Add RFC 6750 WWW-Authenticate on OAuth bearer APIs

Introduce BearerChallengeMiddleware on MCP, Console and Connect GraphQL, Files, and OAuth2 userinfo. Call sites record challenge intent in context via NoteUnauthenticated, NoteInvalidToken, and NoteInsufficientScope; the middleware applies resource_metadata, invalid_token, and insufficient_scope on WriteHeader.

OAuth2 access token middleware flags rejected Bearer tokens for invalid_token challenges. Add Authorizer.ScopesForAction for the scope auth-param.

Signed-off-by: Ludovic Vielle <ludovic@probo.com>

pkg/server/api/files/v1/handler.go

@@ -22,6 +22,8 @@ import (
 
 	"github.com/go-chi/chi/v5"
 	"go.gearno.de/kit/log"
+	"go.probo.inc/probo/pkg/baseurl"
+	"go.probo.inc/probo/pkg/bearertoken"
 	"go.probo.inc/probo/pkg/brand"
 	"go.probo.inc/probo/pkg/coredata"
 	"go.probo.inc/probo/pkg/filemanager"
@@ -41,6 +43,7 @@ type Handler struct {
 	probo   *probo.Service
 	iamSvc  *iam.Service
 	assets  *brand.Assets
+	baseURL *baseurl.BaseURL
 }
 
 func NewMux(
@@ -50,6 +53,7 @@ func NewMux(
 	iamSvc *iam.Service,
 	cookieConfig securecookie.Config,
 	tokenSecret string,
+	baseURL *baseurl.BaseURL,
 ) *chi.Mux {
 	h := &Handler{
 		logger:  logger,
@@ -57,6 +61,7 @@ func NewMux(
 		probo:   proboSvc,
 		iamSvc:  iamSvc,
 		assets:  brand.NewAssets(),
+		baseURL: baseURL,
 	}
 
 	r := chi.NewRouter()
@@ -68,7 +73,7 @@ func NewMux(
 		r.Use(authn.NewSessionMiddleware(iamSvc, cookieConfig))
 		r.Use(authn.NewAPIKeyMiddleware(iamSvc, tokenSecret))
 		r.Use(authn.NewOAuth2AccessTokenMiddleware(iamSvc))
-		r.Use(authn.NewIdentityPresenceMiddleware())
+		r.Use(authn.NewIdentityPresenceMiddleware(baseURL))
 		r.Get("/{fileID}", h.handleGetFile)
 	})
 
@@ -157,8 +162,10 @@ func (h *Handler) handleGetFile(w http.ResponseWriter, r *http.Request) {
 
 	scope, err := h.iamSvc.Authorizer.Authorize(ctx, params)
 	if err != nil {
-		if _, ok := errors.AsType[*iam.ErrInsufficientOAuth2Scope](err); ok {
+		if scopeErr, ok := errors.AsType[*iam.ErrInsufficientOAuth2Scope](err); ok {
+			bearertoken.SetBearerInsufficientScope(w, h.baseURL, scopeErr.Scopes...)
 			jsonx.RenderForbidden(w)
+
 			return
 		}
 

pkg/server/api/files/v1/handler_test.go

@@ -26,6 +26,7 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"go.gearno.de/kit/log"
+	"go.probo.inc/probo/pkg/baseurl"
 	"go.probo.inc/probo/pkg/securecookie"
 )
 
@@ -79,6 +80,7 @@ func TestHandleGetStaticFile(t *testing.T) {
 		nil,
 		securecookie.Config{},
 		"test-secret",
+		baseurl.MustParse("https://example.com"),
 	)
 
 	rec := httptest.NewRecorder()
@@ -118,6 +120,7 @@ func TestHandleGetFile_UnauthenticatedReturns401(t *testing.T) {
 		nil, // iamSvc — not reached when no token/cookie present
 		securecookie.Config{},
 		"test-secret",
+		baseurl.MustParse("https://example.com"),
 	)
 
 	rec := httptest.NewRecorder()