From 1004f2f2d89e89fb7099c80ff994170b4e0e6223 Mon Sep 17 00:00:00 2001 From: ZverGuy Date: Thu, 5 Nov 2026 01:38:47 +0700 Subject: [PATCH] test(observability-proxy): pin the refused forms of the bearer header Parsing the scheme with a case-insensitive split changed which header forms reach the token review; a bare scheme, an empty token and a scheme run into the token must still answer 401. Assisted-by: LLM Signed-off-by: ZverGuy --- internal/observabilityproxy/server_test.go | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/internal/observabilityproxy/server_test.go b/internal/observabilityproxy/server_test.go index ed1aaedc0..a5a9ee2d8 100644 --- a/internal/observabilityproxy/server_test.go +++ b/internal/observabilityproxy/server_test.go @@ -464,10 +464,12 @@ func TestServerBearerSchemeCase(t *testing.T) { t.Errorf("Authorization %q answered %d, want 200", auth, resp.StatusCode) } } - resp := h.do(http.MethodGet, logsRoot+"query", "", nil, map[string]string{"Authorization": "Basic good"}) - _ = resp.Body.Close() - if resp.StatusCode != http.StatusUnauthorized { - t.Errorf("Basic scheme answered %d, want 401", resp.StatusCode) + for _, auth := range []string{"Basic good", "Bearer", "Bearer ", "Bearergood"} { + resp := h.do(http.MethodGet, logsRoot+"query", "", nil, map[string]string{"Authorization": auth}) + _ = resp.Body.Close() + if resp.StatusCode != http.StatusUnauthorized { + t.Errorf("Authorization %q answered %d, want 401", auth, resp.StatusCode) + } } }