fix: return full authorization header in unsupported authorization type error

the unsupported authorization type error only echoed the algorithm back in ArgumentValue, while s3 returns the whole Authorization header there. the parse error now carries the raw header and the s3 error mapping uses it, which also lets the bats test skipped for #1705 run again.

Fixes #2489

internal/sigv4auth/auth.go

@@ -144,7 +144,7 @@ func ParseAuthorization(authorization, expectedService string) (AuthData, error)
 		return a, &ParseError{Kind: ErrUnsupportedAuthorizationVersion, Value: algo}
 	}
 	if algo != AlgorithmHMACSHA256 {
-		return a, &ParseError{Kind: ErrInvalidAuthorizationType, Value: algo}
+		return a, &ParseError{Kind: ErrInvalidAuthorizationType, Input: authorization, Value: algo}
 	}
 
 	kvPairs := strings.Split(authParts[1], ",")

s3api/utils/auth-reader.go

@@ -128,7 +128,7 @@ func mapAuthParseError(err *sigv4auth.ParseError) error {
 	case sigv4auth.ErrUnsupportedAuthorizationVersion:
 		return s3err.GetAPIError(s3err.ErrUnsupportedAuthorizationMechanism)
 	case sigv4auth.ErrInvalidAuthorizationType:
-		return s3err.GetInvalidArgumentErr(s3err.InvalidArgAuthorizationType, err.Value)
+		return s3err.GetInvalidArgumentErr(s3err.InvalidArgAuthorizationType, err.Input)
 	case sigv4auth.ErrMissingComponents:
 		return s3err.MalformedAuth.MissingComponents()
 	case sigv4auth.ErrMissingCredential:

s3api/utils/auth_test.go

@@ -15,6 +15,7 @@
 package utils
 
 import (
+	"errors"
 	"net"
 	"strings"
 	"testing"
@@ -24,6 +25,7 @@ import (
 	"github.com/valyala/fasthttp"
 	"github.com/valyala/fasthttp/fasthttputil"
 	"github.com/versity/versitygw/internal/sigv4auth"
+	"github.com/versity/versitygw/s3err"
 )
 
 func TestAuthParse(t *testing.T) {
@@ -69,6 +71,32 @@ func TestAuthParse(t *testing.T) {
 	}
 }
 
+func TestAuthParseUnsupportedType(t *testing.T) {
+	vectors := []struct {
+		name    string
+		authstr string
+	}{
+		{
+			name:    "misspelled algorithm",
+			authstr: "AWS-HMAC-SHA25 Credential=user/20261007/us-east-1/s3/aws4_request,SignedHeaders=host;x-amz-content-sha256;x-amz-date,Signature=4a2a292c73c80d2fe4a4b9e506fe0d1a8209f92dd2dfd32c27c30402e42b473d",
+		},
+		{
+			name:    "spaces between components",
+			authstr: "AWS2-HMAC-SHA1 Credential=user/20261007/us-east-1/s3/aws4_request, SignedHeaders=host;x-amz-date, Signature=4a2a292c73c80d2fe4a4b9e506fe0d1a8209f92dd2dfd32c27c30402e42b473d",
+		},
+	}
+
+	for _, v := range vectors {
+		t.Run(v.name, func(t *testing.T) {
+			_, err := ParseAuthorization(v.authstr)
+			want := s3err.GetInvalidArgumentErr(s3err.InvalidArgAuthorizationType, v.authstr)
+			if !errors.Is(err, want) {
+				t.Errorf("err got %v, expected %v", err, want)
+			}
+		})
+	}
+}
+
 // 2024/02/06 21:03:28 Request headers:
 // 2024/02/06 21:03:28 Host: 172.21.0.160:11000
 // 2024/02/06 21:03:28 User-Agent: S3 Browser/11.5.7 (https://s3browser.com)

tests/integration/sigv4_auth.go

@@ -65,7 +65,7 @@ func Authentication_unsupported_signature_version(s *S3Conf) error {
 			return err
 		}
 
-		return checkHTTPResponseApiErr(resp, s3err.GetInvalidArgumentErr(s3err.InvalidArgAuthorizationType, "AWS2-HMAC-SHA1"))
+		return checkHTTPResponseApiErr(resp, s3err.GetInvalidArgumentErr(s3err.InvalidArgAuthorizationType, authHdr))
 	})
 }
 

tests/test_rest_list_buckets.sh

@@ -54,9 +54,6 @@ export RUN_USERS=true
 
 # tags: curl,ListBuckets,required-headers,Authorization,invalid-header
 @test "REST - invalid authorization scheme" {
-  if [ "$DIRECT" != "true" ]; then
-    skip "https://github.com/versity/versitygw/issues/1705"
-  fi
   run list_buckets_check_authorization_scheme_error
   assert_success
 }