egress policy: add an actor JWT value source to CredentialHeader

Add ActorJWTSource as a second value source for a replace_headers entry,
next to credential_uri, so an EgressPolicy can have the egress gateway
replace a header with a Substrate-issued JWT for the actor that sent the
request. The two fields form a union and exactly one must be set.
credential_uri stays a plain string: an empty credential URI is never
valid, so the union treats the empty string as unset, and every stored
policy stays valid.

ActorJWTSource names the audiences the JWT is bound to and its lifetime,
which is required and bounded to 300 to 3600 seconds, so the policy
author always chooses how long the gateway's JWTs live.

The gateway cannot mint actor JWTs yet. Until it can, an https rule that
asks for one denies the request with 501 instead of failing on the empty
credential URI. Actor JWTs do not come from the credential provider, so
the denial applies even when no provider is configured. Like a
credential_uri entry, an actor JWT entry is skipped on http rules.

Author: thompsonmax

cmd/ateapi/internal/apivalidation/egress_policy_test.go

@@ -17,6 +17,7 @@ package apivalidation
 import (
 	"context"
 	"fmt"
+	"strings"
 	"testing"
 
 	"github.com/agent-substrate/substrate/cmd/ateapi/internal/defaults"
@@ -43,6 +44,16 @@ func validEgressPolicy() *ateapipb.EgressPolicy {
 	}
 }
 
+// actorJWTHeader is an Authorization header replaced with a 900-second actor
+// JWT for audiences.
+func actorJWTHeader(audiences ...string) *ateapipb.CredentialHeader {
+	return &ateapipb.CredentialHeader{
+		Header:   "Authorization",
+		Prefix:   "Bearer ",
+		ActorJwt: &ateapipb.ActorJWTSource{Audiences: audiences, ExpirationSeconds: 900},
+	}
+}
+
 func TestValidateCreateActorEgressPolicyRequest(t *testing.T) {
 	validReq := func() *ateapipb.CreateActorEgressPolicyRequest {
 		return &ateapipb.CreateActorEgressPolicyRequest{
@@ -801,12 +812,12 @@ func TestValidateEgressPolicyRules(t *testing.T) {
 			field.Invalid(staticHeader.Child("prefix"), "Bearer\r", "must be a valid HTTP field value prefix"),
 		},
 	}, {
-		name: "missing credential URI",
+		name: "no credential source",
 		mutate: func(p *ateapipb.EgressPolicy) {
 			p.Rules[0].Http.Effects.ReplaceHeaders[0].CredentialUri = ""
 		},
 		want: field.ErrorList{
-			field.Required(staticHeader.Child("credential_uri"), ""),
+			field.Invalid(staticHeader, nil, "one of").WithOrigin("union"),
 		},
 	}, {
 		name: "invalid credential URI",
@@ -816,6 +827,113 @@ func TestValidateEgressPolicyRules(t *testing.T) {
 		want: field.ErrorList{
 			field.Invalid(staticHeader.Child("credential_uri"), "https://example.com/secret", "must be ate-secret://<provider-class>/<provider-name>/<provider-specific-tail>"),
 		},
+	}, {
+		name: "actor JWT on an http rule",
+		mutate: func(p *ateapipb.EgressPolicy) {
+			p.Rules[0].Http.Effects.ReplaceHeaders[0] = actorJWTHeader("https://api.example.com")
+		},
+	}, {
+		name: "actor JWT on an https rule",
+		mutate: func(p *ateapipb.EgressPolicy) {
+			p.Rules[0] = &ateapipb.EgressRule{Https: &ateapipb.HTTPSRule{
+				Hostnames: []string{"api.example.com"},
+				Effects:   &ateapipb.HttpRuleEffects{ReplaceHeaders: []*ateapipb.CredentialHeader{actorJWTHeader("https://api.example.com")}},
+			}}
+		},
+	}, {
+		name: "actor JWT next to a credential URI",
+		mutate: func(p *ateapipb.EgressPolicy) {
+			jwt := actorJWTHeader("https://api.example.com")
+			jwt.Header = "X-Actor-Token"
+			p.Rules[0].Http.Effects.ReplaceHeaders = append(p.Rules[0].Http.Effects.ReplaceHeaders, jwt)
+		},
+	}, {
+		name: "credential URI and actor JWT in one header",
+		mutate: func(p *ateapipb.EgressPolicy) {
+			p.Rules[0].Http.Effects.ReplaceHeaders[0].ActorJwt = &ateapipb.ActorJWTSource{Audiences: []string{"https://api.example.com"}, ExpirationSeconds: 900}
+		},
+		want: field.ErrorList{
+			field.Invalid(staticHeader, nil, "one of").WithOrigin("union"),
+		},
+	}, {
+		name: "actor JWT without audiences",
+		mutate: func(p *ateapipb.EgressPolicy) {
+			p.Rules[0].Http.Effects.ReplaceHeaders[0] = actorJWTHeader()
+		},
+		want: field.ErrorList{
+			field.Required(staticHeader.Child("actor_jwt", "audiences"), ""),
+		},
+	}, {
+		name: "actor JWT with an empty audience",
+		mutate: func(p *ateapipb.EgressPolicy) {
+			p.Rules[0].Http.Effects.ReplaceHeaders[0] = actorJWTHeader("")
+		},
+		want: field.ErrorList{
+			field.TooShort(staticHeader.Child("actor_jwt", "audiences").Index(0), "", 1).WithOrigin("minLength"),
+		},
+	}, {
+		name: "actor JWT with a long audience",
+		mutate: func(p *ateapipb.EgressPolicy) {
+			p.Rules[0].Http.Effects.ReplaceHeaders[0] = actorJWTHeader(strings.Repeat("a", 513))
+		},
+		want: field.ErrorList{
+			field.TooLong(staticHeader.Child("actor_jwt", "audiences").Index(0), "", 512).WithOrigin("maxLength"),
+		},
+	}, {
+		name: "actor JWT with a repeated audience",
+		mutate: func(p *ateapipb.EgressPolicy) {
+			p.Rules[0].Http.Effects.ReplaceHeaders[0] = actorJWTHeader("a", "a")
+		},
+		want: field.ErrorList{
+			field.Duplicate(staticHeader.Child("actor_jwt", "audiences").Index(1), "a"),
+		},
+	}, {
+		name: "actor JWT with too many audiences",
+		mutate: func(p *ateapipb.EgressPolicy) {
+			var audiences []string
+			for i := range 17 {
+				audiences = append(audiences, fmt.Sprintf("aud-%d", i))
+			}
+			p.Rules[0].Http.Effects.ReplaceHeaders[0] = actorJWTHeader(audiences...)
+		},
+		want: field.ErrorList{
+			field.TooMany(staticHeader.Child("actor_jwt", "audiences"), 17, 16).WithOrigin("maxItems"),
+		},
+	}, {
+		name: "actor JWT without a lifetime",
+		mutate: func(p *ateapipb.EgressPolicy) {
+			p.Rules[0].Http.Effects.ReplaceHeaders[0] = actorJWTHeader("a")
+			p.Rules[0].Http.Effects.ReplaceHeaders[0].ActorJwt.ExpirationSeconds = 0
+		},
+		want: field.ErrorList{
+			field.Required(staticHeader.Child("actor_jwt", "expiration_seconds"), ""),
+		},
+	}, {
+		name: "actor JWT lifetime at its bounds",
+		mutate: func(p *ateapipb.EgressPolicy) {
+			short, long := actorJWTHeader("a"), actorJWTHeader("a")
+			short.ActorJwt.ExpirationSeconds = 300
+			long.Header, long.ActorJwt.ExpirationSeconds = "X-Actor-Token", 3600
+			p.Rules[0].Http.Effects.ReplaceHeaders = []*ateapipb.CredentialHeader{short, long}
+		},
+	}, {
+		name: "actor JWT lifetime too short",
+		mutate: func(p *ateapipb.EgressPolicy) {
+			p.Rules[0].Http.Effects.ReplaceHeaders[0] = actorJWTHeader("a")
+			p.Rules[0].Http.Effects.ReplaceHeaders[0].ActorJwt.ExpirationSeconds = 299
+		},
+		want: field.ErrorList{
+			field.Invalid(staticHeader.Child("actor_jwt", "expiration_seconds"), 299, "").WithOrigin("minimum"),
+		},
+	}, {
+		name: "actor JWT lifetime too long",
+		mutate: func(p *ateapipb.EgressPolicy) {
+			p.Rules[0].Http.Effects.ReplaceHeaders[0] = actorJWTHeader("a")
+			p.Rules[0].Http.Effects.ReplaceHeaders[0].ActorJwt.ExpirationSeconds = 3601
+		},
+		want: field.ErrorList{
+			field.Invalid(staticHeader.Child("actor_jwt", "expiration_seconds"), 3601, "").WithOrigin("maximum"),
+		},
 	}, {
 		name: "empty effects",
 		mutate: func(p *ateapipb.EgressPolicy) {

