[rudycelekli]

Bug

ServerEditionAuthMiddleware.authenticateFromBearer only recognises an Authorization header that starts with the exact bytes Bearer . The auth-scheme name is case-insensitive (RFC 7235 §2.1, RFC 6750 §2.1), so a valid user JWT sent as bearer <jwt> or BEARER <jwt> is ignored and the request gets 401 Authentication required on the server edition.

Trigger

Build with -tags server, log in, mint a JWT with POST /api/v1/auth/token, then:

curl -H 'Authorization: bearer <jwt>' http://host/api/v1/servers   # 401
curl -H 'Authorization: Bearer <jwt>' http://host/api/v1/servers   # 200

Fix

Compare the scheme prefix with strings.EqualFold instead of strings.HasPrefix. Nothing else changes: empty tokens and agent tokens are still skipped, and the JWT is validated exactly as before.

This is the server-edition counterpart of #1754 (which fixes the core internal/httpapi parser). The two are independent and can land in either order.

Test

TestMiddleware_ValidJWT_SchemeCaseInsensitive sends a valid JWT with the bearer and BEARER schemes through Middleware() and checks for 200 and the right user_id.

Commands run

• CGO_ENABLED=0 go test -count=1 -tags server ./internal/serveredition/auth: ok on 3 of 4 runs. The one failing run was TestHandleCallback_Unavailable_ProviderErrorRenders503, an OAuth-callback timing test that does not go through this middleware. It passes alone (-count=3) and passes on the other three full runs.
• CGO_ENABLED=0 go test -count=1 -tags server -skip TestHandleCallback_Unavailable_ProviderErrorRenders503 ./internal/serveredition/auth: ok
• CGO_ENABLED=0 go vet -tags server ./internal/serveredition/auth: clean
• With the fix reverted (git stash of middleware.go), -run SchemeCaseInsensitive fails with bearer: expected 200 ..., got 401 and BEARER: expected 200 ..., got 401.
• gofmt -l on the edited files: no output

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[Dumbris]

Verified: the PR test fails on main for the reason described and passes on this branch merged with main; race tests for the touched packages and CI lint (bare and server tags) are clean. Also built and tested together with the rest of this batch, independently reviewed, and cross-reviewed with a second model.

[Dumbris]

Merged. Thank you, @rudycelekli! The server edition accepts user JWTs with a lower- or upper-case Bearer scheme.