Address PR review comments

- Fix error message: Change 'Missing or invalid' to 'Invalid' for Authorization header format
- Update documentation: Add breaking change notice for v0.2.13 auth config structure
- Update all auth config examples to use new provider_config structure
- Add GitHub token provider documentation
- Align GitHub default claims mapping with OAuth2 (use 'roles' instead of 'username')
- Add clarification comment that GitHub provider validates GitHub-issued tokens

llama_stack/distribution/datatypes.py

@@ -244,8 +244,7 @@ class GitHubTokenAuthConfig(BaseModel):
     )
     claims_mapping: dict[str, str] = Field(
         default_factory=lambda: {
-            "login": "username",
-            "id": "user_id",
+            "login": "roles",
             "organizations": "teams",
         },
         description="Mapping from GitHub user fields to access attributes",

llama_stack/distribution/server/auth.py

@@ -92,7 +92,7 @@ class AuthenticationMiddleware:
                 return await self._send_auth_error(send, error_msg)
 
             if not auth_header.startswith("Bearer "):
-                return await self._send_auth_error(send, "Missing or invalid Authorization header")
+                return await self._send_auth_error(send, "Invalid Authorization header format")
 
             token = auth_header.split("Bearer ", 1)[1]
 

llama_stack/distribution/server/auth_providers.py

@@ -322,7 +322,10 @@ class GitHubTokenAuthProvider(AuthProvider):
         self.config = config
 
     async def validate_token(self, token: str, scope: dict | None = None) -> User:
-        """Validate a GitHub token by calling the GitHub API."""
+        """Validate a GitHub token by calling the GitHub API.
+        
+        This validates tokens issued by GitHub (personal access tokens or OAuth tokens).
+        """
         try:
             user_info = await self._get_github_user_info(token)