cmd/ateapi/internal/apivalidation/zz_generated.validation.go

@@ -59,6 +59,10 @@ func mapCredentialProviderError(err error) error {
 //
 // Once injection is actually attempted (TLS leg, provider present), any failure
 // to produce the credential the policy required fails closed.
+//
+// This gateway cannot mint actor JWTs yet, so on the MITM leg a rule that asks
+// for one is denied. Actor JWTs don't come from the credential provider, so
+// that holds with no provider configured.
 func (h *Handler) applyEffects(ctx context.Context, ref resources.ActorRef, dest egresspolicy.Destination, leg string, effects *ateapipb.HttpRuleEffects) ([]*corev3.HeaderValueOption, error) {
 	injections := effects.GetReplaceHeaders()
 	if len(injections) == 0 {
@@ -70,6 +74,14 @@ func (h *Handler) applyEffects(ctx context.Context, ref resources.ActorRef, dest
 			slog.Any("actor", ref), slog.String("host", dest.Hostname), slog.String("leg", leg))
 		return nil, nil
 	}
+	// TODO(identity): mint actor JWTs through Control.MintActorJWT.
+	for _, inj := range injections {
+		if inj.GetActorJwt() != nil {
+			slog.ErrorContext(ctx, "egress denied: this gateway cannot inject actor JWTs yet",
+				slog.Any("actor", ref), slog.String("host", dest.Hostname), slog.String("header", inj.GetHeader()))
+			return nil, extproc.NewReqError(envoy_type.StatusCode_NotImplemented, deniedBody)
+		}
+	}
 	if h.provider == nil {
 		slog.WarnContext(ctx, "egress: skipping credential injection because no credential provider is configured; the request proceeds without the credential",
 			slog.Any("actor", ref), slog.String("host", dest.Hostname))