fix: resolve Authorization via the SDK's getallheaders() fallback in Status_Handler

[tomasstark]

This PR fixes the self-report status endpoint silently serving the 404 decoy to the backend's challenge probes on hosts where Apache withholds the Authorization header from $_SERVER — which is why the live self-report check fails for sites on WP Engine despite running 1.3.0-beta.8.

Context

The backend's health check probes /.well-known/supertab/status with a challenge JWT in the Authorization header. Status_Handler::get_authorization_header() read only $_SERVER['HTTP_AUTHORIZATION'] / REDIRECT_HTTP_AUTHORIZATION — but Apache withholds Authorization from the CGI-style $_SERVER variables (a CGI-era behavior), while getallheaders() still exposes it. Since every verification failure fails closed to the decoy, the endpoint looked healthy from outside while every valid probe was rejected.

Stock WordPress masks this: since WP 5.6 the core .htaccess rewrite block includes RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}], which re-exports the header. Hosts that generate their own server config without that rule (WP Engine among them) hit the bug. That's also why the original wp-env verification couldn't catch it — wp-env's stock .htaccess carries the compensating rule.

This is the same defect fixed in the SDK by getsupertab/connect-sdk-php#24, found live on the vanilla-PHP self-report demo; the plugin duplicated the pre-fix header reading instead of going through the SDK.

Key Changes

• SDK bump 1.4.0-beta.9 → 1.4.0-beta.10, which ships RequestContext::resolveAuthorizationHeader() (and fixes the same bug inside the SDK's own handleRequest() path used by Bot_Protection for license-token checks).
• Status_Handler::get_authorization_header() now delegates to the SDK resolver: $_SERVER wins when populated, otherwise the raw request headers are searched case-insensitively. New protected get_raw_request_headers() seam wraps getallheaders() (guarded by function_exists; unavailable under the CLI SAPI) so tests can inject headers.
• 3 regression tests: fallback to raw headers when $_SERVER lacks the header, $_SERVER precedence, and empty result when absent everywhere.

Verified end-to-end in wp-env (Apache + mod_php) via A/B: with the core .htaccess auth rule removed to mirror affected hosts, the old code never delivered the bearer to the verifier (no JWKS activity, decoy served); with this fix the same probe reaches StatusChallengeVerifier, fetches the platform JWKS, and fails only on the (deliberately) unverifiable test token — decoy behavior for invalid/missing challenges is unchanged.

[Copilot]

Pull request overview

Fixes the status endpoint’s Authorization header resolution on hosts where Apache withholds Authorization from $_SERVER, by delegating to the SDK’s header resolver and adding regression tests to cover the fallback behavior.

Changes:

• Bump getsupertab/connect-sdk-php from 1.4.0-beta.9 to 1.4.0-beta.10 to use RequestContext::resolveAuthorizationHeader().
• Update Status_Handler::get_authorization_header() to fall back to raw request headers (via getallheaders() seam) when $_SERVER lacks the header.
• Add regression tests for raw-header fallback, $_SERVER precedence, and empty result when absent.

Reviewed changes

Copilot reviewed 3 out of 4 changed files in this pull request and generated 5 comments.

File	Description
src/class-status-handler.php	Delegates Authorization header resolution to the SDK and adds a protected raw-header seam.
tests/StatusHandlerTest.php	Adds regression tests for Authorization header resolution and raw-header fallback.
composer.json	Updates SDK dependency version constraint to 1.4.0-beta.10.
composer.lock	Locks SDK to v1.4.0-beta.10 and updates the lockfile hash/metadata.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[github-actions]

🎉 This PR is included in version 1.3.0-beta.9 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