Merge pull request 'fix: case-insensitive Bearer token parsing in auth header' (#25) from williams/lmcp:fix/case-insensitive-bearer-auth into master

Reviewed-on: #25

lmcp.lua

@@ -939,7 +939,7 @@ local function _check_auth(self, conn)
     if not self._auth_token then return true end
     if conn.method == "OPTIONS" then return true end
     local auth = conn.headers["authorization"] or ""
-    local token = auth:match("^Bearer%s+(.+)$")
+    local token = auth:match("^[Bb]earer%s+(.+)$")
     return token == self._auth_token
 end
 

server.lua

@@ -200,6 +200,13 @@ end
 local server_name = os.getenv("LMCP_NAME") or (WINDOWS and "windows-tools" or "linux-tools")
 local server = lmcp.new(server_name, {
     port = tonumber(os.getenv("LMCP_PORT") or arg[1]) or 8080,
+    -- LMCP_HOST: bind interface (default 0.0.0.0). Hosts that need
+    -- single-interface binding (hertz: 192.168.88.18 only) set this.
+    host = os.getenv("LMCP_HOST"),
+    -- LMCP_CONF: path to a conf file with bearer-token entries
+    -- (e.g. /opt/herding/etc/hertz-tools.conf). Read by lmcp.lua's
+    -- read_conf; the `.godparticle` entry becomes the bearer token.
+    conf = os.getenv("LMCP_CONF"),
 })
 
 -- ---- Tools ----