[Repo Assist] refactor(auth): move IsMalformedHeader from server to auth package

[github-actions]

🤖 This PR was created by Repo Assist, an automated AI assistant.

Summary

Moves the RFC 7230 header-character validation logic out of internal/server/auth.go into internal/auth/header.go, where all other header-parsing utilities already live.

This addresses Issue 3 from the automated Semantic Function Clustering Analysis (#4138), which identified that isMalformedAuthHeader is conceptually misplaced — it validates raw header bytes per RFC 7230 before any auth parsing, and belongs alongside ParseAuthHeader, ExtractSessionID, ValidateAPIKey, etc.

Changes

• internal/auth/header.go — Add exported IsMalformedHeader(header string) bool
• internal/server/auth.go — Remove private isMalformedAuthHeader; import internal/auth; call auth.IsMalformedHeader
• internal/auth/header_test.go — Add TestIsMalformedHeader with 12 test cases (empty string, normal key, horizontal tab, null byte, control chars 0x01/0x0A/0x0D/0x1F, DEL 0x7F, etc.)
• internal/server/auth_test.go — Update TestIsMalformedAuthHeader to call auth.IsMalformedHeader (no logic change; existing 10 cases preserved)

Rationale

Before this change, server/auth.go contained a comment pointing maintainers at internal/auth for header logic — yet itself held a piece of header validation. After this change, all header validation lives in one package and can be used by any future callers without importing the server package.

Test Status

The environment has Go 1.24.13; the module requires Go 1.25.0 (network-restricted — toolchain download blocked). Build and test could not be run locally. CI will provide authoritative results.

The logic in IsMalformedHeader is identical to the previous isMalformedAuthHeader — only renamed and relocated. The existing 10 unit tests in server/auth_test.go continue to cover the same code paths via the new auth.IsMalformedHeader call, and 12 new cases are added directly to auth/header_test.go.

Warning

⚠️ Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• proxy.golang.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "proxy.golang.org"

See Network Configuration for more information.

Generated by Repo Assist · ● 4.6M · ◷

To install this agentic workflow, run

gh aw add githubnext/agentics/workflows/repo-assist.md@851905c06e905bf362a9f6cc54f912e3df747d55