From 83b0661fd55d1deb426bf31d7ff7c76060ae9307 Mon Sep 17 00:00:00 2001
From: Cristian Dominguez <cdominguez@salesforce.com>
Date: Mon, 31 Mar 2025 10:13:32 -0300
Subject: [PATCH 1/2] feat: add `no-auth` flag

---
 command-snapshot.json            |  2 +-
 messages/rest.md                 |  6 +++++-
 src/commands/api/request/rest.ts | 26 ++++++++++++++++++--------
 3 files changed, 24 insertions(+), 10 deletions(-)

diff --git a/command-snapshot.json b/command-snapshot.json
index 63d771f..3166805 100644
--- a/command-snapshot.json
+++ b/command-snapshot.json
@@ -12,7 +12,7 @@
     "command": "api:request:rest",
     "flagAliases": [],
     "flagChars": ["H", "S", "X", "b", "f", "i", "o"],
-    "flags": ["body", "file", "flags-dir", "header", "include", "method", "stream-to-file", "target-org"],
+    "flags": ["body", "file", "flags-dir", "header", "include", "method", "no-auth", "stream-to-file", "target-org"],
     "plugin": "@salesforce/plugin-api"
   }
 ]
diff --git a/messages/rest.md b/messages/rest.md
index f5c2ddf..a2ab5a8 100644
--- a/messages/rest.md
+++ b/messages/rest.md
@@ -81,4 +81,8 @@ HTTP header in "key:value" format.
 
 # flags.body.summary
 
-File or content for the body of the HTTP request. Specify "-" to read from standard input or "" for an empty body. If passing a file, prefix the filename with '@'. 
+File or content for the body of the HTTP request. Specify "-" to read from standard input or "" for an empty body. If passing a file, prefix the filename with '@'.
+
+# flags.no-auth.summary
+
+Skip the "Authentication" header.
diff --git a/src/commands/api/request/rest.ts b/src/commands/api/request/rest.ts
index 78a9f1f..830a0b2 100644
--- a/src/commands/api/request/rest.ts
+++ b/src/commands/api/request/rest.ts
@@ -81,6 +81,9 @@ export class Rest extends SfCommand<void> {
       helpValue: 'file',
       char: 'b',
     }),
+    'no-auth': Flags.boolean({
+      summary: messages.getMessage('flags.no-auth.summary'),
+    }),
   };
 
   public static args = {
@@ -138,20 +141,27 @@ export class Rest extends SfCommand<void> {
       headers = { ...headers, ...body.getHeaders() };
     }
 
-    // refresh access token to ensure `got` gets a valid access token.
-    // TODO: we could skip this step if we used jsforce's HTTP module instead (handles expired tokens).
-    await org.refreshAuth();
+    const skipAuth = flags['no-auth'];
+    if (!skipAuth) {
+      // refresh access token to ensure `got` gets a valid access token.
+      // TODO: we could skip this step if we used jsforce's HTTP module instead (handles expired tokens).
+      await org.refreshAuth();
+    }
 
     const options = {
       agent: { https: new ProxyAgent() },
       method,
       headers: {
         ...SFDX_HTTP_HEADERS,
-        Authorization: `Bearer ${
-          // we don't care about apiVersion here, just need to get the access token.
-          // eslint-disable-next-line sf-plugin/get-connection-with-version
-          org.getConnection().getConnectionOptions().accessToken!
-        }`,
+        ...(skipAuth
+          ? {}
+          : {
+              Authorization: `Bearer ${
+                // we don't care about apiVersion here, just need to get the access token.
+                // eslint-disable-next-line sf-plugin/get-connection-with-version
+                org.getConnection().getConnectionOptions().accessToken!
+              }`,
+            }),
         ...headers,
       },
       body,

From 2b0d564d7a48757bb91059795c450a69277b306f Mon Sep 17 00:00:00 2001
From: Cristian Dominguez <6853656+cristiand391@users.noreply.github.com>
Date: Wed, 16 Apr 2025 18:58:20 -0300
Subject: [PATCH 2/2] Update messages/rest.md

Co-authored-by: Juliet Shackell <63259011+jshackell-sfdc@users.noreply.github.com>
---
 messages/rest.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/messages/rest.md b/messages/rest.md
index a2ab5a8..52c31aa 100644
--- a/messages/rest.md
+++ b/messages/rest.md
@@ -85,4 +85,4 @@ File or content for the body of the HTTP request. Specify "-" to read from stand
 
 # flags.no-auth.summary
 
-Skip the "Authentication" header.
+Don't add the "Authorization: Bearer <token>" header to the request.