Add RFC 6750 WWW-Authenticate on OAuth bearer APIs

Introduce BearerChallengeMiddleware on MCP, Console and Connect GraphQL, Files, and OAuth2 userinfo. Call sites record challenge intent in context via NoteUnauthenticated, NoteInvalidToken, and NoteInsufficientScope; the middleware applies resource_metadata, invalid_token, and insufficient_scope on WriteHeader.

OAuth2 access token middleware flags rejected Bearer tokens for invalid_token challenges. Add Authorizer.ScopesForAction for the scope auth-param.

Signed-off-by: Ludovic Vielle <ludovic@probo.com>

pkg/server/api/authn/context.go

@@ -28,7 +28,7 @@ var (
 	identityContextKey = &ctxKey{name: "identity"}
 	sessionContextKey  = &ctxKey{name: "session"}
 	apiKeyContextKey   = &ctxKey{name: "api_key"}
-	TrustCenterKey     = &ctxKey{name: "trust_center"}
+	trustCenterKey     = &ctxKey{name: "trust_center"}
 )
 
 func SessionFromContext(ctx context.Context) *coredata.Session {

pkg/server/api/authn/identity_presence_middleware.go

@@ -20,16 +20,25 @@ import (
 	"github.com/99designs/gqlgen/graphql"
 	"github.com/vektah/gqlparser/v2/gqlerror"
 	"go.gearno.de/kit/httpserver"
+	"go.probo.inc/probo/pkg/baseurl"
+	"go.probo.inc/probo/pkg/bearertoken"
 	"go.probo.inc/probo/pkg/server/gqlutils"
 )
 
-func NewIdentityPresenceMiddleware() func(next http.Handler) http.Handler {
+func NewIdentityPresenceMiddleware(baseURL *baseurl.BaseURL) func(next http.Handler) http.Handler {
 	return func(next http.Handler) http.Handler {
 		return http.HandlerFunc(
 			func(w http.ResponseWriter, r *http.Request) {
-				identity := IdentityFromContext(r.Context())
+				ctx := r.Context()
+				identity := IdentityFromContext(ctx)
 
 				if identity == nil {
+					if bearertoken.IsAttempt(r.Header.Get("Authorization")) {
+						bearertoken.SetBearerInvalidToken(w, baseURL)
+					} else {
+						bearertoken.SetBearerUnauthenticated(w, baseURL)
+					}
+
 					httpserver.RenderJSON(
 						w,
 						http.StatusUnauthorized,

pkg/server/api/authn/oauth2_access_token_middleware.go

@@ -36,15 +36,19 @@ func NewOAuth2AccessTokenMiddleware(svc *iam.Service) func(next http.Handler) ht
 					return
 				}
 
-				tokenValue, err := bearertoken.Parse(r.Header.Get("Authorization"))
+				authorization := r.Header.Get("Authorization")
+
+				tokenValue, err := bearertoken.Parse(authorization)
 				if err != nil {
 					next.ServeHTTP(w, r)
+
 					return
 				}
 
 				accessToken, err := svc.OAuth2ServerService.LoadAccessToken(ctx, tokenValue)
 				if err != nil {
 					next.ServeHTTP(w, r)
+
 					return
 				}