chore: pyt contract tests for transformations auth

[fracasula]

Description

See this PR.

Contract tests for how rudder-pytransformer talks to the config backend: hosted-secret
authentication and redirect responses. Tests only — no production code changes in this repo.

Both behaviours matter to rudder-server specifically because they decide whether a config backend misconfiguration is retryable or terminal. rudder-server aborts any per-event status that is not 200/298, so a terminal answer here means every event for every Python transformation is destroyed with nothing to replay from.

Config backend authentication — config_backend_auth_test.go

Pins both variants of pytransformer's CONFIG_BACKEND_HOSTED_SECRET:

• Unset (today's deployments, and every self-hosted one) — the request must be unchanged from the build that didn't know about the variable. Asserted by inspecting what the config backend received: no Authorization header at all. A build sending Basic Og== (base64 of ":") would pass a "does it still work" check against a permissive backend and 401 against a strict one; only looking at the received header separates the two.
• Set — the header is exactly Basic base64("<secret>:"), on the transformation fetch and the library fetch, and it authenticates against a backend enforcing the real check. The empty password is load-bearing: the config backend rejects any decoded token that doesn't hold
  exactly one colon.
• • Wrong secret (stale after a rotation) → 503 + X-Rudder-Should-Retry + X-Rudder-Error-Reason: config_backend_auth_failed, so events are held rather than aborted. Same for an anonymous fetch against an authenticated backend; a blocked public route (403) reports config_backend_forbidden so a bad secret and a missed repoint page differently.
• Trailing newline in the secret is trimmed — the shape it actually arrives in when mounted from a k8s secret file.

The mock config backend is a port of rudder-config-backend, not an invention: RudderKoaBasicAuth (including the exactly-one-colon rule and the non-short-circuiting constant-time comparison), hostedSecretConfig's comma-split/trim/drop-blanks parsing with empty passwords, verifyHostedDataPlaneSecret collapsing every rejection into one 401, and blockHostedPublicAccess's 403. Provenance is listed file-by-file in the mock's doc comment.

TestConfigBackendAuthMockMatchesConfigBackend pins the port itself against cases taken from rudder-config-backend's own suites, and runs without containers — the container tests are only worth their runtime if the thing they authenticate against enforces the real rules.

Config backend redirects — redirects_test.go

pytransformer does not follow redirects, so a 3xx from a misconfigured proxy raises ConfigBackendRedirectError → 503 + retry headers.

TestConfigBackendRedirectIsRetriedNotDropped is the regression test for the data loss: it holds the config backend broken through a full rudder-server pipeline, asserts nothing is aborted, then repairs it and shows the original events come out the far end transformed. Under the previous terminal behaviour those events were gone. It also asserts the redirect target is never contacted.

Running

These need a rudder-pytransformer image; build it from that repo with make build-ecr-latest,
then:

go test -v -count 1 -race ./integration_test/pytransformer_contract -timeout=10m

Linear Ticket

< Fixes PIPE-3229 >

Security

• The code changed/added as part of this pull request won't create any security issues with how the software is being used.

[ktgowtham]

test are failing. pl check

[fracasula]

test are failing. pl check

@ktgowtham As usual they should pass once we merge the pyt PR (the one with the secret support) and then create a release. Then these tests will pull main and should pass 🤞 (they do pass locally in fact).