Skip to content

Update test scenarios for echo-http API breaking changes#92

Merged
lambdalisue merged 2 commits intomainfrom
fix/new-echo-http
Jan 6, 2026
Merged

Update test scenarios for echo-http API breaking changes#92
lambdalisue merged 2 commits intomainfrom
fix/new-echo-http

Conversation

@lambdalisue
Copy link
Member

Summary

  • Update Basic/Bearer authentication tests to use new endpoint paths
  • Migrate OIDC test scenarios to standard RFC 8414 compliant endpoints
  • Replace path-based authentication with environment variable configuration
  • Update Bearer token format to SHA1(username:password)

Why

echo-http underwent breaking changes to align with OAuth2/OIDC standards and improve security:

  1. Standards Compliance: Moved from custom /oidc/{user}/{pass}/* paths to standard /.well-known/* and /oauth2/* endpoints per RFC 8414 (OAuth 2.0 Authorization Server Metadata)

  2. Security Improvement: Authentication credentials are now configured via environment variables instead of URL path parameters, preventing credential leakage in logs and URLs

  3. API Consistency: Bearer authentication now uses SHA1 token hashing and follows the same environment-based pattern as Basic auth

  4. OIDC Standard Endpoints: Authenticated requests now use the standard /oauth2/userinfo endpoint instead of the custom /bearer endpoint

These changes ensure test scenarios accurately verify the new echo-http API behavior.

Test Plan

  • Run `ECHO_HTTP_URL=http://localhost:18080 deno task probitas run -s 'tag:http'` - all HTTP scenarios pass
  • Verify Basic authentication with environment-configured credentials
  • Verify Bearer authentication with SHA1 token format
  • Verify OIDC discovery endpoint (`/.well-known/openid-configuration`)
  • Verify OIDC authorization flow with standard OAuth2 endpoints
  • Verify authenticated requests to `/oauth2/userinfo`
  • Run `deno task verify` - all tests, lint, and type checks pass

echo-http underwent breaking changes moving to environment-based
authentication and standard OAuth2/OIDC endpoints. This updates
test scenarios to reflect the new API:

- Basic/Bearer auth: Removed path parameters (/basic-auth/{u}/{p})
  in favor of environment variable configuration
- Bearer token: Changed to SHA1(username:password) format
- OIDC endpoints: Migrated from /oidc/{u}/{p}/* to standard
  /.well-known/* and /oauth2/* paths per RFC 8414
- OIDC issuer: Simplified from path-based to BASE_URL
- Authenticated requests: Changed /bearer to /oauth2/userinfo
  to use standard OIDC UserInfo endpoint
Copilot AI review requested due to automatic review settings January 6, 2026 15:04
@lambdalisue lambdalisue enabled auto-merge January 6, 2026 15:04
Copy link

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR updates test scenarios in the probitas test suite to align with breaking changes in the echo-http API. The changes migrate authentication mechanisms from path-based to environment-variable-based configuration, adopt RFC 8414 compliant OAuth2/OIDC endpoints, and update bearer token authentication to use SHA1 hashing.

Key changes:

  • Migrated from custom /oidc/{user}/{pass}/* paths to standard /.well-known/* and /oauth2/* RFC 8414-compliant endpoints
  • Updated authentication endpoints from path-based credentials to environment-variable configuration
  • Changed bearer authentication to use SHA1 token hashing format and updated endpoints from /bearer to /bearer-auth and /oauth2/userinfo

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File Description
probitas/03-client-http.probitas.ts Updated BASE_URL to use environment variable; migrated Basic auth endpoint from /basic-auth/{user}/{pass} to /basic-auth; changed Bearer auth endpoint from /bearer to /bearer-auth with SHA1 token format
probitas/16-client-http-oidc.probitas.ts Updated BASE_URL to use environment variable and simplified ISSUER configuration; migrated OIDC discovery and OAuth2 endpoints to RFC 8414 standard paths (/.well-known/openid-configuration, /oauth2/authorize, /oauth2/token, /oauth2/userinfo); changed authentication response validation from authenticated: true to sub: TEST_USER

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@lambdalisue lambdalisue merged commit c6a849d into main Jan 6, 2026
10 checks passed
@lambdalisue lambdalisue deleted the fix/new-echo-http branch January 6, 2026 15:06
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants