feat(ruby): remove omitted basic auth fields from SDK API, add WireMock auth matching

generators/ruby-v2/dynamic-snippets/src/EndpointSnippetGenerator.ts

@@ -213,16 +213,28 @@ export class EndpointSnippetGenerator {
         auth: FernIr.dynamic.BasicAuth;
         values: FernIr.dynamic.BasicAuthValues;
     }): ruby.KeywordArgument[] {
-        return [
-            ruby.keywordArgument({
-                name: auth.username.snakeCase.safeName,
-                value: ruby.TypeLiteral.string(values.username)
-            }),
-            ruby.keywordArgument({
-                name: auth.password.snakeCase.safeName,
-                value: ruby.TypeLiteral.string(values.password)
-            })
-        ];
+        // usernameOmit/passwordOmit may exist in newer IR versions
+        const authRecord = auth as unknown as Record<string, unknown>;
+        const usernameOmitted = !!authRecord.usernameOmit;
+        const passwordOmitted = !!authRecord.passwordOmit;
+        const args: ruby.KeywordArgument[] = [];
+        if (!usernameOmitted) {
+            args.push(
+                ruby.keywordArgument({
+                    name: auth.username.snakeCase.safeName,
+                    value: ruby.TypeLiteral.string(values.username)
+                })
+            );
+        }
+        if (!passwordOmitted) {
+            args.push(
+                ruby.keywordArgument({
+                    name: auth.password.snakeCase.safeName,
+                    value: ruby.TypeLiteral.string(values.password)
+                })
+            );
+        }
+        return args;
     }
 
     private getRootClientBearerAuthArgs({

generators/ruby-v2/sdk/src/root-client/RootClientGenerator.ts

@@ -116,31 +116,59 @@ export class RootClientGenerator extends FileGenerator<RubyFile, SdkCustomConfig
                     writer.write(`headers = `);
                     writer.writeNode(this.getRawClientHeaders());
                     writer.newLine();
+                    let isFirstBlock = true;
+                    let emittedAnyBlock = false;
                     for (let i = 0; i < basicAuthSchemes.length; i++) {
                         const basicAuthScheme = basicAuthSchemes[i];
                         if (basicAuthScheme == null) {
                             continue;
                         }
                         const usernameName = this.case.snakeSafe(basicAuthScheme.username);
                         const passwordName = this.case.snakeSafe(basicAuthScheme.password);
+                        const usernameOmitted = !!basicAuthScheme.usernameOmit;
+                        const passwordOmitted = !!basicAuthScheme.passwordOmit;
+                        // Build the credential string for Base64 encoding.
+                        // Omitted fields become empty (e.g., password omitted → "#{username}:").
+                        let credentialStr: string;
+                        if (usernameOmitted && !passwordOmitted) {
+                            credentialStr = `":#{${passwordName}}"`;
+                        } else if (!usernameOmitted && passwordOmitted) {
+                            credentialStr = `"#{${usernameName}}:"`;
+                        } else {
+                            credentialStr = `"#{${usernameName}}:#{${passwordName}}"`;
+                        }
+                        // Condition: only require non-omitted fields to be present
+                        let condition: string;
+                        if (!usernameOmitted && !passwordOmitted) {
+                            condition = `!${usernameName}.nil? && !${passwordName}.nil?`;
+                        } else if (usernameOmitted && !passwordOmitted) {
+                            condition = `!${passwordName}.nil?`;
+                        } else if (!usernameOmitted && passwordOmitted) {
+                            condition = `!${usernameName}.nil?`;
+                        } else {
+                            // Both fields omitted — skip auth header entirely when auth is non-mandatory
+                            continue;
+                        }
                         if (isAuthOptional || basicAuthSchemes.length > 1) {
-                            if (i === 0) {
-                                writer.writeLine(`if !${usernameName}.nil? && !${passwordName}.nil?`);
+                            if (isFirstBlock) {
+                                writer.writeLine(`if ${condition}`);
                             } else {
-                                writer.writeLine(`elsif !${usernameName}.nil? && !${passwordName}.nil?`);
+                                writer.writeLine(`elsif ${condition}`);
                             }
+                            isFirstBlock = false;
+                            emittedAnyBlock = true;
                             writer.writeLine(
-                                `  headers["Authorization"] = "Basic #{Base64.strict_encode64("#{${usernameName}}:#{${passwordName}}")}"`
+                                `  headers["Authorization"] = "Basic #{Base64.strict_encode64(${credentialStr})}"`
                             );
-                            if (i === basicAuthSchemes.length - 1) {
-                                writer.writeLine(`end`);
-                            }
                         } else {
                             writer.writeLine(
-                                `headers["Authorization"] = "Basic #{Base64.strict_encode64("#{${usernameName}}:#{${passwordName}}")}"`
+                                `headers["Authorization"] = "Basic #{Base64.strict_encode64(${credentialStr})}"`
                             );
                         }
                     }
+                    if (emittedAnyBlock && (isAuthOptional || basicAuthSchemes.length > 1)) {
+                        writer.writeLine(`end`);
+                    }
                 }
                 writer.write(`@raw_client = `);
                 writer.writeNode(this.context.getRawClientClassReference());
@@ -344,30 +372,37 @@ export class RootClientGenerator extends FileGenerator<RubyFile, SdkCustomConfig
                     break;
                 }
                 case "basic": {
-                    const usernameParam = ruby.parameters.keyword({
-                        name: this.case.snakeSafe(scheme.username),
-                        type: ruby.Type.string(),
-                        initializer:
-                            scheme.usernameEnvVar != null
-                                ? ruby.codeblock((writer) => {
-                                      writer.write(`ENV.fetch("${scheme.usernameEnvVar}", nil)`);
-                                  })
-                                : undefined,
-                        docs: undefined
-                    });
-                    parameters.push(usernameParam);
-                    const passwordParam = ruby.parameters.keyword({
-                        name: this.case.snakeSafe(scheme.password),
-                        type: ruby.Type.string(),
-                        initializer:
-                            scheme.passwordEnvVar != null
-                                ? ruby.codeblock((writer) => {
-                                      writer.write(`ENV.fetch("${scheme.passwordEnvVar}", nil)`);
-                                  })
-                                : undefined,
-                        docs: undefined
-                    });
-                    parameters.push(passwordParam);
+                    // When omit is true, the field is completely removed from the end-user API.
+                    const usernameOmitted = !!scheme.usernameOmit;
+                    const passwordOmitted = !!scheme.passwordOmit;
+                    if (!usernameOmitted) {
+                        const usernameParam = ruby.parameters.keyword({
+                            name: this.case.snakeSafe(scheme.username),
+                            type: ruby.Type.string(),
+                            initializer:
+                                scheme.usernameEnvVar != null
+                                    ? ruby.codeblock((writer) => {
+                                          writer.write(`ENV.fetch("${scheme.usernameEnvVar}", nil)`);
+                                      })
+                                    : undefined,
+                            docs: undefined
+                        });
+                        parameters.push(usernameParam);
+                    }
+                    if (!passwordOmitted) {
+                        const passwordParam = ruby.parameters.keyword({
+                            name: this.case.snakeSafe(scheme.password),
+                            type: ruby.Type.string(),
+                            initializer:
+                                scheme.passwordEnvVar != null
+                                    ? ruby.codeblock((writer) => {
+                                          writer.write(`ENV.fetch("${scheme.passwordEnvVar}", nil)`);
+                                      })
+                                    : undefined,
+                            docs: undefined
+                        });
+                        parameters.push(passwordParam);
+                    }
                     break;
                 }
                 case "inferred": {

