refactor(a2a)!: converge a2a_agent auth_type to the control-plane enum (drop oauth2)

[moonming]

What

Converge the a2a_agent resource's auth_type to the control-plane resource model, per the repo rule "The Resource Model Is Canonical in cp-admin.yaml" (CLAUDE.md): the control-plane spec allows only none / bearer / api_key for A2A agents and defines no OAuth fields on this resource.

The oauth2 arm here was schema-only forward compatibility: the runtime never implemented it, so an agent configured with auth_type: oauth2 always answered 501 Not Implemented at request time, and the control plane never accepted such a document in the first place. After this change, schema == spec == runtime reality.

(The mcp_server resource's oauth2 auth is a different story — it is part of the control-plane spec and fully implemented in the runtime. It is deliberately untouched.)

Changes

• crates/aisix-core/src/models/a2a_agent.rs — remove the A2aAuthType::OAuth2 variant and the oauth2-exclusive client_id / token_url / scopes fields (none of which exist on the control-plane a2a_agent resource, and none of which were read by the bearer / api_key paths); update the secret doc comment accordingly.
• crates/aisix-core/src/models/schema.rs — drop the oauth2 title entry from the generated A2aAuthType schema.
• crates/aisix-a2a/src/bridge.rs — upstream_from_a2a_agent is now infallible (every representable auth_type maps to a working upstream auth); remove the forward-compat doc note.
• crates/aisix-a2a/src/error.rs — remove the now-unconstructable A2aError::Unsupported variant.
• crates/aisix-proxy/src/a2a.rs — delete the unreachable 501 branches in the /a2a/:agent dispatch and agent-card handlers and the Unsupported → 501 status mapping.
• crates/aisix-admin/src/a2a_agents_handlers.rs — delete the oauth2 credential-coupling check; an oauth2 payload now fails schema validation up front.
• schemas/resources/a2a_agent.schema.json — regenerated (cargo run -p aisix-core --bin dump-schema).

Test coverage was converted, not deleted:

• model: oauth2 acceptance test → rejection test (auth_type: "oauth2" and each former OAuth field now fail deserialization), plus an api_key round-trip test replacing the oauth2 round-trip.
• Admin API: "incomplete oauth2 → 400" → "oauth2 auth_type → 400 schema rejection".
• proxy: status-map test keeps the Connect/Request → 502 assertions.

No case under tests/e2e/ references the /a2a surface, so there was no oauth2 e2e pin to convert.

Compatibility note (breaking)

Stored a2a_agent documents carrying auth_type: oauth2 — only creatable through the standalone Admin API, and always 501 at request time — no longer validate: the snapshot loader skips them with a warning and surfaces them as rejected entries, and the Admin API rejects such payloads with 400 (previously accepted-then-501). Documents using none / bearer / api_key are unaffected; no field they use changed.

Verification

• cargo fmt --all -- --check — clean
• cargo clippy --workspace --all-targets -- -D warnings — clean
• cargo test -p aisix-core -p aisix-a2a -p aisix-admin -p aisix-proxy — 1126 passed, 0 failed, 2 ignored (pre-existing)
• cargo run -p aisix-core --bin dump-schema — only schemas/resources/a2a_agent.schema.json changed (drift gate will agree)
• cargo run -p aisix-admin --bin dump-openapi — succeeds; in the dumped spec the A2aAgent / A2aAgentEntry / A2aAuthType components carry no oauth2 / client_id / token_url / scopes remnant, while McpServer still documents its (implemented) oauth2
• cargo build --bin aisix — succeeds

Summary by CodeRabbit

• Breaking Changes

  • Removed OAuth 2.0 authentication support from A2A agent configuration.
  • OAuth 2.0 configurations and related fields are now rejected during validation.
  • Supported authentication methods are now limited to None, Bearer, and API key.

• Bug Fixes

  • Simplified A2A connection handling and removed incorrect “Not Implemented” responses for unsupported authentication configurations.

Standalone operators, two additional notes: a previously stored auth_type: oauth2 agent document is skipped by the loader after this change (WARN log schema validation failed; skipping plus the schema_rejected counter); find such documents via that log line and delete or fix them — DELETE /admin/v1/a2a_agents/{id} works without decoding the document. Calls to such an agent's /a2a/<name> path change from 501 to 404, because the resource is absent from the snapshot.

[coderabbitai]

📝 Walkthrough

Walkthrough

A2A OAuth2 configuration is removed from models and schemas. Admin validation rejects OAuth2 payloads through schema validation, while upstream construction and proxy handlers use a direct non-error-returning path for the remaining authentication modes.

Changes

A2A OAuth2 removal

Layer / File(s)	Summary
Authentication contract updates crates/aisix-core/src/models/a2a_agent.rs, crates/aisix-core/src/models/schema.rs, schemas/resources/a2a_agent.schema.json	A2aAuthType and OAuth2-specific fields are removed; model and serialization tests now reject OAuth2 and cover api_key behavior.
Schema-based admin validation crates/aisix-admin/src/a2a_agents_handlers.rs	OAuth2 completeness checks are removed from decoding, and schema validation tests expect 400 Bad Request for OAuth2 payloads.
Direct upstream construction and proxy flow crates/aisix-a2a/src/bridge.rs, crates/aisix-a2a/src/error.rs, crates/aisix-proxy/src/a2a.rs	Upstream construction returns A2aUpstream directly, A2aError::Unsupported is removed, and proxy handlers no longer handle upstream-construction errors.

Estimated code review effort: 4 (Complex) | ~45 minutes

Sequence Diagram(s)

sequenceDiagram
  participant A2ARequest
  participant Proxy
  participant Bridge
  participant A2aUpstream
  A2ARequest->>Proxy: send agent request
  Proxy->>Bridge: build upstream from A2aAgent
  Bridge->>A2aUpstream: return auth mapping and timeout
  Proxy->>A2aUpstream: forward request

Loading

Possibly related PRs

• api7/aisix#717: Updates the same A2A bridge and unsupported OAuth2 error path.
• api7/aisix#732: Updates documentation and schema descriptions for the OAuth2 configuration removed here.

🚥 Pre-merge checks | ✅ 5 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
E2e Test Quality Review	⚠️ Warning	No A2A cases exist under tests/e2e, and the added coverage is crate-level unit/integration only, so the admin→snapshot→proxy→upstream flow isn’t pinned end-to-end.	Add a real e2e case that creates an A2A agent through Admin, loads it from snapshot, calls /a2a/:agent and agent-card, and asserts oauth2 is rejected with 400.

✅ Passed checks (5 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Security Check	✅ Passed	No new security issues: secrets stay gateway-side, AdminAuth still gates mutating routes, and the PR removes only unreachable oauth2 paths without new leakage.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: aligning a2a_agent auth_type with the control-plane enum by dropping oauth2.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch refactor/a2a-auth-enum-convergence

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}