Return Basic realm from CONTENT_ORIGIN in WWW-Authenticate header (#1640)

The OrgGroupAssignmentMixin.authenticate_header() was returning a static
"Bearer" value. When DRF denied an unauthenticated request to a
content-guarded PyPI view, the 401 response carried
WWW-Authenticate: Bearer instead of a Basic challenge that prompts
browsers for credentials.

Derive the realm from settings.CONTENT_ORIGIN so the header matches the
environment (e.g. packages.redhat.com vs packages.stage.redhat.com).

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

Author: git-hyagi

pulp_service/pulp_service/app/authentication.py

@@ -2,7 +2,9 @@
 import logging
 from base64 import b64decode
 from binascii import Error as Base64DecodeError
+from urllib.parse import urlparse
 
+from django.conf import settings
 from django.contrib.auth import get_user_model
 
 from pulpcore.app.authentication import JSONHeaderRemoteAuthentication
@@ -78,7 +80,8 @@ def authenticate(self, request):
         return result
 
     def authenticate_header(self, request):
-        return "Bearer"
+        hostname = urlparse(settings.CONTENT_ORIGIN).hostname or "packages.redhat.com"
+        return f'Basic realm="{hostname}"'
 
 
 class RHServiceAccountCertAuthentication(OrgGroupAssignmentMixin, JSONHeaderRemoteAuthentication):

pulp_service/pulp_service/tests/functional/test_content_guard_permission.py

@@ -194,7 +194,7 @@ def test_unauthenticated_denied_on_guarded_pypi_simple_api(configure_guarded_pyp
     response = requests.get(pypi_url, timeout=30)
 
     assert response.status_code == 401
-    assert response.headers["WWW-Authenticate"] == "Bearer"
+    assert response.headers["WWW-Authenticate"].startswith("Basic realm=")
 
 
 def test_write_operations_unaffected_by_content_guard(configure_guarded_pypi_distribution):

pulp_service/pulp_service/tests/unit/test_authentication_error_content_guard.py

@@ -91,15 +91,16 @@ async def set(self, *args, **kwargs):
 
 
 class TestHandlerAuthentication:
-    def test_permit_maps_authentication_error_to_401(self):
+    def test_permit_maps_authentication_error_to_401(self, settings):
         detail_guard = _detail_guard("identity", AuthenticationError("Authentication required."))
         request = MagicMock(path="/lightwell/osv/record")
+        settings.CONTENT_ORIGIN = "https://packages.stage.redhat.com"
 
         with pytest.raises(HTTPUnauthorized) as exc_info:
             Handler._permit(request, _distribution(detail_guard))
 
         assert exc_info.value.status == 401
-        assert exc_info.value.headers["WWW-Authenticate"] == 'Basic realm="packages.redhat.com"'
+        assert exc_info.value.headers["WWW-Authenticate"] == 'Basic realm="packages.stage.redhat.com"'
 
     def test_permit_keeps_permission_error_as_403(self):
         detail_guard = _detail_guard("feature", PermissionError("Access denied."))