fix(auth): store bearer tokens in native credentials

cloudflare/src/auth.ts

@@ -3,7 +3,7 @@ import { primaryD1Session } from "./bindings.js";
 import { prefixedKvKey } from "./kv_keys.js";
 
 const AUTH_SESSION_CACHE_NAMESPACE = "auth_session_cache";
-const BEARER_TOKEN_PATTERN = /^[A-Za-z0-9._~+/=-]{32,4096}$/;
+const BEARER_TOKEN_PATTERN = /^[A-Za-z0-9._~+/=-]{32,2560}$/;
 const SUBJECT_ID_PATTERN = /^[a-zA-Z0-9._:-]{3,128}$/;
 const DEVICE_ID_PATTERN = /^[a-zA-Z0-9._:-]{3,128}$/;
 const BETTER_AUTH_SESSION_QUERY = `

cloudflare/tests/api_controls.test.ts

@@ -149,6 +149,23 @@ describe("api controls", () => {
     ]);
   });
 
+  it("rejects bearer tokens larger than the native credential contract", async () => {
+    const d1Queries: string[] = [];
+    const response = await withAuthenticatedApiControls(
+      new Request("https://elydora.test/api/devices", {
+        headers: { authorization: `Bearer ${"A".repeat(2561)}` },
+      }),
+      testEnv({ d1: testD1Database({ queries: d1Queries }) }),
+      "devices.list",
+      ["GET"],
+      () => Promise.resolve(jsonResponse({ ok: true }, 200)),
+    );
+
+    assert.equal(response.status, 401);
+    assert.deepEqual(await response.json(), { error: "authorization_invalid" });
+    assert.deepEqual(d1Queries, []);
+  });
+
   it("passes authenticated session context and records subject audit fields", async () => {
     const tokenHash = await authTokenHash(ACCESS_TOKEN);
     const auditEvents: ElyAnalyticsDataPoint[] = [];