Bun: empty Basic-auth credentials cause stack overflow instead of 401 #696

Summary

Sending a Basic-auth header with empty username and empty password (Basic <base64(':')>) causes Harper to crash with Maximum call stack size exceeded under Bun instead of returning a graceful 401.

Reproduction

Start Harper on Bun and send:

POST /
Authorization: Basic Og==
Content-Type: application/json

{"operation":"describe_all"}

Observed

Harper throws a stack overflow and the worker becomes unresponsive:

{"error":"Maximum call stack size exceeded."}

Expected

401 with {"error":"Must login"} or similar.

Context

Discovered via integration test describe_all with empty credentials returns 401 in integrationTests/apiTests/authentication.test.mjs (PR #645). The test was skipped on Bun as a workaround.

The crash only occurs on Bun. Node.js handles the same request correctly. The stack trace points into dist/security/auth.js — likely a recursive call triggered when both username and password are empty strings that behaves differently under Bun's string/prototype handling.

Related: #38 (Support running on Bun)