HybridAuthBackend.authenticate raises ValueError → HTTP 500 on a malformed Authorization header (should be 401)

[ginnoir]

Description

backend/handler/auth/hybrid_auth.py unpacks the Authorization header without
guarding the split, so any value that isn't exactly two whitespace-separated parts
crashes the auth middleware and returns HTTP 500 instead of a clean 401. Because
this runs in AuthenticationMiddleware (before the route), it 500s every
endpoint for that request — including otherwise-public ones like /api/heartbeat.

Still present on master:

# backend/handler/auth/hybrid_auth.py, HybridAuthBackend.authenticate()
if "Authorization" in conn.headers:
    scheme, token = conn.headers["Authorization"].split()

"Bearer ".split() -> ["Bearer"] -> ValueError: not enough values to unpack (expected 2, got 1). Same for "Bearer a b" (too many) or any single-token value.

Version

RomM 4.8.1 (Docker rommapp/romm:4); code unchanged on master.

Reproduction

$ curl -s -o /dev/null -w "%{http_code}\n" -H "Authorization: Bearer "  https://romm.example/api/heartbeat
500
$ curl -s -o /dev/null -w "%{http_code}\n" -H "Authorization: Foo"      https://romm.example/api/heartbeat
500
$ curl -s -o /dev/null -w "%{http_code}\n" -H "Authorization: a b c"    https://romm.example/api/heartbeat
500
# well-formed or absent header behaves correctly:
$ curl -s -o /dev/null -w "%{http_code}\n" -H "Authorization: Bearer rmm_x" https://romm.example/api/heartbeat
200

Full traceback:

File ".../handler/auth/hybrid_auth.py", line 28, in authenticate
    scheme, token = conn.headers["Authorization"].split()
ValueError: not enough values to unpack (expected 2, got 1)

Impact

• An unauthenticated client can trivially 500 every endpoint (and spam Sentry) by
  sending a one-word Authorization header.
• A client mid-bootstrap that sends Authorization: Bearer (empty token) gets a
  500 instead of a 401, which can deadlock first-run auth flows. Real-world case:
  decky-romm-sync — Fresh-setup connect deadlocks: empty Bearer header sent before token mint → RomM 500s the version probe danielcopper/decky-romm-sync#928.

Suggested fix

Validate the split before unpacking and reject cleanly:

if "Authorization" in conn.headers:
    parts = conn.headers["Authorization"].split()
    if len(parts) != 2:
        return None          # -> 401, instead of crashing
    scheme, token = parts

(return None yields an unauthenticated connection; endpoints that require auth
then return 401/403 as normal, and public endpoints like /api/heartbeat keep
working.)