Update test scenarios for echo-http API breaking changes#92
Merged
lambdalisue merged 2 commits intomainfrom Jan 6, 2026
Merged
Update test scenarios for echo-http API breaking changes#92lambdalisue merged 2 commits intomainfrom
lambdalisue merged 2 commits intomainfrom
Conversation
echo-http underwent breaking changes moving to environment-based
authentication and standard OAuth2/OIDC endpoints. This updates
test scenarios to reflect the new API:
- Basic/Bearer auth: Removed path parameters (/basic-auth/{u}/{p})
in favor of environment variable configuration
- Bearer token: Changed to SHA1(username:password) format
- OIDC endpoints: Migrated from /oidc/{u}/{p}/* to standard
/.well-known/* and /oauth2/* paths per RFC 8414
- OIDC issuer: Simplified from path-based to BASE_URL
- Authenticated requests: Changed /bearer to /oauth2/userinfo
to use standard OIDC UserInfo endpoint
There was a problem hiding this comment.
Pull request overview
This PR updates test scenarios in the probitas test suite to align with breaking changes in the echo-http API. The changes migrate authentication mechanisms from path-based to environment-variable-based configuration, adopt RFC 8414 compliant OAuth2/OIDC endpoints, and update bearer token authentication to use SHA1 hashing.
Key changes:
- Migrated from custom
/oidc/{user}/{pass}/*paths to standard/.well-known/*and/oauth2/*RFC 8414-compliant endpoints - Updated authentication endpoints from path-based credentials to environment-variable configuration
- Changed bearer authentication to use SHA1 token hashing format and updated endpoints from
/bearerto/bearer-authand/oauth2/userinfo
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| probitas/03-client-http.probitas.ts | Updated BASE_URL to use environment variable; migrated Basic auth endpoint from /basic-auth/{user}/{pass} to /basic-auth; changed Bearer auth endpoint from /bearer to /bearer-auth with SHA1 token format |
| probitas/16-client-http-oidc.probitas.ts | Updated BASE_URL to use environment variable and simplified ISSUER configuration; migrated OIDC discovery and OAuth2 endpoints to RFC 8414 standard paths (/.well-known/openid-configuration, /oauth2/authorize, /oauth2/token, /oauth2/userinfo); changed authentication response validation from authenticated: true to sub: TEST_USER |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Why
echo-http underwent breaking changes to align with OAuth2/OIDC standards and improve security:
Standards Compliance: Moved from custom
/oidc/{user}/{pass}/*paths to standard/.well-known/*and/oauth2/*endpoints per RFC 8414 (OAuth 2.0 Authorization Server Metadata)Security Improvement: Authentication credentials are now configured via environment variables instead of URL path parameters, preventing credential leakage in logs and URLs
API Consistency: Bearer authentication now uses SHA1 token hashing and follows the same environment-based pattern as Basic auth
OIDC Standard Endpoints: Authenticated requests now use the standard
/oauth2/userinfoendpoint instead of the custom/bearerendpointThese changes ensure test scenarios accurately verify the new echo-http API behavior.
Test Plan