fix: case-insensitive Bearer token scheme matching

[olirice]

fix: case-insensitive Bearer token scheme matching

bearerRegexp only accepted Bearer and bearer
RFC 7235 §2.1 requires auth scheme names to be case-insensitive.

Changed the regex to use the (?i) flag so all capitalizations (e.g. BEARER) are accepted.

Test plan

• Added TestExtractBearerTokenCaseInsensitive covering Bearer, bearer, BEARER, bEaReR, BeArEr

[coderabbitai]

📝 Walkthrough

Summary by CodeRabbit

• Bug Fixes

  • Bearer token authentication now properly handles case-insensitive headers (Bearer, bearer, BEARER, etc.) in compliance with RFC 7235.

• Tests

  • Added test coverage for case-insensitive Authorization header parsing.

Walkthrough

The pull request refactors the bearer token extraction regex in the API authentication handler and adds a corresponding test. The regex pattern was simplified from an explicit case enumeration (B|b)earer to a unified case-insensitive pattern (?i)^bearer, which achieves the same functionality with cleaner syntax. A new test TestExtractBearerTokenCaseInsensitive was introduced to validate that the Authorization header parsing handles bearer scheme names in any case variation (Bearer, bearer, BEARER, etc.) according to RFC 7235 §2.1, using multiple header examples and verifying correct token extraction.

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[cstockton]

Looks good 👍 - my force push was rebase reword on commit prefix

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@internal/api/auth_test.go`:
- Around line 62-84: The test TestExtractBearerTokenCaseInsensitive uses a
JWT-like hardcoded string in the variable token which is flagged as a potential
secret; update the token used in that test (and any other tests using similar
values) to a clearly fake value (e.g., "fake-token-value" or "token1234") that
contains no dot-separated JWT pattern but still has no spaces, or replace it
with a shared constant like testFakeToken and use that in the call to
a.extractBearerToken(req) to avoid gitleaks false positives while preserving
test semantics.

---

ℹ️ Review info

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro

Cache: Disabled due to Reviews > Disable Cache setting

Disabled knowledge base sources:

• Linear integration is disabled

You can enable these sources in your CodeRabbit configuration.

📥 Commits

Reviewing files that changed from the base of the PR and between 53021f6 and 7fbce5e.

📒 Files selected for processing (2)

• internal/api/api.go
• internal/api/auth_test.go