fix: fail closed on empty resolved credential in static-inject

ReadCredentialFile trims a whitespace-only secret file to "" and returns
ok, and an inline mapping value may be "". The OnRequest guard only
checked !ok, so an empty credential was forwarded as "Bearer " (or an
empty raw header) instead of denying. Add a value == "" guard alongside
!ok and lock it in with a test covering both an empty inline mapping and a
whitespace-only secret file.

Addresses review feedback from @huang195 on PR #655.

Assisted-By: Claude (Anthropic AI) <noreply@anthropic.com>
Signed-off-by: Paolo Dettori <dettori@us.ibm.com>

Author: pdettori

authbridge/authlib/plugins/staticinject/plugin.go

@@ -203,7 +203,11 @@ func (p *StaticInject) OnRequest(ctx context.Context, pctx *pipeline.Context) pi
 	}
 
 	value, ok := p.resolver.Resolve(ctx, key)
-	if !ok {
+	// Fail closed on an empty credential as well: ReadCredentialFile trims a
+	// whitespace-only secret file to "" and returns ok, and an inline mapping
+	// may hold "". Without this guard either would forward an empty
+	// "Bearer " / raw header instead of denying.
+	if !ok || value == "" {
 		return pipeline.DenyStatus(401, "static-inject.unresolved-key", "no credential available for the resolved key")
 	}
 

authbridge/authlib/plugins/staticinject/plugin_test.go

@@ -4,6 +4,8 @@ import (
 	"context"
 	"encoding/json"
 	"net/http"
+	"os"
+	"path/filepath"
 	"strings"
 	"testing"
 
@@ -241,6 +243,65 @@ func TestDenyOnUnsafeCredentialValue(t *testing.T) {
 	}
 }
 
+// TestDenyOnEmptyResolvedValue locks in fail-closed behavior when the resolver
+// returns an empty credential. ReadCredentialFile trims a whitespace-only secret
+// file to "" (ok=true), and an inline mapping may hold "" — both must deny rather
+// than forward an empty "Bearer " header.
+func TestDenyOnEmptyResolvedValue(t *testing.T) {
+	t.Run("empty inline mapping value", func(t *testing.T) {
+		p := New()
+		cfg := `{
+			"source": "mappings",
+			"mappings": {"api.example.com": ""},
+			"key_by": "host"
+		}`
+		if err := p.Configure(json.RawMessage(cfg)); err != nil {
+			t.Fatalf("Configure() error = %v", err)
+		}
+
+		pctx := &pipeline.Context{
+			Host:    "api.example.com",
+			Headers: http.Header{"Authorization": []string{"Bearer PLACEHOLDER"}},
+		}
+		action := p.OnRequest(context.Background(), pctx)
+		if action.Type != pipeline.Reject {
+			t.Fatalf("OnRequest() action.Type = %v, want %v (Reject, empty credential)", action.Type, pipeline.Reject)
+		}
+		if got := pctx.Headers.Get("Authorization"); got != "Bearer PLACEHOLDER" {
+			t.Errorf("Authorization header = %q, want unmodified %q", got, "Bearer PLACEHOLDER")
+		}
+	})
+
+	t.Run("whitespace-only secret file", func(t *testing.T) {
+		dir := t.TempDir()
+		if err := os.WriteFile(filepath.Join(dir, "api.example.com"), []byte("   \n"), 0o600); err != nil {
+			t.Fatalf("WriteFile() error = %v", err)
+		}
+
+		p := New()
+		cfg := `{
+			"source": "secret_dir",
+			"secret_dir": "` + dir + `",
+			"key_by": "host"
+		}`
+		if err := p.Configure(json.RawMessage(cfg)); err != nil {
+			t.Fatalf("Configure() error = %v", err)
+		}
+
+		pctx := &pipeline.Context{
+			Host:    "api.example.com",
+			Headers: http.Header{"Authorization": []string{"Bearer PLACEHOLDER"}},
+		}
+		action := p.OnRequest(context.Background(), pctx)
+		if action.Type != pipeline.Reject {
+			t.Fatalf("OnRequest() action.Type = %v, want %v (Reject, whitespace-only file)", action.Type, pipeline.Reject)
+		}
+		if got := pctx.Headers.Get("Authorization"); got != "Bearer PLACEHOLDER" {
+			t.Errorf("Authorization header = %q, want unmodified %q", got, "Bearer PLACEHOLDER")
+		}
+	})
+}
+
 // =============================================================================
 // Name / Capabilities / ConfigSchema / Configure sanity checks
 // =============================================================================