egress policy: add an actor JWT value source to CredentialHeader

Add ActorJWTSource as a second value source for a replace_headers entry,
next to credential_uri, so an EgressPolicy can have the egress gateway
replace a header with a Substrate-issued JWT for the actor that sent the
request. The two fields form a union and exactly one must be set.
credential_uri becomes optional with explicit presence, as the API style
guide requires of a primitive union member. Every stored policy already
sets it, so existing policies stay valid and the wire format is unchanged.

ActorJWTSource names the audiences the JWT is bound to and its lifetime
in seconds. The lifetime has the same 300 to 3600 bounds as
MintActorJWTRequest, and the server fills in 900 when it is unset.

The gateway cannot mint actor JWTs yet. Until it can, an https rule that
asks for one denies the request with 501 instead of failing on the empty
credential URI. Like a credential_uri entry, an actor JWT entry is
skipped on http rules.

Author: thompsonmax

cmd/ateapi/internal/controlapi/egress_policy_test.go

@@ -17,6 +17,7 @@ package controlapi
 import (
 	"context"
 	"fmt"
+	"strings"
 	"testing"
 
 	"github.com/agent-substrate/substrate/cmd/ateapi/internal/defaults"
@@ -40,14 +41,24 @@ func validEgressPolicy() *ateapipb.EgressPolicy {
 					ReplaceHeaders: []*ateapipb.CredentialHeader{{
 						Header:        "Authorization",
 						Prefix:        "Bearer ",
-						CredentialUri: "ate-secret://kubernetes.io/provider/ns/name",
+						CredentialUri: proto.String("ate-secret://kubernetes.io/provider/ns/name"),
 					}},
 				},
 			},
 		}},
 	}
 }
 
