fix(auth): populate oauthScope/myId in getSignerFromOAuthToken, clarify authMiddleware flow

[rickyrombo]

Summary

• When a PKCE Bearer token resolves a signer via getSignerFromOAuthToken, populate oauthScope and myId directly on the context — previously authMiddleware did a redundant second PKCE token lookup to fill these in
• Restructures authMiddleware with explicit priority comments, and moves signature headers to lowest priority (after Bearer-based flows)
• Adds TestOAuthMe_WithApiSecret to verify /me works when the PKCE token belongs to a developer app that also has an api_secret registered in api_keys

Test plan

• go test ./api/... -run TestOAuthMe — all 6 pass

🤖 Generated with Claude Code

[gitguardian]

⚠️ GitGuardian has uncovered 1 secret following the scan of your pull request.

Please consider investigating the findings and remediating the incidents. Failure to do so may lead to compromising the associated services or software components.

🔎 Detected hardcoded secret in your pull request

GitGuardian id	GitGuardian status	Secret	Commit	Filename
28321821	Triggered	Generic High Entropy Secret	b6a5be1	api/v1_oauth_test.go	View secret

🛠 Guidelines to remediate hardcoded secrets

1. Understand the implications of revoking this secret by investigating where it is used in your code.
2. Replace and store your secret safely. Learn here the best practices.
3. Revoke and rotate this secret.
4. If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.

To avoid such incidents in the future consider

• following these best practices for managing and storing secrets including API keys and other credentials
• install secret detection on pre-commit to catch secret before it leaves your machine and ease remediation.

---

^{🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.}

[Copilot]

Pull request overview

This PR refines OAuth/PKCE authentication handling by ensuring PKCE-derived context (scope + user id) is populated during signer resolution, and by clarifying/reordering authMiddleware’s authentication method precedence to avoid redundant token lookups.

Changes:

• Populate oauthScope and myId in getSignerFromOAuthToken so downstream handlers (e.g. /v1/me) don’t require a second PKCE token lookup.
• Restructure authMiddleware with explicit precedence ordering and move signature-header auth to lowest priority after Bearer-based flows.
• Add a regression test covering /v1/me when a PKCE token’s client also has an api_secret in api_keys.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
api/v1_oauth_test.go	Adds regression test for /v1/me with PKCE token + api_secret present.
api/request_helpers.go	Ensures PKCE OAuth token signer resolution also sets oauthScope/myId on the request context.
api/auth_middleware.go	Reorders/clarifies auth resolution flow and makes signature headers lowest priority.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.