Repository: microsoft/kiota (csharp)

Issue:
Regression bug - Kiota should create the right runtime with auth information when security scheme is HTTP bearer token
When using an OpenAPI description that contains the supported auth (HTTP bearer token), Kiota is generating the plugin manifest with runtime "None".

OpenAPI description used:
```yaml
openapi: 3.0.4
info:
  title: Todoist API - Subset - Subset
  description: OpenAPI specification for Todoist REST API.
  version: '2.0'
servers:
  - url: https://api.todoist.com/rest/v2
paths:
  /tasks:
    get:
      summary: Get Active Tasks
      operationId: getActiveTasks
      parameters:
        - name: project_id
          in: query
          description: Filter tasks by project ID
          explode: false
          schema:
            type: string
        - name: section_id
          in: query
          description: Filter tasks by section ID
          explode: false
          schema:
            type: string
        - name: label
          in: query
          description: Filter tasks by label
          explode: false
          schema:
            type: string
        - name: filter
          in: query
          description: 'Filter tasks by a specified filter (e.g., ''today'')'
          explode: false
          schema:
            type: string
        - name: lang
          in: query
          description: Language for filter interpretation
          explode: false
          schema:
            type: string
            default: en
        - name: ids
          in: query
          description: A comma-separated list of task IDs to retrieve
          explode: false
          schema:
            type: array
            items:
              type: integer
      responses:
        '200':
          description: A JSON-encoded array containing all active tasks
          content:
            application/json:
              schema:
                type: array
                items:
                  type: object
                  properties:
                    id:
                      type: string
                    content:
                      type: string
                    description:
                      type: string
                    project_id:
                      type: string
                    section_id:
                      type: string
                    parent_id:
                      type: string
                    order:
                      type: integer
                    labels:
                      type: array
                      items:
                        type: string
                    priority:
                      type: integer
                    due:
                      type: object
                      properties:
                        date:
                          type: string
                        is_recurring:
                          type: boolean
                        datetime:
                          type: string
                          format: date-time
                        string:
                          type: string
                        timezone:
                          type: string
                    assignee_id:
                      type: string
                    assigner_id:
                      type: string
                    comment_count:
                      type: integer
                    is_completed:
                      type: boolean
                    url:
                      type: string
                      format: uri
    post:
      summary: Create a New Task
      operationId: createTask
      requestBody:
        content:
          application/json:
            schema:
              required:
                - content
              type: object
              properties:
                content:
                  type: string
                description:
                  type: string
                project_id:
                  type: string
                section_id:
                  type: string
                parent_id:
                  type: string
                order:
                  type: integer
                labels:
                  type: array
                  items:
                    type: string
                priority:
                  type: integer
                due_string:
                  type: string
                due_date:
                  type: string
                due_datetime:
                  type: string
                  format: date-time
                due_lang:
                  type: string
                assignee_id:
                  type: string
        required: true
      responses:
        '200':
          description: The newly created task
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: string
                  content:
                    type: string
                  description:
                    type: string
                  project_id:
                    type: string
                  section_id:
                    type: string
                  parent_id:
                    type: string
                  order:
                    type: integer
                  labels:
                    type: array
                    items:
                      type: string
                  priority:
                    type: integer
                  due:
                    type: object
                    properties:
                      date:
                        type: string
                      is_recurring:
                        type: boolean
                      datetime:
                        type: string
                        format: date-time
                      string:
                        type: string
                      timezone:
                        type: string
                  assignee_id:
                    type: string
                  assigner_id:
                    type: string
                  comment_count:
                    type: integer
                  is_completed:
                    type: boolean
                  url:
                    type: string
                    format: uri
components:
  securitySchemes:
    BearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
security:
  - BearerAuth: [ ]
```

What was generated:
```jsonc
{
  "$schema": "https://developer.microsoft.com/json-schemas/copilot/plugin/v2.1/schema.json",
  "schema_version": "v2.1",
  "name_for_human": "Todoist API - Subset",
  "description_for_human": "OpenAPI specification for Todoist REST API.",
  "description_for_model": "OpenAPI specification for Todoist REST API.",
  "contact_email": "publisher-email@example.com",
  "namespace": "Todoist",
  "capabilities": {
    "conversation_starters": [
      {
        "text": "Get Active Tasks"
      },
      {
        "text": "Create a New Task"
      }
    ]
  },
  "functions": [
    {
      "name": "createTask",
      "description": "Create a New Task"
    },
    {
      "name": "getActiveTasks",
      "description": "Get Active Tasks"
    }
  ],
  "runtimes": [
    {
      "type": "OpenApi",
      "auth": {
        "type": "None"
      },
      "spec": {
        "url": "todoist-openapi.yml"
      },
      "run_for_functions": [
        "getActiveTasks",
        "createTask"
      ]
    }
  ]
}
```

What should be generated:
```jsonc
"runtimes": [
  {
    "type": "OpenApi",
      "auth": {
        "type": "ApiKeyPluginVault",
        "reference_id": "{{BEARERAUTH_REGISTRATION_ID}}"
      }
  }
]
```

Pull request:
Fixes #6357

Patch:
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 228bea8978..0dc4050c46 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -12,6 +12,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Added
 
 ### Changed
+- Fixed a bug with creating the correct runtime with auth using http bearer security scheme or when root auth is set. [#6357](https://github.com/microsoft/kiota/issues/6357)   
 