+// actorJWTHeader is an Authorization header replaced with an actor JWT for
+// audiences.
+func actorJWTHeader(audiences ...string) *ateapipb.CredentialHeader {
+	return &ateapipb.CredentialHeader{
+		Header:   "Authorization",
+		Prefix:   "Bearer ",
+		ActorJwt: &ateapipb.ActorJWTSource{Audiences: audiences},
+	}
+}
+
 func TestValidateCreateActorEgressPolicyRequest(t *testing.T) {
 	validReq := func() *ateapipb.CreateActorEgressPolicyRequest {
 		return &ateapipb.CreateActorEgressPolicyRequest{
@@ -757,7 +768,7 @@ func TestValidateEgressPolicyRules(t *testing.T) {
 		mutate: func(p *ateapipb.EgressPolicy) {
 			p.Rules[0].Http.Effects.ReplaceHeaders = append(
 				p.Rules[0].Http.Effects.ReplaceHeaders,
-				&ateapipb.CredentialHeader{Header: "authorization", CredentialUri: "ate-secret://example.com/provider/secret"},
+				&ateapipb.CredentialHeader{Header: "authorization", CredentialUri: proto.String("ate-secret://example.com/provider/secret")},
 			)
 		},
 		want: field.ErrorList{
@@ -777,7 +788,7 @@ func TestValidateEgressPolicyRules(t *testing.T) {
 			for i := range 16 {
 				injections = append(injections, &ateapipb.CredentialHeader{
 					Header:        fmt.Sprintf("X-Header-%d", i),
-					CredentialUri: "ate-secret://example.com/provider/secret",
+					CredentialUri: proto.String("ate-secret://example.com/provider/secret"),
 				})
 			}
 			p.Rules[0].Http.Effects.ReplaceHeaders = injections
@@ -789,7 +800,7 @@ func TestValidateEgressPolicyRules(t *testing.T) {
 			for i := range 17 {
 				injections = append(injections, &ateapipb.CredentialHeader{
 					Header:        fmt.Sprintf("X-Header-%d", i),
-					CredentialUri: "ate-secret://example.com/provider/secret",
+					CredentialUri: proto.String("ate-secret://example.com/provider/secret"),
 				})
 			}
 			p.Rules[0].Http.Effects.ReplaceHeaders = injections
@@ -806,21 +817,127 @@ func TestValidateEgressPolicyRules(t *testing.T) {
 			field.Invalid(staticHeader.Child("prefix"), "Bearer\r", "must be a valid HTTP field value prefix"),
 		},
 	}, {
-		name: "missing credential URI",
+		name: "no credential source",
+		mutate: func(p *ateapipb.EgressPolicy) {
+			p.Rules[0].Http.Effects.ReplaceHeaders[0].CredentialUri = nil
+		},
+		want: field.ErrorList{
+			field.Invalid(staticHeader, nil, "one of").WithOrigin("union"),
+		},
+	}, {
+		name: "empty credential URI",
 		mutate: func(p *ateapipb.EgressPolicy) {
-			p.Rules[0].Http.Effects.ReplaceHeaders[0].CredentialUri = ""
+			p.Rules[0].Http.Effects.ReplaceHeaders[0].CredentialUri = proto.String("")
 		},
 		want: field.ErrorList{
-			field.Required(staticHeader.Child("credential_uri"), ""),
+			field.Invalid(staticHeader.Child("credential_uri"), "", "must be ate-secret://<provider-class>/<provider-name>/<provider-specific-tail>"),
 		},
 	}, {
 		name: "invalid credential URI",
 		mutate: func(p *ateapipb.EgressPolicy) {
-			p.Rules[0].Http.Effects.ReplaceHeaders[0].CredentialUri = "https://example.com/secret"
+			p.Rules[0].Http.Effects.ReplaceHeaders[0].CredentialUri = proto.String("https://example.com/secret")
 		},
 		want: field.ErrorList{
 			field.Invalid(staticHeader.Child("credential_uri"), "https://example.com/secret", "must be ate-secret://<provider-class>/<provider-name>/<provider-specific-tail>"),
 		},
+	}, {
+		name: "actor JWT on an http rule",
+		mutate: func(p *ateapipb.EgressPolicy) {
+			p.Rules[0].Http.Effects.ReplaceHeaders[0] = actorJWTHeader("https://api.example.com")
+		},
+	}, {
+		name: "actor JWT on an https rule",
+		mutate: func(p *ateapipb.EgressPolicy) {
+			p.Rules[0] = &ateapipb.EgressRule{Https: &ateapipb.HTTPSRule{
+				Hostnames: []string{"api.example.com"},
+				Effects:   &ateapipb.HttpRuleEffects{ReplaceHeaders: []*ateapipb.CredentialHeader{actorJWTHeader("https://api.example.com")}},
+			}}
+		},
