fix(url): expose response header names in lower case

HTTP header field names are case-insensitive (RFC 9110, section 5.1), but
since the switch to httpx the response_header keys arrived lower-cased
while consumers still looked them up in their original casing. veeam.py
(X-RestSvcSessionId) and huawei.py (Set-Cookie) therefore failed to find
their session token / cookie, surfacing as a false "unauthorized".

Canonicalize response header names to lower case in url.py and update the
consumers to read the canonical key. Tests mirror the real lower-cased
transport behaviour.

Author: markuslf

CHANGELOG.md

@@ -16,9 +16,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Fixed
 
+* huawei.py: the session cookie is read regardless of how the storage system cases the response header, preventing authentication from failing on a case-sensitive header lookup
 * redfish.py: Sensors that report an empty min/max range (identical min and max, used by some firmware as a "no limit" placeholder) no longer raise false warnings ([#1211](https://github.com/Linuxfabrik/monitoring-plugins/issues/1211))
 * url.py: a caller-supplied `Content-Length` is ignored and recomputed from the request body
-* veeam.py: authentication against the Veeam Enterprise Manager API works again
+* url.py: response header names are exposed in lower case, so callers read them reliably no matter how the server cased them
+* veeam.py: authentication against the Veeam Enterprise Manager API no longer fails with a `415 Unsupported Media Type` error or a false "unauthorized" result
 * Installing the library from source (for example `pip install --editable .`) no longer hangs, which also unblocks the API documentation build
 * Resolve the remaining ruff lint violations across the library, including a few robustness fixes: a bare `except` in disk.py now catches only `OSError`, mutable default arguments in url.py and rocket.py are no longer shared between calls, and uptimerobot.py uses `isinstance()` instead of a `type()` comparison ([#118](https://github.com/Linuxfabrik/lib/issues/118))
 

huawei.py

@@ -13,7 +13,7 @@
 """
 
 __author__ = 'Linuxfabrik GmbH, Zurich/Switzerland'
-__version__ = '2025042001'
+__version__ = '2026060501'
 
 import time as _time
 
@@ -160,7 +160,8 @@ def get_creds(args):
     )
 
     ibasetoken = result.get('response_json', {}).get('data', {}).get('iBaseToken')
-    cookie = result.get('response_header', {}).get('Set-Cookie')
+    # lib.url lower-cases all response header names (RFC 9110, section 5.1).
+    cookie = result.get('response_header', {}).get('set-cookie')
 
     expire = time.now() + args.CACHE_EXPIRE * 60
     cache.set(token_key, ibasetoken, expire)

tests/huawei/unit-test/run

@@ -93,9 +93,11 @@ LOGIN_OK = (
             },
             'error': {'code': 0, 'description': '0'},
         },
+        # lib.url lower-cases all response header names (RFC 9110, section 5.1),
+        # so the mock mirrors that canonical form.
         'response_header': {
-            'Set-Cookie': 'session=abc123def456; Path=/deviceManager; HttpOnly',
-            'Content-Type': 'application/json',
+            'set-cookie': 'session=abc123def456; Path=/deviceManager; HttpOnly',
+            'content-type': 'application/json',
         },
     },
 )

tests/url/unit-test/run

@@ -551,7 +551,7 @@ class TestFetchExtended(unittest.TestCase):
         resp = FakeStreamResponse(
             body=b'{"k": 1}',
             status_code=201,
-            headers={'content-type': 'application/json', 'x-test': 'yes'},
+            headers={'Content-Type': 'application/json', 'X-Test': 'yes'},
             elapsed_seconds=1.25,
             extensions=self._tls_extensions(),
         )
@@ -573,7 +573,10 @@ class TestFetchExtended(unittest.TestCase):
         )
         self.assertEqual(res['response'], '{"k": 1}')
         self.assertEqual(res['status_code'], 201)
+        # response_header keys are canonicalized to lower case, so a header the
+        # server sent in mixed case ('X-Test') is read back as 'x-test'.
         self.assertEqual(res['response_header']['x-test'], 'yes')
+        self.assertNotIn('X-Test', res['response_header'])
         self.assertEqual(res['tls_version'], 'TLSv1.3')
         self.assertEqual(res['alpn'], 'h2')
         self.assertEqual(res['peer_cert_der'], b'DER')