 ## [1.24.3] - 2025-03-26
 
diff --git a/src/Kiota.Builder/Plugins/PluginsGenerationService.cs b/src/Kiota.Builder/Plugins/PluginsGenerationService.cs
index 55d2063b63..62e2ee1ee9 100644
--- a/src/Kiota.Builder/Plugins/PluginsGenerationService.cs
+++ b/src/Kiota.Builder/Plugins/PluginsGenerationService.cs
@@ -480,9 +480,14 @@ private static (OpenApiRuntime[], Function[], ConversationStarter[]) GetRuntimes
             foreach (var operation in pathItem.Operations.Values.Where(static x => !string.IsNullOrEmpty(x.OperationId)))
             {
                 var auth = configAuth;
+
                 try
                 {
-                    auth = configAuth ?? GetAuth(operation.Security ?? document.Security ?? []);
+                    // Priority order: operation security > document security > empty list
+                    var securityToUse = operation.Security?.Count > 0 ? operation.Security :
+                                    document.Security?.Count > 0 ? document.Security :
+                                    new List<OpenApiSecurityRequirement>();
+                    auth = configAuth ?? GetAuth(securityToUse);
                 }
                 catch (UnsupportedSecuritySchemeException e)
                 {
@@ -557,7 +562,10 @@ private static Auth GetAuthFromSecurityScheme(OpenApiSecuritySchemeReference sec
             },
             // Only Http bearer is supported
             SecuritySchemeType.Http when "bearer".Equals(securityScheme.Scheme, StringComparison.OrdinalIgnoreCase) =>
-                new ApiKeyPluginVault { ReferenceId = $"{{{name}_REGISTRATION_ID}}" },
+                new ApiKeyPluginVault
+                {
+                    ReferenceId = string.IsNullOrEmpty(authenticationReferenceId) ? $"{{{name}_REGISTRATION_ID}}" : authenticationReferenceId
+                },
             SecuritySchemeType.OpenIdConnect => new ApiKeyPluginVault
             {
                 ReferenceId = string.IsNullOrEmpty(authenticationReferenceId) ? $"{{{name}_REGISTRATION_ID}}" : authenticationReferenceId


Test patch:
diff --git a/tests/Kiota.Builder.Tests/Plugins/PluginsGenerationServiceTests.cs b/tests/Kiota.Builder.Tests/Plugins/PluginsGenerationServiceTests.cs
index 1c9c3872c5..e9f12b5ae3 100644
--- a/tests/Kiota.Builder.Tests/Plugins/PluginsGenerationServiceTests.cs
+++ b/tests/Kiota.Builder.Tests/Plugins/PluginsGenerationServiceTests.cs
@@ -452,20 +452,19 @@ public static TheoryData<string, string, string, PluginAuthConfiguration, Action
                 }
             },
             // security requirement in root object
-            // TODO: Revisit when https://github.com/microsoft/OpenAPI.NET/issues/1797 is fixed
-            // {
-            //     "{securitySchemes: {apiKey0: {type: apiKey, name: x-api-key, in: header }}}",
-            //     "security: [apiKey0: []]", string.Empty, null, resultingManifest =>
-            //     {
-            //         Assert.NotNull(resultingManifest.Document);
-            //         Assert.Empty(resultingManifest.Problems);
-            //         Assert.NotEmpty(resultingManifest.Document.Runtimes);
-            //         var auth0 = resultingManifest.Document.Runtimes[0].Auth;
-            //         Assert.IsType<ApiKeyPluginVault>(auth0);
-            //         Assert.Equal(AuthType.ApiKeyPluginVault, auth0?.Type);
-            //         Assert.Equal("{apiKey0_REGISTRATION_ID}", ((ApiKeyPluginVault)auth0!).ReferenceId);
-            //     }
-            // },
+            {
+                "{securitySchemes: {apiKey0: {type: apiKey, name: x-api-key, in: header }}}",
+                "security: [apiKey0: []]", string.Empty, null, resultingManifest =>
+                {
+                    Assert.NotNull(resultingManifest.Document);
+                    Assert.Empty(resultingManifest.Problems);
+                    Assert.NotEmpty(resultingManifest.Document.Runtimes);
+                    var auth0 = resultingManifest.Document.Runtimes[0].Auth;
+                    Assert.IsType<ApiKeyPluginVault>(auth0);
+                    Assert.Equal(AuthType.ApiKeyPluginVault, auth0?.Type);
+                    Assert.Equal("{apiKey0_REGISTRATION_ID}", ((ApiKeyPluginVault)auth0!).ReferenceId);
+                }
+            },
             // auth provided in config overrides openapi file auth
             {
                 "{securitySchemes: {apiKey0: {type: apiKey, name: x-api-key, in: header, x-ai-auth-reference-id: auth1234 }}}",
@@ -498,7 +497,7 @@ public static TheoryData<string, string, string, PluginAuthConfiguration, Action
             },
             // http bearer auth
             {
-                "{securitySchemes: {httpBearer0: {type: http, scheme: bearer}}}",
+                "{securitySchemes: {httpBearer0: {type: http, scheme: bearer, x-ai-auth-reference-id: bearer-1234}}}",
                 string.Empty, "security: [httpBearer0: []]", null, resultingManifest =>
                 {
                     Assert.NotNull(resultingManifest.Document);
@@ -507,7 +506,7 @@ public static TheoryData<string, string, string, PluginAuthConfiguration, Action
                     var auth0 = resultingManifest.Document.Runtimes[0].Auth;
                     Assert.IsType<ApiKeyPluginVault>(auth0);
                     Assert.Equal(AuthType.ApiKeyPluginVault, auth0?.Type);
-                    Assert.Equal("{httpBearer0_REGISTRATION_ID}", ((ApiKeyPluginVault)auth0!).ReferenceId);
+                    Assert.Equal("bearer-1234", ((ApiKeyPluginVault)auth0!).ReferenceId);
                 }
             },
             // openid connect auth