fix: echo the full Authorization header in Unsupported Authorization Type errors

Fixes #2489

An unsupported `Authorization` algorithm returned only the algorithm in `ArgumentValue`, while AWS S3 echoes the whole header as received. `sigv4auth.ParseAuthorization` now carries the full header in `ParseError.Input`, which the S3 error mapper returns. Also drop the trailing period from the `InvalidArgAuthHeader` message to match AWS.

internal/sigv4auth/auth.go

@@ -144,7 +144,7 @@ func ParseAuthorization(authorization, expectedService string) (AuthData, error)
 		return a, &ParseError{Kind: ErrUnsupportedAuthorizationVersion, Value: algo}
 	}
 	if algo != AlgorithmHMACSHA256 {
-		return a, &ParseError{Kind: ErrInvalidAuthorizationType, Value: algo}
+		return a, &ParseError{Kind: ErrInvalidAuthorizationType, Input: authorization, Value: algo}
 	}
 
 	kvPairs := strings.Split(authParts[1], ",")

s3api/utils/auth-reader.go

@@ -128,7 +128,7 @@ func mapAuthParseError(err *sigv4auth.ParseError) error {
 	case sigv4auth.ErrUnsupportedAuthorizationVersion:
 		return s3err.GetAPIError(s3err.ErrUnsupportedAuthorizationMechanism)
 	case sigv4auth.ErrInvalidAuthorizationType:
-		return s3err.GetInvalidArgumentErr(s3err.InvalidArgAuthorizationType, err.Value)
+		return s3err.GetInvalidArgumentErr(s3err.InvalidArgAuthorizationType, err.Input)
 	case sigv4auth.ErrMissingComponents:
 		return s3err.MalformedAuth.MissingComponents()
 	case sigv4auth.ErrMissingCredential:

s3api/utils/auth_test.go

@@ -16,6 +16,7 @@ package utils
 
 import (
 	"net"
+	"reflect"
 	"strings"
 	"testing"
 	"time"
@@ -24,6 +25,7 @@ import (
 	"github.com/valyala/fasthttp"
 	"github.com/valyala/fasthttp/fasthttputil"
 	"github.com/versity/versitygw/internal/sigv4auth"
+	"github.com/versity/versitygw/s3err"
 )
 
 func TestAuthParse(t *testing.T) {
@@ -69,6 +71,19 @@ func TestAuthParse(t *testing.T) {
 	}
 }
 
+func TestAuthParseUnsupportedType(t *testing.T) {
+	for _, authstr := range []string{
+		"AWS-HMAC-SHA25 Credential=user/20261007/us-east-1/s3/aws4_request,SignedHeaders=host;x-amz-content-sha256;x-amz-date,Signature=4a2a292c73c80d2fe4a4b9e506fe0d1a8209f92dd2dfd32c27c30402e42b473d",
+		"AWS2-HMAC-SHA1   Credential=x,  SignedHeaders=y, Signature=z",
+	} {
+		_, err := ParseAuthorization(authstr)
+		expected := s3err.GetInvalidArgumentErr(s3err.InvalidArgAuthorizationType, authstr)
+		if !reflect.DeepEqual(err, expected) {
+			t.Errorf("got %#v, expected %#v", err, expected)
+		}
+	}
+}
+
 // 2024/02/06 21:03:28 Request headers:
 // 2024/02/06 21:03:28 Host: 172.21.0.160:11000
 // 2024/02/06 21:03:28 User-Agent: S3 Browser/11.5.7 (https://s3browser.com)

s3err/invalid-argument.go

@@ -123,7 +123,7 @@ var invalidArgErrResponses = map[InvalidArgErrorCode]InvalidArgumentError{
 		ArgumentName: "x-amz-tagging",
 	},
 	InvalidArgAuthHeader: {
-		Description:  "Authorization header is invalid -- one and only one ' ' (space) required.",
+		Description:  "Authorization header is invalid -- one and only one ' ' (space) required",
 		ArgumentName: "Authorization",
 	},
 	InvalidArgAuthorizationType: {

tests/integration/sigv4_auth.go

@@ -65,7 +65,7 @@ func Authentication_unsupported_signature_version(s *S3Conf) error {
 			return err
 		}
 
-		return checkHTTPResponseApiErr(resp, s3err.GetInvalidArgumentErr(s3err.InvalidArgAuthorizationType, "AWS2-HMAC-SHA1"))
+		return checkHTTPResponseApiErr(resp, s3err.GetInvalidArgumentErr(s3err.InvalidArgAuthorizationType, authHdr))
 	})
 }
 

tests/test_rest_list_buckets.sh

@@ -54,9 +54,6 @@ export RUN_USERS=true
 
 # tags: curl,ListBuckets,required-headers,Authorization,invalid-header
 @test "REST - invalid authorization scheme" {
-  if [ "$DIRECT" != "true" ]; then
-    skip "https://github.com/versity/versitygw/issues/2489"
-  fi
   run list_buckets_check_authorization_scheme_error
   assert_success
 }