From 97d4dc87a48cda70c4e12d3f99a071f73b3831c5 Mon Sep 17 00:00:00 2001
From: saif <11242541+saifsmailbox98@users.noreply.github.com>
Date: Wed, 15 Jul 2026 14:31:10 +0530
Subject: [PATCH 1/2] test(agent-proxy): cover username-only basic auth rewrite

---
 packages/agentproxy/rewrite_test.go | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/packages/agentproxy/rewrite_test.go b/packages/agentproxy/rewrite_test.go
index 723abc38..6bdfe62e 100644
--- a/packages/agentproxy/rewrite_test.go
+++ b/packages/agentproxy/rewrite_test.go
@@ -56,6 +56,20 @@ func TestBasicAuthFromTwoCredentials(t *testing.T) {
 	}
 }
 
+func TestBasicAuthUsernameOnly(t *testing.T) {
+	req := newReq(t, "")
+	svc := &resolvedService{credentials: []resolvedCredential{
+		{role: roleHeaderRewrite, headerPurpose: purposeUsername, value: "user"},
+	}}
+	if err := applyCredentials(req, svc); err != nil {
+		t.Fatal(err)
+	}
+	// base64("user:") == "dXNlcjo=" — an omitted password yields an empty password segment.
+	if got := req.Header.Get("Authorization"); got != "Basic dXNlcjo=" {
+		t.Fatalf("unexpected basic auth header: %q", got)
+	}
+}
+
 func TestSubstitutionInQuery(t *testing.T) {
 	req := newReq(t, "")
 	svc := &resolvedService{credentials: []resolvedCredential{

From 5e59c3eeaf303ad92d93761cd6bdbd281827d449 Mon Sep 17 00:00:00 2001
From: saif <11242541+saifsmailbox98@users.noreply.github.com>
Date: Wed, 15 Jul 2026 14:55:39 +0530
Subject: [PATCH 2/2] chore(agent-proxy): drop comment in username-only test

---
 packages/agentproxy/rewrite_test.go | 1 -
 1 file changed, 1 deletion(-)

diff --git a/packages/agentproxy/rewrite_test.go b/packages/agentproxy/rewrite_test.go
index 6bdfe62e..eb04e272 100644
--- a/packages/agentproxy/rewrite_test.go
+++ b/packages/agentproxy/rewrite_test.go
@@ -64,7 +64,6 @@ func TestBasicAuthUsernameOnly(t *testing.T) {
 	if err := applyCredentials(req, svc); err != nil {
 		t.Fatal(err)
 	}
-	// base64("user:") == "dXNlcjo=" — an omitted password yields an empty password segment.
 	if got := req.Header.Get("Authorization"); got != "Basic dXNlcjo=" {
 		t.Fatalf("unexpected basic auth header: %q", got)
 	}