test(connectors): cover backward compatibility for the Bearer-prefix fix

Extract resolveHeaderAuthApiKey as a pure, directly testable function so the
catalog-lookup + prefix logic added for #490 can be exercised against a
plain catalog fixture. Adds explicit coverage that non-catalog (custom)
connectors, non-matching header names, and dcr entries are left byte-for-byte
unchanged, preserving prior behavior.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MxyEPwQ73B27NTr83U69Ba

Author: kristopolous

packages/trueforge-ui/src/plugins/trueforge-agent-server-adapter/catalogs/connectorCatalog.ts

@@ -58,6 +58,29 @@ export function applyHeaderValuePrefix({ apiKey, prefix }: { apiKey: string; pre
   return `${prefix}${apiKey}`;
 }
 
+/**
+ * Normalizes a freshly pasted header-auth key against the shipped catalog: if `name` matches a
+ * catalog entry whose `headerName` documents a "Scheme PLACEHOLDER" template, the scheme is
+ * prepended when missing. Connectors with no catalog match (custom "Add MCP Server" entries) or
+ * a template with no extractable scheme are returned unchanged — same behavior as before this
+ * normalization existed.
+ */
+export function resolveHeaderAuthApiKey({
+  catalog,
+  name,
+  headerName,
+  apiKey,
+}: {
+  catalog: readonly TrueForgeApi.CatalogMcpServer[];
+  name: string;
+  headerName: string;
+  apiKey: string;
+}): string {
+  const catalogAuth = catalog.find(server => server.name === name)?.auth;
+  const template = catalogAuth?.type === 'header' ? catalogAuth.headers[headerName] : undefined;
+  return applyHeaderValuePrefix({ apiKey, prefix: deriveHeaderValuePrefix(template) });
+}
+
 export function toHarnessAuth(auth: ConnectorAuth): TrueForgeApi.McpServerManifestAuth | undefined {
   if (auth.type === 'none') {
     return undefined;
@@ -163,10 +186,10 @@ export function createConnectorCatalog(
     if (apiKey !== undefined && apiKey !== '') {
       const headerName = req.auth.headerName?.trim() || DEFAULT_API_KEY_HEADER;
       const catalog = await client.catalogs.mcpServers.list();
-      const catalogAuth = catalog.data.find(server => server.name === req.name)?.auth;
-      const template = catalogAuth?.type === 'header' ? catalogAuth.headers[headerName] : undefined;
-      const prefix = deriveHeaderValuePrefix(template);
-      return { ...req.auth, apiKey: applyHeaderValuePrefix({ apiKey, prefix }) };
+      return {
+        ...req.auth,
+        apiKey: resolveHeaderAuthApiKey({ catalog: catalog.data, name: req.name, headerName, apiKey }),
+      };
     }
     if (req.id === undefined) {
       throw new Error('API key is required for header-authenticated MCP servers');

packages/trueforge-ui/test/plugins/trueforge-agent-server-adapter/catalogs/connectorCatalog.test.ts

@@ -4,6 +4,7 @@ import { describe, it } from 'vitest';
 import {
   applyHeaderValuePrefix,
   deriveHeaderValuePrefix,
+  resolveHeaderAuthApiKey,
   toHarnessAuth,
   toHarnessManifest,
   toUiAuthPublic,
@@ -12,6 +13,7 @@ import {
   toUiConnectorFromReadEntry,
   toUiTool,
 } from '@/plugins/trueforge-agent-server-adapter/catalogs/connectorCatalog.js';
+import { TrueForgeApi } from '@truefoundry/trueforge-sdk';
 
 describe('connectorCatalog mappers', () => {
   it('maps harness auth to UI public auth without secrets', () => {
@@ -55,6 +57,75 @@ describe('connectorCatalog mappers', () => {
     assert.equal(applyHeaderValuePrefix({ apiKey: 'abc123', prefix: undefined }), 'abc123');
   });
 
+  describe('resolveHeaderAuthApiKey (fixes #490)', () => {
+    const catalog: readonly TrueForgeApi.CatalogMcpServer[] = [
+      {
+        type: 'remote',
+        name: 'bright-data',
+        url: 'https://mcp.brightdata.com/mcp',
+        description: 'Search the web and scrape pages, including sites behind bot protection.',
+        auth: { type: 'header', headers: { Authorization: 'Bearer YOUR_BRIGHT_DATA_API_TOKEN' } },
+      },
+      {
+        type: 'remote',
+        name: 'linear',
+        url: 'https://mcp.linear.app/mcp',
+        description: 'Search, read, and create Linear issues.',
+        auth: { type: 'dcr' },
+      },
+    ];
+
+    it('adds the Bearer prefix Bright Data expects when the pasted key lacks one (#490)', () => {
+      assert.equal(
+        resolveHeaderAuthApiKey({ catalog, name: 'bright-data', headerName: 'Authorization', apiKey: 'abc123' }),
+        'Bearer abc123',
+      );
+    });
+
+    it('leaves an already-prefixed key untouched', () => {
+      assert.equal(
+        resolveHeaderAuthApiKey({
+          catalog,
+          name: 'bright-data',
+          headerName: 'Authorization',
+          apiKey: 'Bearer abc123',
+        }),
+        'Bearer abc123',
+      );
+    });
+
+    // Backward compatibility: connectors with no matching catalog entry (e.g. custom "Add MCP
+    // Server" additions) keep the exact prior behavior of storing the pasted value verbatim.
+    it('leaves a custom, non-catalog connector key untouched', () => {
+      assert.equal(
+        resolveHeaderAuthApiKey({
+          catalog,
+          name: 'my-internal-server',
+          headerName: 'Authorization',
+          apiKey: 'raw-token',
+        }),
+        'raw-token',
+      );
+    });
+
+    // Backward compatibility: a catalog match under a header name the template doesn't document
+    // (user overrode the default header) has no template to derive a prefix from.
+    it('leaves the key untouched when the header name has no matching catalog template', () => {
+      assert.equal(
+        resolveHeaderAuthApiKey({ catalog, name: 'bright-data', headerName: 'X-Api-Key', apiKey: 'raw-token' }),
+        'raw-token',
+      );
+    });
+
+    // Backward compatibility: DCR catalog entries carry no header template to consult.
+    it('leaves the key untouched for a catalog entry that uses dcr auth', () => {
+      assert.equal(
+        resolveHeaderAuthApiKey({ catalog, name: 'linear', headerName: 'Authorization', apiKey: 'raw-token' }),
+        'raw-token',
+      );
+    });
+  });
+
   it('maps catalog presets using name as id', () => {
     assert.deepEqual(
       toUiCatalogEntry({