src/client.ts (1)

89-97: ⚠️ Potential issue | 🟠 Major

getContext() still permits unauthenticated requests via forwarded options.

Because options is spread directly, callers can pass auth: false and bypass headers for context GET. If the intended contract is always-auth for getContext(), ignore or strip auth here.

🔧 Suggested hardening for `getContext()`

 getContext(options?: Partial<ClientRequestOptions>) {
+  const { auth: _auth, method: _method, path: _path, query: _query, ...rest } = options ?? {};
   return this.get({
-    ...options,
+    ...rest,
     path: "/context",
     query: {
       application: this._opts.application.name,
       environment: this._opts.environment,
     },
   });
 }

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@src/client.ts` around lines 89 - 97, getContext currently forwards
caller-supplied options which allows bypassing authentication by passing auth:
false; update getContext (in src/client.ts) so it always enforces authentication
by overriding/stripping any auth flag from the merged options (e.g., explicitly
set auth: true or delete auth before calling this.get), ensuring the request to
path "/context" uses the client's intended auth headers regardless of the passed
Partial<ClientRequestOptions>.