[ppenguin]

Part of ReCasaOS/CasaOS#46 (helper: ReCasaOS/CasaOS-Common#7, released in v0.4.31).

• v1, v2 extractors: jwt.TokenFromAuthorization on the Authorization value → bare token (unchanged) or Bearer <token> (scheme case-insensitive)
• raw header still decides: Internal <secret> (skipper), header vs ?token= (v1); the helper's output only feeds the token check
• Common v0.4.26 → v0.4.31 (go.mod only)
• tests: bare, Bearer, bearer → accepted; Basic, Bearer alone → 401; v1 ?token= without a header → accepted, Bearer alone + ?token= → 401

🤖 Generated with Claude Code

[inkly]

Thanks, we reviewed all eight together. The raw header still makes every decision (empty vs ?token=, header-only, Internal <secret>); the helper only feeds the token check, and the gateway's proxying is unchanged. The v0.4.31 bumps are tidy with matching go.sum, and builds and route tests pass, also merged with CasaOS#55 and CasaOS-UserService#6. Approving. We'll squash-merge with a plain commit message.

Optional follow-ups, not blocking: a loopback Bearer Internal <secret> → 401 case in core's tests (LocalStorage and VirtManagement write a secret no case uses), a v1 case in AppManagement and a v2 case in UserService.