authChallenge builds the RFC 6750 §3 WWW-Authenticate value for a 401 on a Bearer-accepting endpoint, given the request and the auth error that caused the rejection. Every 401 advertises the bare `Bearer realm="e2a"`; OAuth- bearer failures additionally carry the §3.1 error params (see writeAuthErro
(r *http.Request, err error)
| 841 | // (writeAuthError) and the v1 surface (WWWAuthenticateChallenge) so both |
| 842 | // surfaces emit byte-identical challenges from one definition. |
| 843 | func (a *API) authChallenge(r *http.Request, err error) string { |
| 844 | bearer := stripBearerScheme(r.Header.Get("Authorization")) |
| 845 | isOAuthFailure := errors.Is(err, errOAuthBearerInvalid) || strings.HasPrefix(bearer, oauth.AccessTokenPrefix) |
| 846 | if !isOAuthFailure { |
| 847 | return `Bearer realm="e2a"` |
| 848 | } |
| 849 | desc := "the access token is invalid" |
| 850 | if errors.Is(err, fosite.ErrTokenExpired) { |
| 851 | desc = "the access token has expired" |
| 852 | } |
| 853 | return `Bearer realm="e2a", error="invalid_token", error_description="` + desc + `"` |
| 854 | } |
| 855 | |
| 856 | // WWWAuthenticateChallenge is the v1-surface seam (internal/httpapi) for the |
| 857 | // RFC 6750 challenge. The legacy mux had the auth error in hand at the 401 site |
no test coverage detected