From 8271bea5c108e8b0af44f0b8148559c95e0da7a8 Mon Sep 17 00:00:00 2001
From: DualFroz <me@dualfroz.com>
Date: Wed, 7 Oct 2026 19:37:46 +0200
Subject: [PATCH] fix: return full authorization header in unsupported
 authorization type error

the unsupported authorization type error only echoed the algorithm back in ArgumentValue, while s3 returns the whole Authorization header there. the parse error now carries the raw header and the s3 error mapping uses it, which also lets the bats test skipped for #1705 run again.

Fixes #2489
---
 internal/sigv4auth/auth.go      |  2 +-
 s3api/utils/auth-reader.go      |  2 +-
 s3api/utils/auth_test.go        | 28 ++++++++++++++++++++++++++++
 tests/integration/sigv4_auth.go |  2 +-
 tests/test_rest_list_buckets.sh |  3 ---
 5 files changed, 31 insertions(+), 6 deletions(-)

diff --git a/internal/sigv4auth/auth.go b/internal/sigv4auth/auth.go
index e57a16d..f47a55e 100644
--- a/internal/sigv4auth/auth.go
+++ b/internal/sigv4auth/auth.go
@@ -144,7 +144,7 @@ func ParseAuthorization(authorization, expectedService string) (AuthData, error)
 		return a, &ParseError{Kind: ErrUnsupportedAuthorizationVersion, Value: algo}
 	}
 	if algo != AlgorithmHMACSHA256 {
-		return a, &ParseError{Kind: ErrInvalidAuthorizationType, Value: algo}
+		return a, &ParseError{Kind: ErrInvalidAuthorizationType, Input: authorization, Value: algo}
 	}
 
 	kvPairs := strings.Split(authParts[1], ",")
diff --git a/s3api/utils/auth-reader.go b/s3api/utils/auth-reader.go
index 8161b5e..c17061e 100644
--- a/s3api/utils/auth-reader.go
+++ b/s3api/utils/auth-reader.go
@@ -128,7 +128,7 @@ func mapAuthParseError(err *sigv4auth.ParseError) error {
 	case sigv4auth.ErrUnsupportedAuthorizationVersion:
 		return s3err.GetAPIError(s3err.ErrUnsupportedAuthorizationMechanism)
 	case sigv4auth.ErrInvalidAuthorizationType:
-		return s3err.GetInvalidArgumentErr(s3err.InvalidArgAuthorizationType, err.Value)
+		return s3err.GetInvalidArgumentErr(s3err.InvalidArgAuthorizationType, err.Input)
 	case sigv4auth.ErrMissingComponents:
 		return s3err.MalformedAuth.MissingComponents()
 	case sigv4auth.ErrMissingCredential:
diff --git a/s3api/utils/auth_test.go b/s3api/utils/auth_test.go
index af1f97a..2fa1b84 100644
--- a/s3api/utils/auth_test.go
+++ b/s3api/utils/auth_test.go
@@ -15,6 +15,7 @@
 package utils
 
 import (
+	"errors"
 	"net"
 	"strings"
 	"testing"
@@ -24,6 +25,7 @@ import (
 	"github.com/valyala/fasthttp"
 	"github.com/valyala/fasthttp/fasthttputil"
 	"github.com/versity/versitygw/internal/sigv4auth"
+	"github.com/versity/versitygw/s3err"
 )
 
 func TestAuthParse(t *testing.T) {
@@ -69,6 +71,32 @@ func TestAuthParse(t *testing.T) {
 	}
 }
 
+func TestAuthParseUnsupportedType(t *testing.T) {
+	vectors := []struct {
+		name    string
+		authstr string
+	}{
+		{
+			name:    "misspelled algorithm",
+			authstr: "AWS-HMAC-SHA25 Credential=user/20261007/us-east-1/s3/aws4_request,SignedHeaders=host;x-amz-content-sha256;x-amz-date,Signature=4a2a292c73c80d2fe4a4b9e506fe0d1a8209f92dd2dfd32c27c30402e42b473d",
+		},
+		{
+			name:    "spaces between components",
+			authstr: "AWS2-HMAC-SHA1 Credential=user/20261007/us-east-1/s3/aws4_request, SignedHeaders=host;x-amz-date, Signature=4a2a292c73c80d2fe4a4b9e506fe0d1a8209f92dd2dfd32c27c30402e42b473d",
+		},
+	}
+
+	for _, v := range vectors {
+		t.Run(v.name, func(t *testing.T) {
+			_, err := ParseAuthorization(v.authstr)
+			want := s3err.GetInvalidArgumentErr(s3err.InvalidArgAuthorizationType, v.authstr)
+			if !errors.Is(err, want) {
+				t.Errorf("err got %v, expected %v", err, want)
+			}
+		})
+	}
+}
+
 // 2024/02/06 21:03:28 Request headers:
 // 2024/02/06 21:03:28 Host: 172.21.0.160:11000
 // 2024/02/06 21:03:28 User-Agent: S3 Browser/11.5.7 (https://s3browser.com)
diff --git a/tests/integration/sigv4_auth.go b/tests/integration/sigv4_auth.go
index 551b43f..95e9b62 100644
--- a/tests/integration/sigv4_auth.go
+++ b/tests/integration/sigv4_auth.go
@@ -65,7 +65,7 @@ func Authentication_unsupported_signature_version(s *S3Conf) error {
 			return err
 		}
 
-		return checkHTTPResponseApiErr(resp, s3err.GetInvalidArgumentErr(s3err.InvalidArgAuthorizationType, "AWS2-HMAC-SHA1"))
+		return checkHTTPResponseApiErr(resp, s3err.GetInvalidArgumentErr(s3err.InvalidArgAuthorizationType, authHdr))
 	})
 }
 
diff --git a/tests/test_rest_list_buckets.sh b/tests/test_rest_list_buckets.sh
index 128cf1c..0e384fb 100644
--- a/tests/test_rest_list_buckets.sh
+++ b/tests/test_rest_list_buckets.sh
@@ -54,9 +54,6 @@ export RUN_USERS=true
 
 # tags: curl,ListBuckets,required-headers,Authorization,invalid-header
 @test "REST - invalid authorization scheme" {
-  if [ "$DIRECT" != "true" ]; then
-    skip "https://github.com/versity/versitygw/issues/1705"
-  fi
   run list_buckets_check_authorization_scheme_error
   assert_success
 }