fix(http): advertise bearer challenge on current main

[seonghobae]

Objective

Reconstruct stale #401's unique WWW-Authenticate: Bearer contract directly on protected main, without importing stale ancestry or changing token-verification semantics.

Exact current-head evidence

• protected base at reconstruction: b66b692ce580b783cddf9e99d96c4f94aa6b1735;
• test-only RED head: 0ebd44c1c9b3b092cc466f4bb0e9f62a7a36b64b;
• exact GREEN head: 4667cc116c4d05f4156961ac7783088ad7099464;
• changed paths: ArtifactHttpResponse.java and its focused response-header regression only;
• CI, Security Scan, SAST Semgrep, and fuzz: terminal-success;
• mergeable: true;
• unresolved inline findings: zero;
• stale predecessor fix(http): advertise bearer challenge for artifact-token 401 #401 is superseded.

HTTP contract

A controlled 401 Unauthorized artifact-token failure advertises WWW-Authenticate: Bearer while retaining Cache-Control: no-store and X-Content-Type-Options: nosniff. A 403 Forbidden failure preserves those security headers without issuing a new authentication challenge.

Scope boundary

Response-header semantics only. This does not change artifact-token parsing, signatures, credential source, tenant authority, artifact lookup/delivery, checksum binding, range behavior, or #431's preauthorization ordering.

Merge gate

Keep this exact head unchanged. Auto-merge may act only after live required checks remain terminal-success, zero valid unresolved findings remain, and a qualifying independent non-author approval is attached to this exact head. If live protection requires an updated base, rebuild or update against protected main and regenerate all base-sensitive checks and reviews. No predecessor evidence transfers.

[coderabbitai]

Warning

Review limit reached

@seonghobae, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 46 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 78b34f01-0766-4344-a2e1-3c1e085f68f3

📥 Commits

Reviewing files that changed from the base of the PR and between 961f44a and 4667cc1.

📒 Files selected for processing (2)

• src/main/java/com/clearfolio/viewer/controller/ArtifactHttpResponse.java
• src/test/java/com/clearfolio/viewer/controller/ArtifactHttpResponseTest.java

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@opencode-agent review

Please review the unchanged exact current head b85034617dc52b47344d8efa13dc57070cd4ed03 against live protected main and repository gates. Treat checks/model output as evidence only and submit a formal review only for this exact head.

[opencode-agent]

Pull request overview

OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.

Findings

1. HIGH Current-head GitHub Checks - Fix failed required checks before approval

• Problem: Failed same-head checks remain for 4667cc116c4d05f4156961ac7783088ad7099464.
• Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
• Fix: Read and fix the failed check logs below, then rerun the current-head checks.
• Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.

Failed checks:

• Strix Security Scan/strix: FAILURE (https://github.com/ContextualWisdomLab/clearfolio/actions/runs/31650593852/job/94293866348)
• Strix Security Scan/strix: failure (https://github.com/ContextualWisdomLab/clearfolio/actions/runs/31650593852/job/94293866348)

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Changed file (2 files)"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Changed file (2 files)"]
  R1 --> V1["required checks"]

Loading

[opencode-agent]

OpenCode Review Overview

• Head SHA: 4667cc116c4d05f4156961ac7783088ad7099464
• Workflow run: 31701017273
• Workflow attempt: 1
• Gate result: REQUEST_CHANGES (approval step)

Pull request overview

OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.

Findings

1. HIGH Current-head GitHub Checks - Fix failed required checks before approval

• Problem: Failed same-head checks remain for 4667cc116c4d05f4156961ac7783088ad7099464.
• Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
• Fix: Read and fix the failed check logs below, then rerun the current-head checks.
• Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.

Failed checks:

• Strix Security Scan/strix: FAILURE (https://github.com/ContextualWisdomLab/clearfolio/actions/runs/31650593852/job/94293866348)
• Strix Security Scan/strix: failure (https://github.com/ContextualWisdomLab/clearfolio/actions/runs/31650593852/job/94293866348)

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Changed file (2 files)"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Changed file (2 files)"]
  R1 --> V1["required checks"]

Loading

[seonghobae]

@opencode-agent review
@coderabbitai review
@cwl-noema-review review
@strix review

Review exact head 4667cc116c4d05f4156961ac7783088ad7099464 only. Exact-head CI, Security Scan, SAST Semgrep, and fuzz are terminal-success; unresolved inline findings are zero. Validate that only 401 advertises the bearer challenge while 403 does not restart authentication and both retain no-store/nosniff defenses.

Review read-only; preserve independent reviewer identity. Do not mutate the branch, synthesize author approval, weaken protection, or merge.

[coderabbitai]

Rate Limit Exceeded

@seonghobae have exceeded the limit for the number of chat messages per hour. Please wait 28 minutes and 34 seconds before sending another message.