Accept a case-insensitive Bearer prefix on the config API

[gyanu2507]

Summary

The gateway already accepts bearer <token> (RFC 7235). The Python config service only stripped a capital Bearer prefix, so the same header that works on inference returned 401/403 on /v1/configs.

One helper now trims, strips a case-insensitive Bearer prefix, and still accepts a raw token with no scheme.

Test plan

• Authorization: bearer <admin> reaches /v1/configs/export
• BEARER with extra spaces also works
• missing/wrong token cases are unchanged

Summary by CodeRabbit

• Bug Fixes

  • Improved authorization header handling for configuration access.
  • Bearer tokens are now recognized regardless of capitalization and surrounding whitespace.

• Tests

  • Added coverage for lowercase and uppercase Bearer prefixes, including headers with extra whitespace.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: 9ab42166-ca0b-48dd-a435-4f72e3a9c11a

📥 Commits

Reviewing files that changed from the base of the PR and between 9a7e8d3 and a89ad86.

📒 Files selected for processing (2)

• packages/sie_config/src/sie_config/config_api.py
• packages/sie_config/tests/test_config_api.py

Included review availability: Your plan provides up to 8 included reviews per hour; 7 remain after this review.

---

📝 Walkthrough

Walkthrough

Changes

Authorization token parsing

Layer / File(s)	Summary
Token parser and authentication coverage packages/sie_config/src/sie_config/config_api.py, packages/sie_config/tests/test_config_api.py	The API uses _extract_bearer_token for audit logging and read/write authentication. The parser accepts case-insensitive Bearer prefixes and surrounding whitespace. Tests cover lowercase and uppercase prefixes.andaş

Merge Risk: ⚪ Minimal · up to a89ad

The configuration API now accepts case-insensitive, whitespace-tolerant Bearer authorization prefixes while retaining raw-token and invalid-token behavior. No current merge-blocking risk remains.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 55.56% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 9 functions across 2 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: accepting a case-insensitive Bearer prefix in the config API.

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}