feat: Add inbound bypass paths for public endpoints

[huang195]

Summary

Closes #124

AuthBridge's ext-proc now skips inbound JWT validation for configurable path patterns, allowing agents and tools to expose public endpoints without requiring OAuth.

• Default bypass paths are built into the go-processor: /.well-known/*, /healthz, /readyz, /livez. These work out of the box with no configuration needed.
• Override via env var: Set BYPASS_INBOUND_PATHS to a comma-separated list of path patterns to replace the defaults entirely (e.g., BYPASS_INBOUND_PATHS=/.well-known/*,/metrics).
• Patterns use Go's path.Match glob syntax: * matches any sequence of non-/ characters, so /.well-known/* matches /.well-known/agent.json but not /.well-known/a/b.
• Query strings are stripped before matching.

Files changed

• AuthBridge/AuthProxy/go-processor/main.go — bypass path matching logic, default patterns, env var override parsing, bypass check in handleInbound()
• AuthBridge/AuthProxy/go-processor/main_test.go — unit tests for pattern matching and default behavior

How it works

1. On startup, the go-processor initializes bypassInboundPaths with the built-in defaults.
2. If BYPASS_INBOUND_PATHS is set, the defaults are replaced with the env var values.
3. On each inbound request, the :path pseudo-header is checked against the bypass list before JWT validation. If matched, the request is forwarded without authentication.

Example: override defaults

To disable all bypasses:

BYPASS_INBOUND_PATHS=""

To add a custom set:

BYPASS_INBOUND_PATHS="/.well-known/*,/healthz,/metrics,/custom-public"

Test plan

• go build ./... passes
• go test ./... — 13 unit tests pass (exact match, glob match, query string, empty list, defaults)
• make test in kagenti-webhook passes
• Cluster test: GET /.well-known/agent.json from another pod returns 200 without auth
• Cluster test: GET /healthz from another pod bypasses (404 from app, not 401)
• Cluster test: GET /, /api/data, /v1/tasks from another pod all return 401

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR adds configurable path bypass functionality to AuthBridge's go-processor, allowing specific endpoints to skip inbound JWT validation for public access. This addresses issue #124 by enabling agents and tools to expose public endpoints like AgentCard discovery and health checks without OAuth requirements.

Changes:

• Added bypass path matching with default patterns for common public endpoints (/.well-known/*, /healthz, /readyz, /livez)
• Implemented BYPASS_INBOUND_PATHS environment variable for custom configuration with comma-separated glob patterns
• Integrated bypass logic into the inbound authentication flow to skip JWT validation for matched paths

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 5 comments.

File	Description
AuthBridge/AuthProxy/go-processor/main.go	Adds matchBypassPath function, default bypass patterns, env var parsing, and bypass check in handleInbound before JWT validation
AuthBridge/AuthProxy/go-processor/main_test.go	Adds comprehensive unit tests for pattern matching including exact matches, globs, query strings, empty lists, and default behaviors

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[mrsabath]

LGTM