harden(auth): guard bearer auth errors as 503; widen AuthContext to ServicePrincipal (Stage 1 PR2)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-28 12:04:19 +08:00
parent 3ec4fb8537
commit 78359c3fd8
3 changed files with 27 additions and 5 deletions
@@ -122,3 +122,13 @@ async def test_non_dfk_bearer_falls_through_to_cookie_path(tmp_path):
        assert r.json()["detail"]["code"] == "not_authenticated"
    finally:
        await _cleanup()
+
+
+async def test_bare_prefix_bearer_returns_401(tmp_path):
+    await _seed_key(tmp_path)
+    try:
+        client = TestClient(_make_app())
+        r = client.get("/api/probe", headers={"Authorization": "Bearer dfk_"})
+        assert r.status_code == 401
+    finally:
+        await _cleanup()