refactor: rename parseAPIKeyBasicAuth and pin colon-in-password split

Rename parseAPIKeyBasicAuth to parseBasicAuthHeaderValue so the helper
name matches the final X-Tinyauth-Authorization header, and add a test
pinning that a password containing a colon keeps everything after the
first colon, matching http.Request.BasicAuth().

Co-Authored-By: ZCode <noreply@z.ai>

Author: eGames

internal/middleware/context_middleware.go

@@ -96,7 +96,7 @@ func (m *ContextMiddleware) Middleware() gin.HandlerFunc {
 		}
 
 		if apiKeyHeaders := c.Request.Header["X-Tinyauth-Authorization"]; len(apiKeyHeaders) > 0 {
-			username, password, ok := parseAPIKeyBasicAuth(apiKeyHeaders[0])
+			username, password, ok := parseBasicAuthHeaderValue(apiKeyHeaders[0])
 			if !ok {
 				m.log.App.Debug().Msg("Invalid basic auth in X-Tinyauth-Authorization header")
 				c.AbortWithStatus(http.StatusUnauthorized)
@@ -387,9 +387,9 @@ func (m *ContextMiddleware) tailscaleWhois(ip string) (*model.TailscaleContext,
 	return &uctx, nil
 }
 
-// parseAPIKeyBasicAuth parses an X-Tinyauth-Authorization value in the
+// parseBasicAuthHeaderValue parses an X-Tinyauth-Authorization value in the
 // form "Basic base64(username:password)".
-func parseAPIKeyBasicAuth(header string) (username string, password string, ok bool) {
+func parseBasicAuthHeaderValue(header string) (username string, password string, ok bool) {
 	const prefix = "Basic "
 
 	if len(header) < len(prefix) || !strings.EqualFold(header[:len(prefix)], prefix) {

internal/middleware/context_middleware_test.go

@@ -18,6 +18,7 @@ import (
 	"github.com/tinyauthapp/tinyauth/internal/service"
 	"github.com/tinyauthapp/tinyauth/internal/test"
 	"github.com/tinyauthapp/tinyauth/internal/utils/logger"
+	"golang.org/x/crypto/bcrypt"
 )
 
 func TestContextMiddleware(t *testing.T) {
@@ -26,6 +27,13 @@ func TestContextMiddleware(t *testing.T) {
 
 	cfg, runtime := test.CreateTestConfigs(t)
 
+	colonPasswd, err := bcrypt.GenerateFromPassword([]byte("pa:ss"), bcrypt.DefaultCost)
+	require.NoError(t, err)
+	runtime.LocalUsers = append(runtime.LocalUsers, model.LocalUser{
+		Username: "colonuser",
+		Password: string(colonPasswd),
+	})
+
 	basicAuthHeader := func(username, password string) string {
 		return "Basic " + base64.StdEncoding.EncodeToString([]byte(username+":"+password))
 	}
@@ -272,6 +280,18 @@ func TestContextMiddleware(t *testing.T) {
 				assert.True(t, userCtx.Authenticated)
 			},
 		},
+		{
+			description: "Password containing a colon keeps everything after the first colon",
+			run: func(t *testing.T, args runArgs) {
+				req := httptest.NewRequest("GET", "/api/test", nil)
+				req.Header.Set("X-Tinyauth-Authorization", basicAuthHeader("colonuser", "pa:ss"))
+				userCtx, _ := args.do(req)
+
+				require.NotNil(t, userCtx)
+				assert.Equal(t, "colonuser", userCtx.GetUsername())
+				assert.True(t, userCtx.Authenticated)
+			},
+		},
 		{
 			description: "Malformed header is rejected without fallback to Authorization",
 			run: func(t *testing.T, args runArgs) {