fix(auth): reject invalid optional credentials

[BigSimmo]

Summary

• Distinguish optional authentication as absent | valid | invalid.
• Return 401 for presented invalid or malformed credentials instead of assigning the anonymous quota.
• Give an Authorization header precedence over cookies and propagate dependency failures instead of downgrading them.
• Preserve public reads when credentials are absent and preserve administrator-only uploads; the stale anonymous-upload patch was not applied.

Verification

• npm run verify:pr-local — final merged head passed; 360 files, 3,192 tests passed, 1 skipped; build and offline fixtures passed
• npm run verify:cheap — 21 gates; 360 files passed; 3,191 tests passed, 1 skipped
• npm exec vitest run tests/auth-tri-state.test.ts tests/account-access-model.test.ts tests/private-access-routes.test.ts — 3 files, 141 tests passed on the final merged head
• npm run build — production build, TypeScript, 1,677 static pages, and client-bundle secret scan passed
• npm run check:rag:fixtures — 36 golden cases / 21 suites passed; no RAG behavior changed
• npm run check:production-readiness — code guards passed; clean worktree intentionally lacks .env.local, so Supabase/OpenAI configuration checks reported missing variables and no provider call was made
• UI verification not run: no UI, routing, styling, or browser behavior changed.
• Live RAG not run: no retrieval, ranking, generation, or source behavior changed; spending would add no useful evidence.

Red proof: before the implementation, the focused invalid-bearer test failed because getOptionalAuthenticatedUser resolved null instead of rejecting.

Risk and rollout

• Risk: clients that send a stale/invalid Authorization header alongside a valid cookie now receive the intended 401 and must refresh or remove the invalid header. Requests with no credentials remain public.
• Rollback: revert this PR; no schema, data, provider, or deployment mutation is involved.
• Provider or production effects: None. Local/static/mocked checks only.

Clinical Governance Preflight

• Source-backed claims still require linked source verification before clinical use
• No patient-identifiable document workflow was introduced or expanded without explicit governance approval
• Supabase target remains Clinical KB Database (sjrfecxgysukkwxsowpy)
• Service-role keys and private document access remain server-only
• Demo/synthetic content remains clearly separated from real clinical sources
• Source metadata, review status, and outdated/unknown-source behavior remain conservative
• Deployment classification/TGA SaMD impact was checked; clinical decision-support behavior is unchanged

Notes

• Upload duplicate metadata remains reachable only after administrator authentication. Anonymous uploads are already rejected on current main before form parsing and duplicate lookup, so the archived anonymous-upload response patch was rejected as stale.
• RAG impact: no retrieval behaviour change — authentication and quota classification only.

[supabase]

This pull request has been ignored for the connected project sjrfecxgysukkwxsowpy because there are no changes detected in supabase directory. You can change this behaviour in Project Integrations Settings ↗︎.

---

Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f83bb6772f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".