fix(httpapi): match the Bearer auth scheme case-insensitively (#1754)

## Bug

The REST auth middleware only recognises an `Authorization` header that
starts with the exact bytes `Bearer `. The auth-scheme name is
case-insensitive (RFC 7235 §2.1, RFC 6750 §2.1), so a client or proxy
that sends `bearer <key>` or `BEARER <key>` is rejected with `401
Invalid or missing API key` even though the key is valid. Because
precedence is decided by header *membership*, the request never falls
back to `?apikey=` or the session cookie either.

## Trigger

```
curl -H 'Authorization: bearer <api-key>' http://127.0.0.1:8080/api/v1/status   # 401
curl -H 'Authorization: Bearer <api-key>' http://127.0.0.1:8080/api/v1/status   # 200
```

## Fix

Add a small `bearerToken(header)` helper in `internal/httpapi` that
compares the scheme with `strings.EqualFold`, and use it at the three
places that parse the header: `authenticateBearer`, `ExtractToken`, and
`sessionCredentialValue` (SSE re-check of a bearer JWT). The last one
has to match the first, otherwise a JWT accepted with a lowercase scheme
would read back as empty during the `/events` scope check.

## Test

`TestBearerScheme_CaseInsensitive` sends the admin key with `Bearer`,
`bearer` and `BEARER` through `ExtractToken` and through the full
`ServeHTTP` middleware, and checks that `Basic` still yields no token.

## Commands run

- `CGO_ENABLED=0 go test -count=1 ./internal/httpapi` — ok
- `CGO_ENABLED=0 go vet ./internal/httpapi` — clean
- With the fix reverted (`git stash` of `server.go` and `sse_scope.go`):
`go test -count=1 -run TestBearerScheme ./internal/httpapi` — FAIL (the
`bearer` and `BEARER` subtests: token mismatch and 401)
- `gofmt -l` on the edited files — no output

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: rudycelekli

internal/httpapi/bearer_scheme_case_test.go

@@ -0,0 +1,35 @@
+package httpapi
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"go.uber.org/zap"
+
+	"github.com/smart-mcp-proxy/mcpproxy-go/internal/config"
+)
+
+// The Authorization scheme name is case-insensitive (RFC 7235 §2.1), so a
+// client that sends "bearer <key>" must be treated like "Bearer <key>".
+func TestBearerScheme_CaseInsensitive(t *testing.T) {
+	const apiKey = "admin-key-12345"
+
+	for _, scheme := range []string{"Bearer", "bearer", "BEARER"} {
+		t.Run(scheme, func(t *testing.T) {
+			req := httptest.NewRequest("GET", "/api/v1/status", nil)
+			req.Header.Set("Authorization", scheme+" "+apiKey)
+			assert.Equal(t, apiKey, ExtractToken(req))
+
+			srv := NewServer(&testControllerWithConfig{cfg: &config.Config{APIKey: apiKey}}, zap.NewNop().Sugar(), nil)
+			w := httptest.NewRecorder()
+			srv.ServeHTTP(w, req)
+			assert.Equal(t, http.StatusOK, w.Code, "admin key sent with %q scheme should authenticate", scheme)
+		})
+	}
+
+	req := httptest.NewRequest("GET", "/api/v1/status", nil)
+	req.Header.Set("Authorization", "Basic "+apiKey)
+	assert.Equal(t, "", ExtractToken(req), "non-Bearer schemes must not yield a token")
+}

internal/httpapi/server.go

@@ -679,10 +679,7 @@ func (s *Server) authenticateExplicitToken(w http.ResponseWriter, r *http.Reques
 // global admin key, or a user JWT resolved as a session principal
 // (kind=bearer_jwt) through the edition hook.
 func (s *Server) authenticateBearer(w http.ResponseWriter, r *http.Request, next http.Handler, cfg *config.Config, authHeader string) {
-	var token string
-	if strings.HasPrefix(authHeader, "Bearer ") {
-		token = strings.TrimPrefix(authHeader, "Bearer ")
-	}
+	token := bearerToken(authHeader)
 
 	if token != "" && strings.HasPrefix(token, auth.ClientTokenPrefixStr) {
 		s.rejectClientCredentialOnREST(w, r)
@@ -813,12 +810,8 @@ func ExtractToken(r *http.Request) string {
 	}
 
 	// 2. Check Authorization: Bearer header
-	if authHeader := r.Header.Get("Authorization"); authHeader != "" {
-		if strings.HasPrefix(authHeader, "Bearer ") {
-			if token := strings.TrimPrefix(authHeader, "Bearer "); token != "" {
-				return token
-			}
-		}
+	if token := bearerToken(r.Header.Get("Authorization")); token != "" {
+		return token
 	}
 
 	// 3. Check query parameter (for SSE and Web UI initial load)
@@ -829,6 +822,17 @@ func ExtractToken(r *http.Request) string {
 	return ""
 }
 
+// bearerToken returns the credential from an Authorization header value that
+// uses the Bearer scheme, or "" otherwise. The scheme name is matched
+// case-insensitively (RFC 7235 §2.1, RFC 6750 §2.1).
+func bearerToken(authHeader string) string {
+	const scheme = "Bearer "
+	if len(authHeader) < len(scheme) || !strings.EqualFold(authHeader[:len(scheme)], scheme) {
+		return ""
+	}
+	return authHeader[len(scheme):]
+}
+
 // correlationIDMiddleware injects correlation ID and request source into context
 func (s *Server) correlationIDMiddleware() func(http.Handler) http.Handler {
 	return func(next http.Handler) http.Handler {

internal/httpapi/sse_scope.go

@@ -83,11 +83,7 @@ func sessionCredentialValue(r *http.Request, kind auth.CredentialKind) string {
 		}
 		return ""
 	case auth.CredentialKindBearerJWT:
-		authHeader := r.Header.Get("Authorization")
-		if len(authHeader) > len("Bearer ") && authHeader[:7] == "Bearer " {
-			return authHeader[7:]
-		}
-		return ""
+		return bearerToken(r.Header.Get("Authorization"))
 	default:
 		return ""
 	}