feat(cli): auto-detect OIDC configuration during gateway add

[akram]

Problem Statement

When registering a gateway with openshell gateway add https://<endpoint>, the CLI defaults to the Cloudflare Access edge-auth flow. On non-Cloudflare deployments, this hangs for 120 seconds and times out. Users must know about --oidc-issuer to use the OIDC flow.

While #2103 proposes making OIDC the default (simpler, more immediate), auto-detection would provide a seamless experience where gateway add works without any auth flags by querying the gateway for its configuration.

Proposed Design

During gateway add, the CLI queries the gateway's Health or a new metadata endpoint to detect the auth configuration:

1. gateway add https://<endpoint> (no auth flags)
2. CLI calls the Health gRPC endpoint (already works without auth)
3. If the gateway reports OIDC is configured, the CLI extracts the issuer URL and client ID, then starts the OIDC browser flow automatically
4. If no OIDC is configured and no Cloudflare is detected, display a clear message listing the available options

Server-side change

Extend the HealthResponse (or add a new GatewayInfo RPC) to include the auth mode:

message HealthResponse {
  // existing fields...
  AuthInfo auth_info = N;
}

message AuthInfo {
  string auth_mode = 1;         // "oidc", "edge", "unauthenticated"
  string oidc_issuer = 2;       // populated when auth_mode is "oidc"
  string oidc_client_id = 3;
}

CLI-side change

In gateway_add(), before starting any auth flow:

if oidc_issuer.is_none() && !local && !edge_auth {
    if let Some(info) = query_gateway_auth_info(&endpoint).await {
        match info.auth_mode.as_str() {
            "oidc" => { /* use info.oidc_issuer and info.oidc_client_id */ }
            "unauthenticated" => { /* register as local */ }
            _ => { /* prompt user */ }
        }
    }
}

Alternatives Considered

1. Make OIDC the default, require --edge-auth for CF (feat(cli): make OIDC the default auth for HTTPS endpoints, add --edge-auth for Cloudflare #2103): Simpler and more immediate. Doesn't require server-side changes. Recommended as the first step — auto-detection can come later as a refinement.

2. Try OIDC discovery on the gateway endpoint: Fetch <endpoint>/.well-known/openid-configuration. Won't work — the gateway doesn't serve OIDC metadata, the IdP does.

3. Client-side heuristic: Try edge-auth for 5 seconds, fall back to prompting. Fragile and still wastes time.

Agent Investigation

• Explored crates/openshell-cli/src/run.rs:940-960 — confirmed gateway_add() has no detection logic, it defaults to edge-auth for any HTTPS endpoint.
• Explored crates/openshell-server/src/grpc/health.rs — the Health RPC returns basic status. Adding auth info would be a small extension.
• Explored crates/openshell-server/src/cli.rs — the gateway's OIDC config (issuer, audience) is available at startup in the server state.

Related

• feat(cli): make OIDC the default auth for HTTPS endpoints, add --edge-auth for Cloudflare #2103 — simpler alternative: make OIDC the default (recommended first step)
• bug: gateway add defaults to Cloudflare edge-auth for HTTPS endpoints — no fallback or guidance for non-CF deployments #2057 — original issue documenting the CF edge-auth problem
• fix(cli): improve error message when edge-auth flow times out on non-Cloudflare deployments #2099 — improve the timeout error message

---

• I've reviewed existing issues and the architecture docs
• This is a design proposal, not a "please build this" request

[TaylorMutch]

📋 triage-agent

Classification: Duplicate of #2057

This is a strong and more concrete implementation proposal, but it addresses the same confirmed product defect tracked by #2057: gateway add selects Cloudflare authentication for an unqualified HTTPS gateway instead of discovering the gateway's configured authentication mode.

Current main already exposes unauthenticated GET /auth/oidc-config, returning the issuer and audience specifically needed for CLI OIDC discovery. That means the proposed HealthResponse/GatewayInfo server API extension is no longer necessary. The remaining implementation should teach gateway add to query /auth/oidc-config before falling back to Cloudflare, and to fail or prompt clearly when discovery is unavailable.

We will keep #2057 as the canonical bug because it captures the original user-facing failure and fallback requirements. The auto-detection design here is useful implementation guidance for that issue. #2099 remains separate because it covers bounded timeout and error behavior rather than auth-mode selection itself.

Closing this issue through GitHub's native duplicate relationship to #2057.