fix: case-insensitive ****** check in resolvePublicAuthContext

[Copilot]

Per RFC 7235 §2.1, the auth-scheme token is case-insensitive, but the existing startsWith('Bearer ') check silently drops valid tokens sent as bearer <token> or BEARER <token>.

Changes

• resolvePublicAuthContext.js — replace startsWith('Bearer ') with /^bearer\s+/i regex for both the presence check and token extraction:

// Before
if (!authHeader || !authHeader.startsWith('Bearer ')) { ... }
const token = authHeader.slice(7).trim();

// After
if (!authHeader || !/^bearer\s+/i.test(authHeader)) { ... }
const token = authHeader.replace(/^bearer\s+/i, '');

The \s+ (vs. \s) is used consistently in both the check and extraction to correctly handle any amount of whitespace between the scheme and token.

---

⚡ Quickly spin up Copilot coding agent tasks from anywhere on your macOS or Windows machine with Raycast.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
ur-backend-web-dashboard	Ready	Preview, Comment	Mar 28, 2026 9:03am

[yash-pouranik]

@coderabbitai checkout the PR, i think i should merge? here the issue #53

[Copilot]

Pull request overview

Updates the public API auth middleware to accept case-insensitive Authorization: Bearer <token> schemes per RFC 7235, ensuring valid tokens aren’t ignored when clients vary scheme casing.

Changes:

• Replaced startsWith('Bearer ') with a case-insensitive /^bearer\s+/i check.
• Updated token extraction to remove the scheme via regex.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The same /^bearer\s+/i literal is duplicated in both the presence check and extraction. Defining it once (e.g., const bearerPrefix = /^bearer\s+/i) reduces the chance of these drifting apart in future edits.

[coderabbitai]

Tip

For best results, initiate chat on the files or code changes.

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Get PR details
gh pr view 55 --repo yash-pouranik/urBackend --json title,body,state,reviews,reviewDecision,mergeable,statusCheckRollup,files,additions,deletions

echo "---ISSUE---"
# Get issue `#53` details
gh issue view 53 --repo yash-pouranik/urBackend --json title,body,state,comments

echo "---PR CHECKS---"
gh pr checks 55 --repo yash-pouranik/urBackend

echo "---PR DIFF---"
gh pr diff 55 --repo yash-pouranik/urBackend

Length of output: 5184

---

@yash-pouranik Here's my assessment of PR #55 against issue #53:

---

✅ Summary: Safe to Merge

What the PR does

The PR replaces the case-sensitive startsWith('Bearer ') check with a case-insensitive regex /^bearer\s+/i in resolvePublicAuthContext.js, which correctly implements RFC 7235 §2.1.

Code Review

The diff is small and correct:

// Presence check — now case-insensitive ✅
- if (!authHeader || !authHeader.startsWith('Bearer ')) {
+ if (!authHeader || !/^bearer\s+/i.test(authHeader)) {

// Token extraction — handles any casing and multiple spaces ✅
- const token = authHeader.slice(7).trim();
+ const token = authHeader.replace(/^bearer\s+/i, '');

Notable improvement over issue #53's suggestion: The PR uses \s+ (one or more spaces) consistently for both the check and the extraction, while the issue suggested \s (single space) for the check. Using \s+ consistently is the right call.

Status Checklist

Check	Status
Vercel CI	✅ Pass
Mergeable	✅ Yes
Addresses issue #53	✅ Yes
RFC 7235 compliant	✅ Yes
Logic correct	✅ Yes

⚠️ Minor Concerns (non-blocking)

1. Self-approval — You approved your own PR as the owner. For a team repo, a second set of eyes from another contributor is ideal before merging.
2. No tests added — There are no unit tests covering bearer <token>, BEARER <token>, or multi-space variants. Consider adding tests in a follow-up.

---

Bottom line: The fix is correct, minimal, and well-scoped. You're good to merge. 🚀

[yash-pouranik]

ok thankyou @coderabbitai, can u please create an issue to add unit tests? for auth only? auth for urabackend basically under ./apps/dashboard-api

[coderabbitai]

Tip

For best results, initiate chat on the files or code changes.

