IONOS(user_oidc): backport Bearer-scheme guard from upstream #1386 (HDNEXT-2218)

[printminion-co]

Summary

NC30–NC33 IONOS user_oidc line: vanilla v8.6.1 + a single backported upstream fix.

• Integration branch ionos-stable8.6 = vanilla v8.6.1 (b5a67c7).
• This PR adds the backport on top. It is a verbatim cherry-pick -x of upstream
  2aa104a
  (nextcloud/user_oidc#1386), which landed
  after v8.6.1 — the version we must stay on.

Why

Backend::getCurrentUserId() strips a Bearer prefix from the Authorization header without
checking the header actually uses the Bearer scheme. A WebDAV client authenticating with an app
password sends Authorization: Basic …; that value passes through unmodified and is forwarded to
the IdP as Authorization: Bearer Basic …, which the IdP rejects with 400. The request then
succeeds via the app-password backend, so the defect is invisible from the client side.

Because DAV requests carry no session, Nextcloud re-runs the full auth chain per request
(apps/dav/lib/Connector/Sabre/Auth.php → OC_User::handleApacheAuth() →
Backend::getCurrentUserId()), so this fires on every PROPFIND, PUT and MKCOL from every
non-browser client.

Measured live 2026-09-09, 08:00–09:00 UTC: 92,617 /userinfo calls/hour estate-wide
(~2.2M/day), of which 9 in three hours were legitimate. Load is spiky rather than smooth — a
single rclone client produced 3,492 of these events in one minute (~29 /userinfo calls/second
from one host), which alone exceeds the estate-wide hourly average.

Reconciliation against v8.6.1

Commit	Outcome
2aa104a — only validate auth if the Authorization header starts with 'Bearer'	kept, applies cleanly (v8.6.1 already carries the preg_replace('/^bearer\s+/i', …) line the patch expects)

Because this is the unmodified upstream commit, the IONOS delta disappears by itself as soon as we
upgrade to an upstream release that already contains nextcloud#1386.

No configuration change

userinfo_bearer_validation stays true and must not be set to false: IONOS access tokens carry
no userId claim, so SelfEncodedValidator cannot resolve a uid and UserInfoValidator is the only
validator that works. Over three hours live, all 9 successful Bearer validations went through
UserInfoValidator and zero through SelfEncodedValidator.

Scope note

This branch line (ionos-stable8.6) serves HiDriveNext / nc-server, whose four release branches
(ionos-dev-v30 … ionos-dev-v33) all pin the same v8.6.1 commit; v8.6.1 declares NC min 29 /
max 34, so one artifact covers all four. appinfo/info.xml therefore needs no bump.

The ionos-dev branch (ncw-server, 8.1.0 line) has the same defect but is deliberately not
touched here — it needs its own ticket and its own backport.

Consumed by the IONOS-Productivity/nc-server ionos-dev-v30…v33 submodule bumps after merge +
prerelease tag v8.6.1-<sha7>.

Commit hashes are written unformatted (no backticks) so GitHub auto-links them.

Jira: HDNEXT-2218