Handle malformed Authorization headers in HybridAuthBackend without 500s

[Copilot]

Malformed Authorization headers were triggering an unguarded unpack in HybridAuthBackend.authenticate, causing ValueError and HTTP 500s in authentication middleware (including on public routes like /api/heartbeat). This change makes malformed headers fail authentication cleanly instead of crashing request handling.

• Auth parsing hardening

  • Guarded header tokenization before unpacking.
  • If Authorization does not split into exactly two parts, authentication returns None (unauthenticated path) instead of raising.

• Backend auth coverage

  • Added parametrized auth-backend tests for malformed header shapes:
    • single token ("Foo")
    • empty bearer token shape ("Bearer ")
    • extra segments ("a b c")

• Public endpoint regression coverage

  • Added heartbeat test cases asserting malformed Authorization values do not break middleware handling for /api/heartbeat.

if "Authorization" in conn.headers:
    auth_header_parts = conn.headers["Authorization"].split()
    if len(auth_header_parts) != 2:
        return None

    scheme, token = auth_header_parts

[github-actions]

Test Results (postgresql)

    1 files      1 suites   4m 35s ⏱️
1 561 tests 1 561 ✅ 0 💤 0 ❌
1 563 runs  1 563 ✅ 0 💤 0 ❌

Results for commit a2775ca.

[github-actions]

Test Results (mariadb)

    1 files      1 suites   4m 55s ⏱️
1 561 tests 1 561 ✅ 0 💤 0 ❌
1 563 runs  1 563 ✅ 0 💤 0 ❌

Results for commit a2775ca.

[github-actions]

☂️ Python Coverage

current status: ✅

Overall Coverage

Lines	Covered	Coverage	Threshold	Status
17002	12247	72%	0%	🟢

New Files

No new covered files...

Modified Files

File	Coverage	Status
backend/handler/auth/hybrid_auth.py	92%	🟢
TOTAL	92%	🟢

updated for commit: a2775ca by action🐍

[Copilot]

Pull request overview

This PR hardens backend authentication handling so malformed Authorization headers no longer crash request processing (avoiding HTTP 500s), and adds regression tests to ensure public endpoints like /api/heartbeat remain unaffected.

Changes:

• Added defensive parsing in HybridAuthBackend.authenticate to avoid unpacking malformed Authorization header values.
• Added parametrized tests for malformed Authorization header shapes against HybridAuthBackend.
• Added a heartbeat endpoint regression test to ensure malformed Authorization headers still return HTTP 200.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
backend/handler/auth/hybrid_auth.py	Adds a guard around Authorization header tokenization to prevent ValueError-triggered 500s.
backend/tests/handler/auth/test_auth.py	Adds parametrized tests asserting malformed Authorization headers do not authenticate and do not crash.
backend/tests/endpoints/test_heartbeat.py	Adds a regression test ensuring /api/heartbeat still succeeds with malformed Authorization headers.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.