11-28T16:10:29Z

templates-v7/csharp/libraries/generichost/JsonConverter.mustache

+
+            {{/children}}
+            {{/discriminator}}
+            {{! start | support oneOf without discriminator.mapping property - WriteProperties }}


I see that this is new, do you have a test for this on the other PR?

galesky-a · 2025-11-28T16:16:45Z

templates-v7/csharp/libraries/generichost/OperationSignature.mustache

@@ -0,0 +1 @@
+{{#pathParams}}{{{dataType}}}{{>NullConditionalParameter}} {{paramName}}, {{/pathParams}}{{#queryParams}}{{#required}}{{{dataType}}}{{>NullConditionalParameter}} {{paramName}}, {{/required}}{{/queryParams}}{{#bodyParams}}{{{dataType}}}{{>NullConditionalParameter}} {{paramName}}, {{/bodyParams}}{{#queryParams}}{{^required}}Option<{{{dataType}}}{{>NullConditionalParameter}}> {{paramName}}{{#notRequiredOrIsNullable}} = default{{/notRequiredOrIsNullable}}, {{/required}}{{/queryParams}} RequestOptions? requestOptions = default, System.Threading.CancellationToken cancellationToken = default{{^netstandard20OrLater}}(global::System.Threading.CancellationToken){{/netstandard20OrLater}}


I see that this version is a bit more complicated than the original. No need to change for now but we can create a follow up about maintainability later

galesky-a · 2025-11-28T16:19:40Z

templates-v7/csharp/libraries/generichost/WriteProperty.mustache

+
+{{/required}}
+{{^required}}
+if ({{#lambda.camelcase_sanitize_param}}{{classname}}{{/lambda.camelcase_sanitize_param}}._{{name}}Option.IsSet)


Today we also add this underscore ?

Kwok-he-Chu requested review from a team as code owners November 18, 2025 15:53

Kwok-he-Chu changed the base branch from main to v7-generator/1-add-core-classes November 18, 2025 15:53

gemini-code-assist bot reviewed Nov 18, 2025

View reviewed changes

Adyen deleted a comment from gemini-code-assist bot Nov 18, 2025

Kwok-he-Chu changed the title ~~OpenAPIGenerator upgrade to v7.16.0 - Added new mustache templates~~ OpenAPIGenerator upgrade to v7.16.0 - [2] Added new mustache templates Nov 18, 2025

Kwok-he-Chu self-assigned this Nov 18, 2025

Kwok-he-Chu mentioned this pull request Nov 18, 2025

Upgrade OpenApiGenerator to v7.16.0 to generate new .NET models/services to support allOf/type, System.Text.Json #1204

Open

30 tasks

Kwok-he-Chu added a commit that referenced this pull request Nov 19, 2025

Remove unused HttpSigningToken and HttpSigningConfiguration templates

8e96c78

Remove unused templates ApiTests, DependencyInjectionTests #1208 (comment)

Kwok-he-Chu mentioned this pull request Nov 20, 2025

[Do not merge] Upgraded Adyen's .NET generator to support latest OpenApiGenerator #1203

Closed

Kwok-he-Chu force-pushed the v7-generator/2-add-mustache-templates branch from 6d99b32 to 2e33dc4 Compare November 26, 2025 15:26

Kwok-he-Chu changed the base branch from v7-generator/1-add-core-classes to v7-generator/development-branch November 26, 2025 15:51

Kwok-he-Chu mentioned this pull request Nov 28, 2025

OpenAPIGenerator upgrade [development-branch] to v7.16.0 for Adyen's .NET Library #1214

Open

30 tasks

Kwok-he-Chu added 3 commits November 28, 2025 13:37

Added /Core classes and tests in preparations for the v7-generator-up…

d9dcffc

…grade

Include updated core classes for review

74b88ec

Add new mustache templates for v7

d49b160

Remove old mustache templates

Kwok-he-Chu force-pushed the v7-generator/2-add-mustache-templates branch from 2e33dc4 to d49b160 Compare November 28, 2025 12:38

Remove HttpSigningConfiguration and HttpSigningToken mustache templates

33998d6

galesky-a reviewed Nov 28, 2025

View reviewed changes

templates-v7/csharp/libraries/generichost/ApiResponse`1.mustache Show resolved Hide resolved

galesky-a reviewed Nov 28, 2025

View reviewed changes

		@@ -0,0 +1 @@
		{{#pathParams}}{{{dataType}}}{{>NullConditionalParameter}} {{paramName}}, {{/pathParams}}{{#queryParams}}{{#required}}{{{dataType}}}{{>NullConditionalParameter}} {{paramName}}, {{/required}}{{/queryParams}}{{#bodyParams}}{{{dataType}}}{{>NullConditionalParameter}} {{paramName}}, {{/bodyParams}}{{#queryParams}}{{^required}}Option<{{{dataType}}}{{>NullConditionalParameter}}> {{paramName}}{{#notRequiredOrIsNullable}} = default{{/notRequiredOrIsNullable}}, {{/required}}{{/queryParams}} RequestOptions? requestOptions = default, System.Threading.CancellationToken cancellationToken = default{{^netstandard20OrLater}}(global::System.Threading.CancellationToken){{/netstandard20OrLater}} No newline at end of file

OpenAPIGenerator upgrade to v7.16.0 - [2] Added new mustache templates #1208

Are you sure you want to change the base?

OpenAPIGenerator upgrade to v7.16.0 - [2] Added new mustache templates #1208

Uh oh!

Conversation

Kwok-he-Chu commented Nov 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

gemini-code-assist bot Nov 18, 2025

Choose a reason for hiding this comment

Uh oh!

Kwok-he-Chu Nov 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist bot Nov 18, 2025

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist bot Nov 18, 2025

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Kwok-he-Chu commented Nov 20, 2025

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Kwok-he-Chu commented Nov 18, 2025 •

edited

Loading

Kwok-he-Chu Nov 19, 2025 •

edited

Loading