ChallengeScheme.valueOf: Bearer and MAC no longer resolve to HTTP_OAuth

changes.md

@@ -18,6 +18,7 @@ Changes log
     - CorsService and CorsFilter now add `Vary: Origin` to every response when the CORS answer depends on the request origin (origin allow-list or credentials allowed), including requests without an `Origin` header, so shared caches no longer serve the response of one origin to another. A static `*` without credentials still sends no `Vary`, as recommended by the Fetch standard. Issue #1611.
     - Fixed the parsing of a `WWW-Authenticate` challenge made of a token68 ending with `=` (such as a `Negotiate` token): the whole header was dropped. Issue #191.
     - The `realm` and `charset` parameters of an HTTP Basic challenge are now recognized whatever their case (`Realm=`, `Charset=`), as required by RFC 9110. Issue #1455.
+    - `ChallengeScheme.valueOf()` returned `HTTP_OAUTH` for the names of the Bearer and MAC schemes (`HTTP_Bearer`, `HTTP_MAC`) instead of `HTTP_OAUTH_BEARER` and `HTTP_OAUTH_MAC`. Issue #1618.
 
 - 2.7.0 (30-09-2026)
   - Misc

org.restlet/src/main/java/org/restlet/data/ChallengeScheme.java

@@ -108,8 +108,8 @@ public final class ChallengeScheme {
                     Map.entry(HTTP_DIGEST.getName().toLowerCase(), HTTP_DIGEST),
                     Map.entry(HTTP_NTLM.getName().toLowerCase(), HTTP_NTLM),
                     Map.entry(HTTP_OAUTH.getName().toLowerCase(), HTTP_OAUTH),
-                    Map.entry(HTTP_OAUTH_BEARER.getName().toLowerCase(), HTTP_OAUTH),
-                    Map.entry(HTTP_OAUTH_MAC.getName().toLowerCase(), HTTP_OAUTH));
+                    Map.entry(HTTP_OAUTH_BEARER.getName().toLowerCase(), HTTP_OAUTH_BEARER),
+                    Map.entry(HTTP_OAUTH_MAC.getName().toLowerCase(), HTTP_OAUTH_MAC));
 
     /**
      * Returns the challenge scheme associated with a scheme name. If an existing constant exists,

org.restlet/src/test/java/org/restlet/data/ChallengeSchemeTestCase.java

@@ -29,6 +29,39 @@ void valueOf_isCaseInsensitive() {
         assertSame(ChallengeScheme.HTTP_BASIC, ChallengeScheme.valueOf("http_basic"));
     }
 
+    /** Issue #1618: the Bearer and MAC schemes used to be mapped to HTTP_OAUTH. */
+    @Test
+    void valueOf_oauthBearerAndMac_returnTheirOwnConstants() {
+        assertSame(ChallengeScheme.HTTP_OAUTH_BEARER, ChallengeScheme.valueOf("HTTP_Bearer"));
+        assertSame(ChallengeScheme.HTTP_OAUTH_BEARER, ChallengeScheme.valueOf("http_bearer"));
+        assertSame(ChallengeScheme.HTTP_OAUTH_MAC, ChallengeScheme.valueOf("HTTP_MAC"));
+        assertSame(ChallengeScheme.HTTP_OAUTH, ChallengeScheme.valueOf("HTTP_OAuth"));
+    }
+
+    /**
+     * Every constant must be found again by its name, so that a missing or mistaken entry in the
+     * lookup table is detected. HTTP_AWS_IAM and HTTP_AWS_QUERY are deliberately resolved to
+     * HTTP_AWS_S3.
+     */
+    @Test
+    void valueOf_everyConstant_isFoundByItsName() throws IllegalAccessException {
+        int checked = 0;
+        for (java.lang.reflect.Field field : ChallengeScheme.class.getFields()) {
+            if (field.getType() != ChallengeScheme.class
+                    || !java.lang.reflect.Modifier.isStatic(field.getModifiers())) {
+                continue;
+            }
+            ChallengeScheme constant = (ChallengeScheme) field.get(null);
+            if (constant == ChallengeScheme.HTTP_AWS_IAM
+                    || constant == ChallengeScheme.HTTP_AWS_QUERY) {
+                continue;
+            }
+            assertSame(constant, ChallengeScheme.valueOf(constant.getName()), field.getName());
+            checked++;
+        }
+        assertEquals(12, checked);
+    }
+
     @Test
     void valueOf_unknownName_createsNewInstance() {
         ChallengeScheme scheme = ChallengeScheme.valueOf("CUSTOM_SCHEME");