From 5bb0ce9a19bddbb92376a43a175691cbcb4c95a5 Mon Sep 17 00:00:00 2001
From: Dipesh Babu <dipeshmahato@outlook.com>
Date: Fri, 31 Jul 2026 04:08:41 -0400
Subject: [PATCH] Reject unsupported scan authentication modes

---
 sdk/typescript/src/api.ts           |  5 +++++
 sdk/typescript/tests-ts/api.test.ts | 29 +++++++++++++++++++++++++++++
 2 files changed, 34 insertions(+)

diff --git a/sdk/typescript/src/api.ts b/sdk/typescript/src/api.ts
index 32269c0..32c3425 100644
--- a/sdk/typescript/src/api.ts
+++ b/sdk/typescript/src/api.ts
@@ -1712,6 +1712,11 @@ export function scanAuthentication(
   environment: ProcessEnvironment,
   auth: ScanAuthMode = "auto",
 ): ScanAuthentication {
+  if (auth !== "auto" && auth !== "chatgpt" && auth !== "api-key") {
+    throw new TypeError(
+      "Scan authentication mode must be auto, chatgpt, or api-key.",
+    );
+  }
   if (auth === "chatgpt") {
     return { method: "stored_credentials", verified: false };
   }
diff --git a/sdk/typescript/tests-ts/api.test.ts b/sdk/typescript/tests-ts/api.test.ts
index 0ce7f5b..282d670 100644
--- a/sdk/typescript/tests-ts/api.test.ts
+++ b/sdk/typescript/tests-ts/api.test.ts
@@ -867,6 +867,35 @@ describe("CodexSecurity orchestration", () => {
     await client.close();
   });
 
+  test("rejects unsupported authentication modes before runtime initialization", async () => {
+    const root = await temporaryDirectory();
+    const repository = join(root, "repository");
+    await mkdir(repository);
+    let runtimeStarted = false;
+    const client = new TestClient(
+      {},
+      {
+        environment: { OPENAI_API_KEY: "synthetic-openai-key" },
+        prepareRuntime: async () => {
+          runtimeStarted = true;
+          throw new Error("runtime should not initialize");
+        },
+      },
+    );
+    const options = {
+      auth: "unsupported",
+    } as unknown as ScanOptions;
+
+    await expect(client.preflight(repository, options)).rejects.toThrow(
+      "Scan authentication mode must be auto, chatgpt, or api-key.",
+    );
+    await expect(client.run(repository, options)).rejects.toThrow(
+      "Scan authentication mode must be auto, chatgpt, or api-key.",
+    );
+    expect(runtimeStarted).toBe(false);
+    await client.close();
+  });
+
   test("rejects explicit API-key authentication without a configured key before runtime initialization", async () => {
     const root = await temporaryDirectory();
     const repository = join(root, "repository");