Function callAPIWithBearer

internal/agent/oauth_bearer_test.go:87–99

callAPIWithBearer hits /v1/account with the given Authorization value. Returns the status code and the WWW-Authenticate header. v1/account is the right validity probe because it authenticates with requirePrincipal — i.e. it returns 200 for ANY valid credential regardless of scope (account OR agent),

(t *testing.T, serverURL, bearer string)

// is account-scope-gated and would 403 a valid agent-scoped token —
// conflating credential validity with authorization.)
func callAPIWithBearer(t *testing.T, serverURL, bearer string) (int, string) {
	t.Helper()
	req, _ := http.NewRequest("GET", serverURL+"/v1/account", nil)
	if bearer != "" {
		req.Header.Set("Authorization", "Bearer "+bearer)
	}
	resp, err := http.DefaultClient.Do(req)
	if err != nil {
		t.Fatal(err)
	}
	defer resp.Body.Close()
	return resp.StatusCode, resp.Header.Get("WWW-Authenticate")
}

// ──────────────────────── Bearer dispatch tests ────────────────────────