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Find auth-related files under apps/dashboard-api
fd . apps/dashboard-api --type f | grep -i auth

echo "---STRUCTURE---"
tree apps/dashboard-api --dirsfirst -L 4 2>/dev/null || fd . apps/dashboard-api --type f | head -60

Length of output: 718

---

🏁 Script executed:

#!/bin/bash
# Find resolvePublicAuthContext.js
fd resolvePublicAuthContext.js

echo "---EXISTING TESTS---"
fd . --type f -e test.js -e spec.js -e test.ts -e spec.ts | head -30

echo "---PACKAGE JSON---"
cat apps/dashboard-api/package.json

Length of output: 786

---

🏁 Script executed:

#!/bin/bash
gh issue create \
  --repo yash-pouranik/urBackend \
  --title "test: add unit tests for auth layer in apps/dashboard-api" \
  --assignee yash-pouranik \
  --body "## Overview

This issue tracks adding unit tests for the authentication layer in \`apps/dashboard-api\`. Currently, there is no test infrastructure set up in this package and no test files exist anywhere in the repository.

This was flagged as a follow-up in PR `#55` (which fixed the case-insensitive Bearer token check) and is related to issue `#53`.

---

## Scope

Unit tests should cover the following auth-related files under \`apps/dashboard-api/src/\`:

| File | What to test |
|---|---|
| \`controllers/auth.controller.js\` | Login, registration, token refresh, error paths |
| \`controllers/userAuth.controller.js\` | User-scoped auth flows, edge cases |
| \`middlewares/authMiddleware.js\` | Valid JWT, expired JWT, missing/malformed header, case-insensitive Bearer scheme (\`bearer\`, \`BEARER\`, \`Bearer\`) |
| \`middlewares/auth_limiter.js\` | Rate limiting behaviour |
| \`routes/auth.js\` | Route wiring, middleware application |

---

## Setup Required

No test framework is currently configured. Before writing tests, add a test runner to \`apps/dashboard-api/package.json\`. Recommended options:

- **Jest** (widely used with Express):
  \`\`\`bash
  npm install --save-dev jest `@types/jest`
  \`\`\`
- **Vitest** (faster, ESM-friendly alternative):
  \`\`\`bash
  npm install --save-dev vitest
  \`\`\`

Add a \`test\` script to \`package.json\`:
\`\`\`json
\"scripts\": {
  \"test\": \"jest --testPathPattern=src/\"
}
\`\`\`

---

## Acceptance Criteria

- [ ] Test framework installed and configured in \`apps/dashboard-api\`
- [ ] Unit tests written for \`authMiddleware.js\` including:
  - [ ] Accepts \`Bearer <token>\`
  - [ ] Accepts \`bearer <token>\` (lowercase — regression from PR `#55`)
  - [ ] Accepts \`BEARER <token>\` (uppercase)
  - [ ] Rejects missing \`Authorization\` header
  - [ ] Rejects malformed header (no scheme, wrong scheme)
  - [ ] Rejects expired / invalid JWT
- [ ] Unit tests written for \`auth.controller.js\` and \`userAuth.controller.js\`
- [ ] Tests run in CI

---

## References

- PR `#55` — fix: case-insensitive Bearer check in resolvePublicAuthContext
- Issue `#53` — original bug report

/cc `@yash-pouranik`"

Length of output: 52

---

@yash-pouranik Done! Issue #56 has been created and assigned to you: #56

Here's a quick summary of what it covers:

• Setup — Since there's no test framework anywhere in the repo yet, the issue includes instructions for adding Jest or Vitest to apps/dashboard-api
• Scope — Tests for all 5 auth files identified under apps/dashboard-api/src/:
  • middlewares/authMiddleware.js (including the bearer/BEARER/Bearer casing regression from PR #55)
  • middlewares/auth_limiter.js
  • controllers/auth.controller.js
  • controllers/userAuth.controller.js
  • routes/auth.js
• Acceptance criteria — Checklist-style so progress is easy to track

One thing worth noting: resolvePublicAuthContext.js (the file changed in this PR) actually lives in apps/public-api, not apps/dashboard-api — you may want a separate issue for that package's tests when you get to it. 🐇