fix: Do now allow sdk header override

Author: razor-x

lib/seam/request.rb

@@ -20,6 +20,12 @@ def self.create_faraday_client(endpoint, auth_headers, faraday_options = {}, far
         }
 
         options = deep_merge(default_options, faraday_options)
+        options.delete("headers")
+        options[:headers] = merge_headers(
+          faraday_options[:headers] || faraday_options["headers"] || {},
+          auth_headers,
+          default_headers
+        )
 
         default_faraday_retry_options = {
           max: 2,
@@ -104,7 +110,23 @@ def self.deep_merge(hash1, hash2)
         result
       end
 
-      private_class_method :deep_merge
+      def self.merge_headers(*headers_list)
+        result = {}
+        header_keys = {}
+
+        headers_list.each do |headers|
+          headers.each do |key, value|
+            normalized_key = key.to_s.downcase
+            result.delete(header_keys[normalized_key]) if header_keys.key?(normalized_key)
+            header_keys[normalized_key] = key
+            result[key] = value
+          end
+        end
+
+        result
+      end
+
+      private_class_method :deep_merge, :merge_headers
     end
   end
 end

spec/seam_client/faraday_options_spec.rb

@@ -27,6 +27,26 @@
       expect(seam.client.headers["seam-sdk-name"]).to eq("seamapi/ruby")
     end
 
+    it "does not let faraday_options override auth or SDK headers" do
+      seam = described_class.new(
+        api_key: seed["seam_apikey1_token"],
+        endpoint: endpoint,
+        faraday_options: {
+          headers: {
+            "Authorization" => "Bearer caller_token",
+            "Content-Type" => "text/plain",
+            "Seam-Sdk-Name" => "caller-sdk",
+            :"seam-sdk-version" => "0.0.0"
+          }
+        }
+      )
+
+      expect(seam.client.headers["Authorization"]).to eq("Bearer #{seed["seam_apikey1_token"]}")
+      expect(seam.client.headers["Content-Type"]).to eq("application/json")
+      expect(seam.client.headers["seam-sdk-name"]).to eq("seamapi/ruby")
+      expect(seam.client.headers["seam-sdk-version"]).to eq(Seam::VERSION)
+    end
+
     it "still authorizes requests against the server" do
       seam = described_class.new(
         api_key: seed["seam_apikey1_token"],

spec/seam_client/headers_spec.rb

@@ -29,6 +29,38 @@
     expect(stub).to have_been_requested
   end
 
+  it "sends the SDK and auth headers over caller-provided duplicates" do
+    stub = stub_request(:post, "#{Seam::DEFAULT_ENDPOINT}/devices/get")
+      .with(
+        headers: {
+          "Authorization" => "Bearer seam_some_api_key",
+          "Content-Type" => "application/json",
+          "seam-sdk-name" => "seamapi/ruby",
+          "seam-sdk-version" => Seam::VERSION
+        }
+      )
+      .to_return(
+        status: 200,
+        body: {device: {device_id: device_id}}.to_json,
+        headers: {"Content-Type" => "application/json"}
+      )
+
+    seam = Seam.new(
+      api_key: "seam_some_api_key",
+      faraday_options: {
+        headers: {
+          "Authorization" => "Bearer caller_token",
+          "Content-Type" => "text/plain",
+          "Seam-Sdk-Name" => "caller-sdk",
+          :"seam-sdk-version" => "0.0.0"
+        }
+      }
+    )
+    seam.devices.get(device_id: device_id)
+
+    expect(stub).to have_been_requested
+  end
+
   it "sends the workspace header with a personal access token" do
     stub = stub_request(:post, "#{Seam::DEFAULT_ENDPOINT}/devices/get")
       .with(