Prepare deployment and Forgejo CI

auth.py

@@ -37,19 +37,20 @@ class OAuthStateRecord:
 _OAUTH_STATES: dict[str, OAuthStateRecord] = {}
 
 
-def resolve_forgejo_token(request: Request, settings: Settings) -> tuple[str | None, str]:
-    header_token = _authorization_token(request.headers.get("authorization"))
-    if header_token:
-        return header_token, "authorization"
+def resolve_forgejo_auth(request: Request, settings: Settings) -> tuple[str | None, str, str]:
+    header_credential = _authorization_credential(request.headers.get("authorization"))
+    if header_credential:
+        header_token, auth_scheme = header_credential
+        return header_token, "authorization", auth_scheme
 
     session = _session_from_request(request, settings)
     if session and session.forgejo_token:
-        return session.forgejo_token, "session"
+        return session.forgejo_token, "session", "Bearer"
 
     if settings.forgejo_token:
-        return settings.forgejo_token, "server"
+        return settings.forgejo_token, "server", "token"
 
-    return None, "none"
+    return None, "none", "token"
 
 
 def current_session_user(request: Request, settings: Settings) -> dict[str, Any] | None:
@@ -113,13 +114,16 @@ def code_challenge(code_verifier: str) -> str:
     return urlsafe_b64encode(digest).decode("ascii").rstrip("=")
 
 
-def _authorization_token(value: str | None) -> str | None:
+def _authorization_credential(value: str | None) -> tuple[str, str] | None:
     if not value:
         return None
 
     parts = value.strip().split(None, 1)
     if len(parts) == 2 and parts[0].lower() in {"bearer", "token"}:
-        return parts[1].strip() or None
+        token = parts[1].strip()
+        if not token:
+            return None
+        return token, "Bearer" if parts[0].lower() == "bearer" else "token"
     return None