feat(a2a): Add API key authentication provider (#19548)

packages/core/src/agents/agentLoader.ts

@@ -48,7 +48,6 @@ interface FrontmatterAuthConfig {
   agent_card_requires_auth?: boolean;
   // API Key
   key?: string;
-  in?: 'header' | 'query' | 'cookie';
   name?: string;
   // HTTP
   scheme?: 'Bearer' | 'Basic';
@@ -129,7 +128,6 @@ const apiKeyAuthSchema = z.object({
   ...baseAuthFields,
   type: z.literal('apiKey'),
   key: z.string().min(1, 'API key is required'),
-  in: z.enum(['header', 'query', 'cookie']).optional(),
   name: z.string().optional(),
 });
 
@@ -138,24 +136,18 @@ const apiKeyAuthSchema = z.object({
  * Note: Validation for scheme-specific fields is applied in authConfigSchema
  * since discriminatedUnion doesn't support refined schemas directly.
  */
-const httpAuthSchemaBase = z.object({
+const httpAuthSchema = z.object({
   ...baseAuthFields,
   type: z.literal('http'),
   scheme: z.enum(['Bearer', 'Basic']),
-  token: z.string().optional(),
-  username: z.string().optional(),
-  password: z.string().optional(),
+  token: z.string().min(1).optional(),
+  username: z.string().min(1).optional(),
+  password: z.string().min(1).optional(),
 });
 
-/**
- * Combined auth schema - discriminated union of all auth types.
- * Note: We use the base schema for discriminatedUnion, then apply refinements
- * via superRefine since discriminatedUnion doesn't support refined schemas directly.
- */
 const authConfigSchema = z
-  .discriminatedUnion('type', [apiKeyAuthSchema, httpAuthSchemaBase])
+  .discriminatedUnion('type', [apiKeyAuthSchema, httpAuthSchema])
   .superRefine((data, ctx) => {
-    // Apply HTTP auth validation after union parsing
     if (data.type === 'http') {
       if (data.scheme === 'Bearer' && !data.token) {
         ctx.addIssue({
@@ -164,12 +156,21 @@ const authConfigSchema = z
           path: ['token'],
         });
       }
-      if (data.scheme === 'Basic' && (!data.username || !data.password)) {
-        ctx.addIssue({
-          code: z.ZodIssueCode.custom,
-          message: 'Basic scheme requires "username" and "password"',
-          path: data.username ? ['password'] : ['username'],
-        });
+      if (data.scheme === 'Basic') {
+        if (!data.username) {
+          ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            message: 'Basic authentication requires "username"',
+            path: ['username'],
+          });
+        }
+        if (!data.password) {
+          ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            message: 'Basic authentication requires "password"',
+            path: ['password'],
+          });
+        }
       }
     }
   });
@@ -338,7 +339,6 @@ function convertFrontmatterAuthToConfig(
         ...base,
         type: 'apiKey',
         key: frontmatter.key,
-        location: frontmatter.in,
         name: frontmatter.name,
       };