From a6379bb9f4d2cb59854ca793d479a2dd90ddd295 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Aur=C3=A9lien=20Sibiril?=
 <81782+aureliensibiril@users.noreply.github.com>
Date: Fri, 17 Apr 2026 10:46:23 +0200
Subject: [PATCH] Always send Bearer auth for OAuth2 connectors
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Provider token_type values are not reliably valid HTTP auth schemes
(Slack returns "bot" / "user", some providers send an empty string),
which produces a malformed Authorization header on subsequent
requests. Every OAuth2 connector in this codebase actually uses a
bearer token, so we always send "Bearer".

Signed-off-by: Aurélien Sibiril <81782+aureliensibiril@users.noreply.github.com>
---
 pkg/connector/oauth2.go | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/pkg/connector/oauth2.go b/pkg/connector/oauth2.go
index c575d0904..510f2d688 100644
--- a/pkg/connector/oauth2.go
+++ b/pkg/connector/oauth2.go
@@ -583,6 +583,10 @@ type oauth2Transport struct {
 
 func (t *oauth2Transport) RoundTrip(req *http.Request) (*http.Response, error) {
 	req2 := req.Clone(req.Context())
-	req2.Header.Set("Authorization", t.tokenType+" "+t.token)
+	// tokenType from the provider's OAuth response is not always a valid HTTP
+	// auth scheme (Slack returns "bot" / "user", some providers send an empty
+	// string), so we always send "Bearer" -- the only scheme any connector in
+	// this codebase actually needs.
+	req2.Header.Set("Authorization", "Bearer "+t.token)
 	return t.underlying.RoundTrip(req2)
 }