fix: made bearer token scheme case-insensitive for non-spec-compliant oidc providers

[wim07101993]

Which Problems Are Solved

When a client requested userinfo with a lowercase authorization header (bearer instead of Bearer), the server would reject it because it is not compliant to the spec.

How the Problems Are Solved

• made the bearer scheme check case-insensitive

Additional Changes

Additional Context

• Closes [Bug]: Normalize tokenType when calling Userinfo #876

[Copilot]

Pull request overview

This PR updates the OP userinfo Authorization header parsing to accept a lowercase bearer scheme (case-insensitive), addressing interoperability with non-spec-compliant OIDC providers (closes #876).

Changes:

• Adjusted bearer-scheme detection in getAccessToken to be case-insensitive.
• Added a route test ensuring /userinfo succeeds with authorization: bearer <token>.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
pkg/op/userinfo.go	Updates Authorization header parsing logic for bearer scheme matching.
pkg/op/server_http_routes_test.go	Adds coverage for lowercase bearer Authorization scheme on userinfo route.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.