Simplify echo-http authentication to environment-based OAuth2/OIDC

[lambdalisue]

Summary

• Add OAuth2/OIDC server with environment-based authentication
• Add Basic and Bearer authentication handlers
• Remove path-based authentication endpoints (breaking changes)
• Standardize API documentation structure across all echo servers

Why

The previous implementation used credentials in URL paths (/basic-auth/{user}/{pass}, /oidc/{user}/{pass}/*), which created security and usability issues:

• Credentials in URLs appear in server logs and browser history (security anti-pattern)
• Each test scenario required different URL paths (poor DX)
• Configuration was inflexible for CI/CD environments

The new environment-based approach:

• Uses standard OAuth2/OIDC discovery endpoints (/.well-known/*, /oauth2/*)
• Configures credentials once via environment variables
• Follows OAuth2 and OIDC specifications more closely
• Simplifies integration testing with consistent URLs

Bearer authentication now uses SHA1(username:password) for predictable token generation, making it easier to script tests.

Breaking Changes

• Removed: /basic-auth/{user}/{pass}, /hidden-basic-auth/{user}/{pass}, /bearer
• Removed: /oidc/{user}/{pass}/* endpoints
• Added: /basic-auth, /bearer-auth (environment-based)
• Added: /oauth2/* and /.well-known/* endpoints
• Renamed: Environment variables from OIDC_* to AUTH_* prefix for consistency

Test Plan

• All tests pass (verified with `just test`)
• Linter passes (verified with `just lint`)
• Build succeeds (verified with `just build`)
• Documentation updated and formatted
• Manual testing of OAuth2 authorization flow
• Manual testing of Basic and Bearer authentication

[Copilot]

Pull request overview

This PR refactors the echo-http authentication system from path-based credentials to environment-based OAuth2/OIDC authentication. The changes remove deprecated endpoints that exposed credentials in URL paths and replace them with standard OAuth2/OIDC discovery endpoints that use environment variables for credential configuration.

Key Changes:

• Environment-based authentication using AUTH_* environment variables instead of path-based credentials
• New OAuth2 token endpoint supporting multiple grant types (authorization_code, client_credentials, password, refresh_token)
• Standard OAuth2/OIDC discovery endpoints (/.well-known/*, /oauth2/*)

Reviewed changes

Copilot reviewed 31 out of 32 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
echo-http/main.go	Updated routing to use new OAuth2/OIDC endpoints, removed path-based auth routes
echo-http/config.go	Renamed environment variables from OIDC_* to AUTH_* prefix, added new auth configuration
echo-http/handlers/config.go	Updated Config struct with new OAuth2/OIDC configuration fields
echo-http/handlers/auth.go	Simplified to only contain AuthResponse type definition
echo-http/handlers/basic_auth.go	New environment-based Basic Auth handler with helpful error messages
echo-http/handlers/bearer_auth.go	New Bearer token handler using SHA1(username:password) for token generation
echo-http/handlers/oauth2_*.go	New OAuth2/OIDC implementation with discovery, authorization, token, and utility handlers
echo-http/handlers/oidc*.go	Removed old path-based OIDC implementation
echo-http/README.md	Updated documentation with new endpoints and usage examples
echo-*/docs/api.md	Standardized API documentation structure across all echo servers

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

This documentation defines the Bearer auth token as SHA1(username:password), which relies on the weak and deprecated SHA1 hash of low-entropy credentials as the sole authentication secret. An attacker who guesses or learns the username/password can trivially recompute this deterministic, unsalted hash, making the Bearer token easy to forge and undermining any expectation of token strength. For any usage beyond very limited local testing, use a cryptographically strong, random bearer token format (or at least a modern hash/KDF) instead of SHA1 of credentials.

[Copilot]

The docs describe ID tokens using JWT with id_token_signing_alg_values_supported: ["none"] and an empty JWKS set, meaning clients are expected to accept completely unsigned tokens. Any relying party that treats these ID tokens as proof of identity can have authentication trivially bypassed by an attacker who forges a JWT with alg: "none", since there is no cryptographic verification. Make it extremely clear that this configuration must never be used in production and, for stronger guarantees even in tests, prefer signed tokens with a proper key pair advertised via JWKS.

Suggested change

	- Returns an empty key set because this implementation uses `alg: "none"` (no signature)
	- In a production OIDC provider, this would contain public keys in JWK format
	- This example returns an empty key set because this demo implementation issues unsigned ID tokens with `alg: "none"` (no signature).
	- **Do not use this configuration in production.** Relying parties must not treat unsigned ID tokens as proof of identity, because they can be trivially forged and bypass authentication.
	- For any non-trivial testing and all production deployments, configure signed tokens (for example, `RS256`) and expose the corresponding public keys here in JWK format so clients can verify token signatures.