From f7ffc3f8bc810b4668941a8f8acfe33aab247970 Mon Sep 17 00:00:00 2001
From: Leo Vasanko <leo@git>
Date: Sun, 26 Apr 2026 05:13:37 +0000
Subject: [PATCH] Restore UA-aware auth header advertisement

Revert accidental removal of WWW-Authenticate headers.
Windows WebDAV clients receive Basic + Negotiate;
all other clients receive Basic only.
---
 cista/auth.py            | 9 ++++++++-
 tests/test_files_auth.py | 4 ++--
 2 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/cista/auth.py b/cista/auth.py
index 9074513..6c7788f 100644
--- a/cista/auth.py
+++ b/cista/auth.py
@@ -279,7 +279,14 @@ def _log_webdav_user_agent_once(request, user_agent: str):
 
 
 def _build_ua_auth_headers(request, *, include_hint=False) -> dict[str, str]:
-    return {}
+    user_agent = request.headers.get("user-agent", "")
+    _log_webdav_user_agent_once(request, user_agent)
+    if _is_windows_auth_client(user_agent):
+        challenge = f'Basic realm="{_AUTH_REALM}", Negotiate'
+    else:
+        challenge = f'Basic realm="{_AUTH_REALM}"'
+    headers = {"WWW-Authenticate": challenge}
+    return headers
 
 
 def _cleanup_ntlm_challenges():
diff --git a/tests/test_files_auth.py b/tests/test_files_auth.py
index 76533eb..29fdf80 100644
--- a/tests/test_files_auth.py
+++ b/tests/test_files_auth.py
@@ -159,11 +159,11 @@ async def test_options_unauthenticated_allowed(client):
 
 
 @pytest.mark.asyncio
-async def test_unauthenticated_sends_no_auth_challenge(client):
+async def test_unauthenticated_sends_basic_auth_challenge(client):
     _, res = await client.request("PROPFIND", "/files/")
 
     assert res.status_code == 401
-    assert "www-authenticate" not in res.headers
+    assert res.headers.get("www-authenticate", "").lower().startswith('basic realm="cista"')
 
 
 @pytest.mark.asyncio