generators/ruby-v2/sdk/src/wire-tests/WireTestGenerator.ts

@@ -210,8 +210,12 @@ export class WireTestGenerator {
                     authParams.push(`${this.case.snakeSafe(scheme.name)}: "test-api-key"`);
                     break;
                 case "basic":
-                    authParams.push(`${this.case.snakeSafe(scheme.username)}: "test-username"`);
-                    authParams.push(`${this.case.snakeSafe(scheme.password)}: "test-password"`);
+                    if (!scheme.usernameOmit) {
+                        authParams.push(`${this.case.snakeSafe(scheme.username)}: "test-username"`);
+                    }
+                    if (!scheme.passwordOmit) {
+                        authParams.push(`${this.case.snakeSafe(scheme.password)}: "test-password"`);
+                    }
                     break;
                 case "oauth":
                     authParams.push('client_id: "test-client-id"');
@@ -348,6 +352,19 @@ export class WireTestGenerator {
             lines.push(`      query_params: ${queryParamsCode},`);
             lines.push(`      expected: 1`);
             lines.push(`    )`);
+
+            // Verify Authorization header when basic auth is configured
+            const expectedAuthHeader = this.buildExpectedAuthorizationHeader();
+            if (expectedAuthHeader != null) {
+                lines.push(``);
+                lines.push(`    verify_authorization_header(`);
+                lines.push(`      test_id: test_id,`);
+                lines.push(`      method: "${endpoint.method}",`);
+                lines.push(`      url_path: "${basePath}",`);
+                lines.push(`      expected_value: "${expectedAuthHeader}"`);
+                lines.push(`    )`);
+            }
+
             lines.push("  end");
 
             return lines;
@@ -532,6 +549,26 @@ export class WireTestGenerator {
         return out;
     }
 
