bug(auth): Authorization header parsing requires exact-case `Bearer ` and rejects valid `bearer` scheme

[CloneOfAlex]

User Story

As a developer integrating a third-party gRPC/HTTP client or SDK with an OpenShell gateway,
I want standards-compliant Authorization headers to be accepted regardless of scheme casing,
so that my client authenticates without OpenShell-specific header workarounds.

Problem Statement

Every bearer-token extraction site uses strip_prefix("Bearer "), so the auth scheme is matched case-sensitively and with exactly one space. RFC 7235 §2.1 and RFC 6750 define the scheme name as case-insensitive, so authorization: bearer <token> or BEARER <token> is a valid header that OpenShell rejects as unauthenticated.

Sites on main (0ea0d31):

• OpenShell/crates/openshell-server/src/auth/oidc.rs

  Line 897 in 0ea0d31

  .and_then(|v| v.strip_prefix("Bearer "))

• OpenShell/crates/openshell-server/src/auth/peer.rs

  Line 99 in 0ea0d31

  .and_then(|v| v.strip_prefix("Bearer "))

• OpenShell/crates/openshell-server/src/auth/sandbox_jwt.rs

  Line 282 in 0ea0d31

  .and_then(|value| value.strip_prefix("Bearer "))

• OpenShell/crates/openshell-server/src/auth/compute_driver.rs

  Line 40 in 0ea0d31

  .and_then(|value| value.strip_prefix("Bearer "))

• OpenShell/crates/openshell-server/src/grpc/auth_rpc.rs

  Line 203 in 0ea0d31

  .and_then(|value| value.strip_prefix("Bearer "))

• OpenShell/crates/openshell-sandbox-backend/src/sandbox_auth.rs

  Line 107 in 0ea0d31

  .strip_prefix("Bearer ")

• openshell-core/src/jwt.rs#L21 and grpc_client.rs#L668 fall back to treating the whole value as the token, so bearer xyz becomes the token bearer xyz.

Impact / Why This Matters

Clients and proxies that normalize or lower-case the scheme (some HTTP libraries, API gateways, service meshes, hand-written SDKs) get UNAUTHENTICATED with no hint that casing is the cause. Users have to debug the gateway to find out that only Bearer with exact casing works. The behavior is also inconsistent across entry points: some sites reject the header, while others pass a malformed token downstream.

Acceptance Criteria

• The scheme comparison is ASCII case-insensitive at all listed sites (ideally one shared helper).
• bearer <t>, Bearer <t> and BEARER <t> authenticate identically; empty or whitespace-containing tokens are still rejected.
• Unit tests cover the case variants for the OIDC, sandbox JWT, and sandbox protocol authenticators.

Reproduction Steps

1. Start a local gateway with OIDC (or use a sandbox session JWT).
2. Call any authenticated RPC with grpcurl -H 'authorization: bearer <valid-token>' ....
3. Observe Unauthenticated; the same call with Bearer succeeds.

Environment

• OpenShell: main @ 0ea0d31 (code review)
• Components: openshell-server auth, openshell-sandbox-backend, openshell-core

Logs

[ousamabenyounes]

🏗️ build-plan

Implementation Plan

Issue type: fix
Complexity: Medium
Confidence: High — all eight reported call sites still use case-sensitive prefix matching, and the shared fix is well bounded.

Summary

Add one shared, allocation-free parser for HTTP Bearer credentials that compares the scheme case-insensitively, accepts the RFC-defined one-or-more ASCII-space separator, and rejects empty or whitespace-containing tokens. Reuse it across the gateway, sandbox backend, and client-side JWT expiry helpers while preserving each caller's current error and fallthrough behavior.

Scope

• crates/openshell-core/src/auth.rs: add the shared parser and a table-driven validity matrix.
• crates/openshell-core/src/jwt.rs and crates/openshell-core/src/grpc_client.rs: recognize case-insensitive Bearer prefixes while retaining raw-token support.
• crates/openshell-server/src/auth/{oidc,sandbox_jwt,peer,compute_driver}.rs and crates/openshell-server/src/grpc/auth_rpc.rs: replace duplicated exact-case parsing.
• crates/openshell-sandbox-backend/src/sandbox_auth.rs: use the shared parser at the Sandbox Protocol boundary.

Implementation Steps

1. Add and unit-test the shared parser for scheme casing, one-or-more literal spaces, and invalid token whitespace.
2. Replace all eight reported parsing sites without changing caller-specific missing or malformed credential handling.
3. Add authenticator-level regression tests for OIDC, gateway sandbox JWT, and Sandbox Protocol case variants.
4. Run focused crate tests, the repository test task, and pre-commit checks.

Test Plan

• Unit tests: Parser matrix covering Bearer, bearer, BEARER, multiple separator spaces, wrong or missing schemes, empty tokens, and embedded/trailing whitespace.
• Integration tests: Existing authenticator fixtures exercise valid case variants through OIDC, gateway session JWT, and Sandbox Protocol boundaries.
• E2E tests: N/A — this is a pure header-parsing correction with no e2e/ changes.

Risks & Open Questions

• Preserve auth-chain fallthrough semantics in OIDC/peer/driver authenticators versus explicit unauthenticated errors in refresh and Sandbox Protocol paths.
• Preserve raw JWT/token inputs accepted by expiry parsing and refresh scheduling.
• Avoid broader token-alphabet validation because peer and driver credentials may be opaque.

Documentation Impact

None expected. Existing canonical Authorization: Bearer <token> examples remain correct. There is no gateway configuration, Helm, or LSM impact.

---

Revision 1 — initial plan