From 94adc28e65b4bc4709e98845386088fb0895f5e7 Mon Sep 17 00:00:00 2001
From: Yanislav Igonin <yanislavdabest@gmail.com>
Date: Wed, 15 Jul 2026 23:18:27 +0400
Subject: [PATCH] fix(gateway): preserve duplicate auth behavior

---
 gateway/controllers.go      |  6 +++++-
 gateway/controllers_test.go | 33 +++++++++++++++++++++++++++++++++
 2 files changed, 38 insertions(+), 1 deletion(-)
 create mode 100644 gateway/controllers_test.go

diff --git a/gateway/controllers.go b/gateway/controllers.go
index 403d193..bf1ed9a 100644
--- a/gateway/controllers.go
+++ b/gateway/controllers.go
@@ -7,7 +7,11 @@ import (
 )
 
 func Ping(c *fiber.Ctx) error {
-	headerKey := c.Get("Authorization")
+	headerValues := c.GetReqHeaders()["Authorization"]
+	headerKey := ""
+	if len(headerValues) > 0 {
+		headerKey = headerValues[len(headerValues)-1]
+	}
 	if config.App.Gateway.ApiKey != headerKey {
 		return c.Status(fiber.StatusUnauthorized).JSON(fiber.Map{"error": "Unauthorized"})
 	}
diff --git a/gateway/controllers_test.go b/gateway/controllers_test.go
new file mode 100644
index 0000000..3cf82d5
--- /dev/null
+++ b/gateway/controllers_test.go
@@ -0,0 +1,33 @@
+package gateway
+
+import (
+	"net/http/httptest"
+	"testing"
+
+	"github.com/gofiber/fiber/v2"
+
+	"micrach/config"
+)
+
+func TestPingUsesLastAuthorizationHeader(t *testing.T) {
+	previousConfig := config.App
+	t.Cleanup(func() {
+		config.App = previousConfig
+	})
+	config.App.Gateway.ApiKey = "configured-key"
+
+	app := fiber.New()
+	app.Get("/api/ping", Ping)
+
+	req := httptest.NewRequest("GET", "/api/ping", nil)
+	req.Header.Add("Authorization", "wrong-key")
+	req.Header.Add("Authorization", "configured-key")
+
+	resp, err := app.Test(req)
+	if err != nil {
+		t.Fatalf("test ping request: %v", err)
+	}
+	if resp.StatusCode != fiber.StatusOK {
+		t.Fatalf("expected status %d when final Authorization header matches, got %d", fiber.StatusOK, resp.StatusCode)
+	}
+}