[PATCH pve-guest-common] tunnel: websocket: prepend api token name when missing

[PATCH pve-guest-common] tunnel: websocket: prepend api token name when missing

[Erik Fastermann]

Ensure that the API token used in `fork_websocket_tunnel` is properly
prefixed with 'PVEAPIToken=' if it isn't already.

Previously, if a token was supplied without this explicit prefix,
initial API checks would pass successfully, but QEMU and LXC
migrations would abruptly fail midway with the error "server didn't
upgrade: 401 Unauthorized" when attempting to establish the websocket
tunnel. This inconsistency created a confusing user experience, as the
migration appeared to work fine initially.

The early API checks succeeded because `PVE::APIClient::LWP` already
automatically handles the missing prefix. This change brings the
websocket tunnel setup in line with that behavior, preventing mid-
migration failures when the prefix is omitted.

Signed-off-by: Erik Fastermann <e.fastermann@proxmox.com>
---
 src/PVE/Tunnel.pm | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/src/PVE/Tunnel.pm b/src/PVE/Tunnel.pm
index 791b465..10f2bd6 100644
--- a/src/PVE/Tunnel.pm
+++ b/src/PVE/Tunnel.pm
@@ -234,6 +234,9 @@ sub fork_websocket_tunnel {
     my ($conn, $url, $req_params, $tunnel_params, $log) = @_;
 
     if (my $apitoken = $conn->{apitoken}) {
+        if ($apitoken !~ /^\w+(?:=| )/) {
+            $apitoken = "PVEAPIToken=${apitoken}";
+        }
         $tunnel_params->{headers} = [["Authorization", "$apitoken"]];
     } else {
         die "can't connect to remote host without credentials\n";
-- 
2.47.3