Load API specifications from a remote URL with authentication (Apicurio Registry / HTTP)

[joseegman-idoneea]

Loads spec files from a remote URL for both OpenAPI and AsyncAPI, including authentication for protected registries. Implements joseegman-idoneea#7 and joseegman-idoneea#8.

What

specFile.filePath accepts an http/https/file URL; the spec is fetched at generation time. This is the mechanism to consume a spec published in an Apicurio Registry (artifacts served over HTTP) or any URL-addressable source.

<specFile>
    <filePath>https://my-apicurio-host/apis/registry/v2/groups/default/artifacts/my-api</filePath>
    <apiPackage>com.example.api</apiPackage>
    <modelPackage>com.example.model</modelPackage>
</specFile>

How

• PathUtil.isRemoteUri detects URL-scheme paths; SchemaUtil.readFile fetches remote specs — the shared main-spec reader for both generators, so one change covers OpenAPI and AsyncAPI.
• RemoteFileLocation resolves external $refs relative to a remote spec's base URL; AsyncApiGenerator/BaseAsyncApiHandler/ApiTool/OpenApiGenerator handle remote locations and $ref bases.

Security / robustness

• Bounded timeouts (connect 15s / read 30s) — an unresponsive server can't hang the build.
• Scheme allowlist: http/https/file only (no ftp).
• Authentication from system properties / environment variables (never from build files): bearer token, basic auth, or an arbitrary header (e.g. X-Registry-ApiKey). Applied only to http/https.
• Host scoping (scs.multiapi.remote.host / SCS_MULTIAPI_REMOTE_HOST): credentials are sent only to the configured host, so a token is never leaked to another host via an external $ref or cross-host redirect. Credentials are never logged; TLS validation is unchanged.

Tests

• PathUtilTest (scheme detection, bearer/basic/custom-header, host scoping) and a SchemaUtil file:// URL-loading test — network-free and deterministic.
• Full multiapi-engine suite: 118/118 (mvn clean test).

Docs & version

• New README section "Loading specifications from a remote URL" incl. an authentication table.
• Rebased on current main (6.5.3, after Release 6.5.3: Gradle JDK 21 fix + OpenAPI 3.1 refinements (enum metadata, deprecated) #384). Bumps to 6.6.0 (new feature).

🤖 Generated with Claude Code

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 23 complexity · 0 duplication

Metric	Results
Complexity	23
Duplication	0

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}