auth: include Basic challenge in 401 responses

Requests rejected by Basic authentication currently return 401 without WWW-Authenticate, preventing HTTP clients from prompting for credentials. Advertise the Basic scheme on the server and metrics auth paths while leaving proxy authentication unchanged.

mux_test.go

@@ -1,6 +1,7 @@
 package restserver
 
 import (
+	"net/http"
 	"net/http/httptest"
 	"testing"
 )
@@ -78,3 +79,57 @@ func TestCheckAuth(t *testing.T) {
 		})
 	}
 }
+
+func TestUnauthorizedResponsesIncludeBasicChallenge(t *testing.T) {
+	const challenge = `Basic realm="rest-server"`
+
+	tests := []struct {
+		name          string
+		server        *Server
+		metrics       bool
+		wantChallenge string
+	}{
+		{
+			name:          "server Basic authentication",
+			server:        &Server{},
+			wantChallenge: challenge,
+		},
+		{
+			name:   "server proxy authentication",
+			server: &Server{ProxyAuthUsername: "X-Remote-User"},
+		},
+		{
+			name:          "metrics Basic authentication",
+			server:        &Server{},
+			metrics:       true,
+			wantChallenge: challenge,
+		},
+		{
+			name:    "metrics proxy authentication",
+			server:  &Server{ProxyAuthUsername: "X-Remote-User"},
+			metrics: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			var handler http.HandlerFunc
+			if tt.metrics {
+				handler = tt.server.wrapMetricsAuth(func(http.ResponseWriter, *http.Request) {
+					t.Fatal("handler should not be called for an unauthorized request")
+				})
+			} else {
+				handler = tt.server.ServeHTTP
+			}
+
+			rec := httptest.NewRecorder()
+			handler(rec, httptest.NewRequest(http.MethodGet, "/", nil))
+			if rec.Code != http.StatusUnauthorized {
+				t.Fatalf("status = %d, want %d", rec.Code, http.StatusUnauthorized)
+			}
+			if got := rec.Header().Get("WWW-Authenticate"); got != tt.wantChallenge {
+				t.Errorf("WWW-Authenticate = %q, want %q", got, tt.wantChallenge)
+			}
+		})
+	}
+}