tests/veeam/unit-test/run

@@ -80,12 +80,17 @@ class FakeArgs:
 
 
 def make_success(token='8a8b1c2d-3e4f-5a6b-7c8d-9e0f1a2b3c4d', extra_headers=None):
-    """Build an `extended=True` style success result with a session token."""
-    headers = {'Content-Type': 'application/json'}
+    """Build an `extended=True` style success result with a session token.
+
+    `response_header` keys are lower-cased, exactly as `lib.url.fetch_json`
+    returns them (HTTP header names are case-insensitive, RFC 9110 section 5.1),
+    so the suite stays faithful to real transport behaviour.
+    """
+    headers = {'content-type': 'application/json'}
     if extra_headers:
         headers.update(extra_headers)
     if token is not None:
-        headers[TOKEN_HEADER] = token
+        headers['x-restsvcsessionid'] = token
     return {
         'response': '{}',
         'status_code': 201,
@@ -292,12 +297,14 @@ class TestGetTokenSuccess(unittest.TestCase):
         _ok, result = self._run((True, payload))
         self.assertEqual(result[TOKEN_HEADER], 'HEADER-TOKEN')
 
-    def test_token_lookup_is_case_sensitive(self):
-        # A lowercase header key is treated as missing -> unauthorized error.
-        payload = make_success(token=None, extra_headers={'x-restsvcsessionid': 'x'})
-        ok, msg = self._run((True, payload))
-        self.assertFalse(ok)
-        self.assertEqual(msg, 'Something went wrong, maybe user is unauthorized.')
+    def test_token_lookup_is_case_insensitive(self):
+        # lib.url lower-cases header names (RFC 9110, section 5.1), so a session
+        # id delivered under the canonical 'x-restsvcsessionid' key resolves
+        # regardless of how the server originally cased the header.
+        payload = make_success(token=None, extra_headers={'x-restsvcsessionid': 'low'})
+        ok, result = self._run((True, payload))
+        self.assertTrue(ok)
+        self.assertEqual(result[TOKEN_HEADER], 'low')
 
     def test_captured_session_payload(self):
         # Realistic Veeam EM session response with a token header attached.

url.py

@@ -11,7 +11,7 @@
 """Get for example HTML or JSON from an URL."""
 
 __author__ = 'Linuxfabrik GmbH, Zurich/Switzerland'
-__version__ = '2026060301'
+__version__ = '2026060501'
 
 import base64
 import json
@@ -368,7 +368,7 @@ def fetch(
         - On success with `extended=True`, a dict with keys:
             - `response`: response body
             - `status_code`: int
-            - `response_header`: dict of response headers
+            - `response_header`: dict of response headers, keys lower-cased
             - `timings`: dict with at least `total` (seconds, float)
             - `tls_version`: str like `'TLSv1.3'` or None over plain HTTP
             - `alpn`: str like `'h2'` or `'http/1.1'` or None
@@ -501,7 +501,13 @@ def fetch(
             response.raise_for_status()
             body_bytes = response.read()
             status_code = response.status_code
-            response_headers = dict(response.headers)
+            # HTTP header field names are case-insensitive (RFC 9110, section 5.1).
+            # Canonicalize them to lower case so callers can look a header up
+            # deterministically regardless of how the server cased it. httpx
+            # already lower-cases, but keep it explicit and backend-independent.
+            response_headers = {
+                key.lower(): value for key, value in response.headers.items()
+            }
             elapsed_seconds = response.elapsed.total_seconds()
             response_charset = response.charset_encoding
     except httpx.HTTPStatusError as e:

veeam.py

@@ -12,7 +12,7 @@
 Credits go to https://github.com/surfer190/veeam/blob/master/veeam/client.py."""
 
 __author__ = 'Linuxfabrik GmbH, Zurich/Switzerland'
-__version__ = '2026060301'
+__version__ = '2026060501'
 
 import base64
 
@@ -80,7 +80,8 @@ def get_token(args):
     if not result:
         return False, f'There was no result from {uri}.'
 
-    token = result.get('response_header', {}).get('X-RestSvcSessionId')
+    # lib.url lower-cases all response header names (RFC 9110, section 5.1).
+    token = result.get('response_header', {}).get('x-restsvcsessionid')
     if not token:
         return False, 'Something went wrong, maybe user is unauthorized.'