refactor(api): send adapter JWT via Authorization header

Send the phone-signed notification JWT via the standard Authorization
header, matching webhook requests exactly, instead of a dedicated
X-Httpsms-Signature header. Adapter endpoint URLs are no longer
expected to carry HTTP basic auth credentials, since Authorization
is now always used for the bearer JWT; update the corresponding test
to assert basic auth from the URL is ignored.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: AchoArnold

api/pkg/services/http_notification_sender.go

@@ -26,9 +26,6 @@ const (
 	notificationHTTPRetryDelay          = 250 * time.Millisecond
 	notificationJWTIssuer               = "api.httpsms.com"
 	notificationJWTValidity             = 10 * time.Minute
-	// notificationSignatureHeader carries the phone-signed JWT. It is not sent as Authorization so
-	// adapters can still use HTTP basic auth embedded in the endpoint URL (see [url.URL.User]).
-	notificationSignatureHeader = "X-Httpsms-Signature"
 )
 
 // HTTPNotificationSender sends FCM-compatible gateway notifications to HTTPS adapters.
@@ -170,7 +167,7 @@ func createHTTPNotificationRequest(
 		return nil, err
 	}
 	request.Header.Set("Content-Type", "application/json")
-	request.Header.Set(notificationSignatureHeader, fmt.Sprintf("Bearer %s", authToken))
+	request.Header.Set("Authorization", fmt.Sprintf("Bearer %s", authToken))
 	return request, nil
 }
 

api/pkg/services/http_notification_sender_test.go

@@ -62,7 +62,7 @@ func TestHTTPNotificationSenderSendsFCMCompatiblePayload(t *testing.T) {
 		assert.Equal(t, "high", payload.Message.Android.Priority)
 		assert.Equal(t, "600s", payload.Message.Android.TTL)
 
-		token, err := jwt.Parse(strings.TrimPrefix(request.Header.Get("X-Httpsms-Signature"), "Bearer "), func(*jwt.Token) (interface{}, error) {
+		token, err := jwt.Parse(strings.TrimPrefix(request.Header.Get("Authorization"), "Bearer "), func(*jwt.Token) (interface{}, error) {
 			return []byte(testNotificationPhoneID.String()), nil
 		})
 		require.NoError(t, err)
@@ -293,17 +293,21 @@ func TestHTTPNotificationSenderUsesInjectedHTTPClientUnchanged(t *testing.T) {
 	assert.Equal(t, time.Minute, sender.client.Timeout)
 }
 
-func TestHTTPNotificationSenderAllowsEndpointUserInformation(t *testing.T) {
+func TestHTTPNotificationSenderIgnoresEndpointUserInformation(t *testing.T) {
+	// Adapter endpoints must not rely on HTTP basic auth embedded in the URL; the Authorization
+	// header always carries the phone-signed JWT instead.
 	sender := newHTTPNotificationSender(t, roundTripFunc(func(request *http.Request) (*http.Response, error) {
-		username, password, ok := request.BasicAuth()
-		assert.True(t, ok)
-		assert.Equal(t, "adapter-user", username)
-		assert.Equal(t, "adapter-password", password)
+		_, _, ok := request.BasicAuth()
+		assert.False(t, ok)
 
-		token, err := jwt.Parse(strings.TrimPrefix(request.Header.Get("X-Httpsms-Signature"), "Bearer "), func(*jwt.Token) (interface{}, error) {
+		authorization := request.Header.Get("Authorization")
+		assert.True(t, strings.HasPrefix(authorization, "Bearer "))
+
+		token, err := jwt.Parse(strings.TrimPrefix(authorization, "Bearer "), func(*jwt.Token) (interface{}, error) {
 			return []byte(testNotificationPhoneID.String()), nil
 		})
 		require.NoError(t, err)
+		assert.True(t, token.Valid)
 		claims, ok := token.Claims.(jwt.MapClaims)
 		require.True(t, ok)
 		audience, err := claims.GetAudience()