fix(serveredition): accept the Bearer scheme case-insensitively for user JWTs

internal/serveredition/auth/middleware.go

@@ -188,12 +188,14 @@ func (m *ServerEditionAuthMiddleware) authenticateFromSession(r *http.Request) (
 // Authorization header and returns an AuthContext if successful.
 // Returns (nil, nil) if no Bearer token is present.
 func (m *ServerEditionAuthMiddleware) authenticateFromBearer(r *http.Request) (*coreauth.AuthContext, error) {
+	// The auth-scheme name is case-insensitive (RFC 7235 §2.1).
 	authHeader := r.Header.Get("Authorization")
-	if !strings.HasPrefix(authHeader, "Bearer ") {
+	const scheme = "Bearer "
+	if len(authHeader) < len(scheme) || !strings.EqualFold(authHeader[:len(scheme)], scheme) {
 		return nil, nil
 	}
 
-	token := strings.TrimPrefix(authHeader, "Bearer ")
+	token := authHeader[len(scheme):]
 	if token == "" {
 		return nil, nil
 	}

internal/serveredition/auth/middleware_test.go

@@ -800,3 +800,24 @@ func TestMiddleware_BearerContextFieldParity(t *testing.T) {
 		}
 	}
 }
+
+func TestMiddleware_ValidJWT_SchemeCaseInsensitive(t *testing.T) {
+	s := setupMiddlewareTest(t)
+	token := s.generateJWT(t, s.testUser.ID, s.testUser.Email, s.testUser.DisplayName, "user", s.testUser.Provider, 1*time.Hour)
+	handler := s.middleware.Middleware()(authContextHandler())
+
+	for _, scheme := range []string{"bearer", "BEARER"} {
+		req := httptest.NewRequest(http.MethodGet, "/api/v1/servers", nil)
+		req.Header.Set("Authorization", scheme+" "+token)
+		rr := httptest.NewRecorder()
+		handler.ServeHTTP(rr, req)
+
+		var body map[string]interface{}
+		if err := json.Unmarshal(rr.Body.Bytes(), &body); err != nil {
+			t.Fatalf("%s: failed to unmarshal response (%d): %v", scheme, rr.Code, err)
+		}
+		if rr.Code != http.StatusOK || body["user_id"] != s.testUser.ID {
+			t.Errorf("%s: expected 200 for user %q, got %d: %s", scheme, s.testUser.ID, rr.Code, rr.Body.String())
+		}
+	}
+}