+	}, {
+		name: "actor JWT next to a credential URI",
+		mutate: func(p *ateapipb.EgressPolicy) {
+			jwt := actorJWTHeader("https://api.example.com")
+			jwt.Header = "X-Actor-Token"
+			p.Rules[0].Http.Effects.ReplaceHeaders = append(p.Rules[0].Http.Effects.ReplaceHeaders, jwt)
+		},
+	}, {
+		name: "credential URI and actor JWT in one header",
+		mutate: func(p *ateapipb.EgressPolicy) {
+			p.Rules[0].Http.Effects.ReplaceHeaders[0].ActorJwt = &ateapipb.ActorJWTSource{Audiences: []string{"https://api.example.com"}}
+		},
+		want: field.ErrorList{
+			field.Invalid(staticHeader, nil, "one of").WithOrigin("union"),
+		},
+	}, {
+		name: "actor JWT without audiences",
+		mutate: func(p *ateapipb.EgressPolicy) {
+			p.Rules[0].Http.Effects.ReplaceHeaders[0] = actorJWTHeader()
+		},
+		want: field.ErrorList{
+			field.Required(staticHeader.Child("actor_jwt", "audiences"), ""),
+		},
+	}, {
+		name: "actor JWT with an empty audience",
+		mutate: func(p *ateapipb.EgressPolicy) {
+			p.Rules[0].Http.Effects.ReplaceHeaders[0] = actorJWTHeader("")
+		},
+		want: field.ErrorList{
+			field.TooShort(staticHeader.Child("actor_jwt", "audiences").Index(0), "", 1).WithOrigin("minLength"),
+		},
+	}, {
+		name: "actor JWT with a long audience",
+		mutate: func(p *ateapipb.EgressPolicy) {
+			p.Rules[0].Http.Effects.ReplaceHeaders[0] = actorJWTHeader(strings.Repeat("a", 513))
+		},
+		want: field.ErrorList{
+			field.TooLong(staticHeader.Child("actor_jwt", "audiences").Index(0), "", 512).WithOrigin("maxLength"),
+		},
+	}, {
+		name: "actor JWT with a repeated audience",
+		mutate: func(p *ateapipb.EgressPolicy) {
+			p.Rules[0].Http.Effects.ReplaceHeaders[0] = actorJWTHeader("a", "a")
+		},
+		want: field.ErrorList{
+			field.Duplicate(staticHeader.Child("actor_jwt", "audiences").Index(1), "a"),
+		},
+	}, {
+		name: "actor JWT with too many audiences",
+		mutate: func(p *ateapipb.EgressPolicy) {
+			var audiences []string
+			for i := range 17 {
+				audiences = append(audiences, fmt.Sprintf("aud-%d", i))
+			}
+			p.Rules[0].Http.Effects.ReplaceHeaders[0] = actorJWTHeader(audiences...)
+		},
+		want: field.ErrorList{
+			field.TooMany(staticHeader.Child("actor_jwt", "audiences"), 17, 16).WithOrigin("maxItems"),
+		},
+	}, {
+		name: "actor JWT lifetime at its bounds",
+		mutate: func(p *ateapipb.EgressPolicy) {
+			short, long := actorJWTHeader("a"), actorJWTHeader("a")
+			short.ActorJwt.ExpirationSeconds = 300
+			long.Header, long.ActorJwt.ExpirationSeconds = "X-Actor-Token", 3600
+			p.Rules[0].Http.Effects.ReplaceHeaders = []*ateapipb.CredentialHeader{short, long}
+		},
+	}, {
+		name: "actor JWT lifetime too short",
+		mutate: func(p *ateapipb.EgressPolicy) {
+			p.Rules[0].Http.Effects.ReplaceHeaders[0] = actorJWTHeader("a")
+			p.Rules[0].Http.Effects.ReplaceHeaders[0].ActorJwt.ExpirationSeconds = 299
+		},
+		want: field.ErrorList{
+			field.Invalid(staticHeader.Child("actor_jwt", "expiration_seconds"), 299, "").WithOrigin("minimum"),
+		},
+	}, {
+		name: "actor JWT lifetime too long",
+		mutate: func(p *ateapipb.EgressPolicy) {
+			p.Rules[0].Http.Effects.ReplaceHeaders[0] = actorJWTHeader("a")
+			p.Rules[0].Http.Effects.ReplaceHeaders[0].ActorJwt.ExpirationSeconds = 3601
+		},
+		want: field.ErrorList{
+			field.Invalid(staticHeader.Child("actor_jwt", "expiration_seconds"), 3601, "").WithOrigin("maximum"),
+		},
 	}, {
 		name: "empty effects",
 		mutate: func(p *ateapipb.EgressPolicy) {
@@ -893,7 +1010,7 @@ func TestActorEgressPolicy(t *testing.T) {
 						ReplaceHeaders: []*ateapipb.CredentialHeader{{
 							Header:        "Authorization",
 							Prefix:        "Bearer ",
-							CredentialUri: "ate-secret://kubernetes.io/provider/ns/name",
+							CredentialUri: proto.String("ate-secret://kubernetes.io/provider/ns/name"),
 						}},
 					},
 				},