+    /**
+     * Builds the expected Authorization header value for basic auth.
+     * Returns the full header value (e.g., "Basic dGVzdC11c2VybmFtZTp0ZXN0LXBhc3N3b3Jk")
+     * or null if no basic auth scheme is configured.
+     */
+    private buildExpectedAuthorizationHeader(): string | null {
+        for (const scheme of this.context.ir.auth.schemes) {
+            if (scheme.type === "basic") {
+                if (scheme.usernameOmit && scheme.passwordOmit) {
+                    continue;
+                }
+                const username = scheme.usernameOmit ? "" : "test-username";
+                const password = scheme.passwordOmit ? "" : "test-password";
+                const encoded = Buffer.from(`${username}:${password}`).toString("base64");
+                return `Basic ${encoded}`;
+            }
+        }
+        return null;
+    }
+
     private toPascalCase(str: string): string {
         return str
             .split("_")

generators/ruby-v2/sdk/src/wire-tests/WireTestSetupGenerator.ts

@@ -298,6 +298,31 @@ class WireMockTestCase < Minitest::Test
 
     assert_equal expected, requests.length, "Expected #{expected} requests, found #{requests.length}"
   end
+
+  # Verifies that the Authorization header on captured requests matches the expected value.
+  #
+  # @param test_id [String] The test ID used to filter requests
+  # @param method [String] The HTTP method (GET, POST, etc.)
+  # @param url_path [String] The URL path to match
+  # @param expected_value [String] The expected Authorization header value
+  def verify_authorization_header(test_id:, method:, url_path:, expected_value:)
+    admin_url = ENV['WIREMOCK_URL'] ? "#{ENV['WIREMOCK_URL']}/__admin" : WIREMOCK_ADMIN_URL
+    uri = URI("#{admin_url}/requests/find")
+    http = Net::HTTP.new(uri.host, uri.port)
+    post_request = Net::HTTP::Post.new(uri.path, { "Content-Type" => "application/json" })
+
+    request_body = { "method" => method, "urlPath" => url_path }
+    request_body["headers"] = { "X-Test-Id" => { "equalTo" => test_id } }
+
+    post_request.body = request_body.to_json
+    response = http.request(post_request)
+    result = JSON.parse(response.body)
+    requests = result["requests"] || []
+
+    refute_empty requests, "No requests found for test_id #{test_id}"
+    actual_header = requests.first.dig("request", "headers", "Authorization")
+    assert_equal expected_value, actual_header, "Expected Authorization header '#{expected_value}', got '#{actual_header}'"
+  end
 end
 `;
     }

generators/ruby-v2/sdk/versions.yml

@@ -1,5 +1,17 @@
 # yaml-language-server: $schema=../../../fern-versions-yml.schema.json
 
+- version: 1.4.0
+  changelogEntry:
+    - summary: |
+        Support omitting username or password from basic auth when configured via
+        `usernameOmit` or `passwordOmit` in the IR. Omitted fields are removed from
+        the SDK's public API and treated as empty strings internally (e.g., omitting
+        password encodes `username:`, omitting username encodes `:password`). When
+        both are omitted, the Authorization header is skipped entirely.
+      type: feat
+  createdAt: "2026-04-02"
+  irVersion: 66
+
 - version: 1.3.0-rc.1
   changelogEntry:
     - summary: |

packages/commons/mock-utils/index.ts

@@ -15,7 +15,7 @@ export interface WireMockMapping {
     request: {
         urlPathTemplate: string;
         method: string;
-        headers?: Record<string, { matches: string }>;
+        headers?: Record<string, { matches?: string; equalTo?: string }>;
         pathParameters?: Record<string, { equalTo: string }>;
         queryParameters?: Record<string, { equalTo: string }>;
         formParameters?: Record<string, unknown>;
@@ -267,16 +267,27 @@ export class WireMock {
         const shouldAddBodyPattern = needsBodyPattern && isSseResponse;
 
         // Build auth header matchers for endpoints that require authentication.
-        // Skip auth header matching when endpoint has per-endpoint security because
-        // the client configures all auth schemes globally and header overwriting
-        // (e.g., multiple schemes writing to "Authorization") makes the exact value unpredictable.
-        const authHeaders: Record<string, { matches: string }> = {};
-        if (endpoint.auth && !(endpoint.security != null && endpoint.security.length > 0)) {
+        const authHeaders: Record<string, { matches?: string; equalTo?: string }> = {};
+        if (endpoint.auth) {
             for (const scheme of ir.auth.schemes) {
                 switch (scheme.type) {
-                    case "basic":
-                        authHeaders["Authorization"] = { matches: "Basic .+" };
+                    case "basic": {
+                        // Compute exact Authorization header using test credentials.
+                        // Access usernameOmit/passwordOmit via runtime property check
+                        // (available in IR v63+ but @fern-fern/ir-sdk types may lag).
+                        const schemeRecord = scheme as unknown as Record<string, unknown>;
+                        const usernameOmit = schemeRecord.usernameOmit === true;
+                        const passwordOmit = schemeRecord.passwordOmit === true;
+                        if (usernameOmit && passwordOmit) {
+                            // Both omitted — SDK skips the Authorization header entirely.
+                            break;
+                        }
+                        const username = usernameOmit ? "" : "test-username";
+                        const password = passwordOmit ? "" : "test-password";
+                        const encoded = Buffer.from(`${username}:${password}`).toString("base64");
+                        authHeaders["Authorization"] = { equalTo: `Basic ${encoded}` };
                         break;
+                    }
                     case "bearer":
                         authHeaders["Authorization"] = { matches: "Bearer .+" };
                         break;