jwe-decrypt: default metadata namespace aligned with other boe extensions (#308)

Author: nacx

extensions/composer/jwe-decrypt/manifest.yaml

@@ -121,10 +121,10 @@ examples:
   - title: Add decrypted payload to metadata
     description: |
       Set `output_metadata` in the config to store the decrypted payload in Envoy's dynamic metadata instead of a
-      header. Specify the `key` to store the value under. The `namespace` defaults to `jwe-decrypt` if omitted.
+      header. Specify the `key` to store the value under. The `namespace` defaults to `io.builtonenvoy.jwe-decrypt` if omitted.
       Downstream filters such as JWT authn, OPA, or ext_authz can then read the value from this metadata.
     code: |
-      # Store the decrypted payload in the default "jwe-decrypt" namespace
+      # Store the decrypted payload in the default "io.builtonenvoy.jwe-decrypt" namespace
       boe run --extension jwe-decrypt --config '{
         "private_key": { "file": "/path/to/private-key.pem" },
         "algorithm": "RSA-OAEP",

extensions/composer/jwe-decrypt/plugin.go

@@ -17,6 +17,8 @@ import (
 	"github.com/tetratelabs/built-on-envoy/extensions/composer/pkg"
 )
 
+const defaultMetadataNamespace = "io.builtonenvoy.jwe-decrypt"
+
 // Config represents the JSON configuration for this filter.
 type jweDecryptConfig struct {
 	// PrivateKey is the PKCS8 private key used for decryption, provided either via a file path or inline.
@@ -31,7 +33,7 @@ type jweDecryptConfig struct {
 	// OutputHeader is the name of the header where the decrypted payload will be stored.
 	OutputHeader string `json:"output_header"`
 	// OutputMetadata specifies the metadata namespace and key under which the decrypted payload will be stored.
-	// The namespace defaults to "jwe-decrypt" if not specified.
+	// The namespace defaults to "io.builtonenvoy.jwe-decrypt" if not specified.
 	OutputMetadata *pkg.MetadataKey `json:"output_metadata"`
 
 	privateKey *boeJwe.Keys
@@ -148,10 +150,10 @@ func (f *JWEDecryptHttpFilterConfigFactory) Create(handle shared.HttpFilterConfi
 	if cfg.InputHeader == "" {
 		cfg.InputHeader = "Authorization"
 	}
-	// Default metadata namespace to "jwe-decrypt" if not specified
+	// Default metadata namespace if not specified
 	if cfg.OutputMetadata != nil {
 		if cfg.OutputMetadata.Namespace == "" {
-			cfg.OutputMetadata.Namespace = "jwe-decrypt"
+			cfg.OutputMetadata.Namespace = defaultMetadataNamespace
 		}
 		if err := cfg.OutputMetadata.Validate(); err != nil {
 			handle.Log(shared.LogLevelError, "jwe-decrypt: invalid output metadata config: "+err.Error())

extensions/composer/jwe-decrypt/plugin_test.go

@@ -738,7 +738,7 @@ func TestJWEDecryptHttpFilterConfigFactory_Create_DefaultMetadataNamespace(t *te
 	require.NoError(t, err)
 	jweFilterFactory, ok := filterFactory.(*jweDecryptHttpFilterFactory)
 	require.True(t, ok)
-	require.Equal(t, "jwe-decrypt", jweFilterFactory.config.OutputMetadata.Namespace)
+	require.Equal(t, "io.builtonenvoy.jwe-decrypt", jweFilterFactory.config.OutputMetadata.Namespace)
 }
 
 func TestJWEDecryptHttpFilterConfigFactory_Create_CustomMetadataNamespace(t *testing.T) {

website/public/extensions.json

@@ -511,8 +511,8 @@
       },
       {
         "title": "Add decrypted payload to metadata",
-        "description": "Set `output_metadata` in the config to store the decrypted payload in Envoy's dynamic metadata instead of a\nheader. Specify the `key` to store the value under. The `namespace` defaults to `jwe-decrypt` if omitted.\nDownstream filters such as JWT authn, OPA, or ext_authz can then read the value from this metadata.\n",
-        "code": "# Store the decrypted payload in the default \"jwe-decrypt\" namespace\nboe run --extension jwe-decrypt --config '{\n  \"private_key\": { \"file\": \"/path/to/private-key.pem\" },\n  \"algorithm\": \"RSA-OAEP\",\n  \"input_header\": \"X-JWE-Token\",\n  \"output_metadata\": { \"key\": \"jwe_decrypted_payload\" }\n}'\n\n# Store the decrypted payload in a custom namespace\nboe run --extension jwe-decrypt --config '{\n  \"private_key\": { \"file\": \"/path/to/private-key.pem\" },\n  \"input_header\": \"X-JWE-Token\",\n  \"output_metadata\": { \"namespace\": \"my-namespace\", \"key\": \"jwe_decrypted_payload\" }\n}'\n"
+        "description": "Set `output_metadata` in the config to store the decrypted payload in Envoy's dynamic metadata instead of a\nheader. Specify the `key` to store the value under. The `namespace` defaults to `io.builtonenvoy.jwe-decrypt` if omitted.\nDownstream filters such as JWT authn, OPA, or ext_authz can then read the value from this metadata.\n",
+        "code": "# Store the decrypted payload in the default \"io.builtonenvoy.jwe-decrypt\" namespace\nboe run --extension jwe-decrypt --config '{\n  \"private_key\": { \"file\": \"/path/to/private-key.pem\" },\n  \"algorithm\": \"RSA-OAEP\",\n  \"input_header\": \"X-JWE-Token\",\n  \"output_metadata\": { \"key\": \"jwe_decrypted_payload\" }\n}'\n\n# Store the decrypted payload in a custom namespace\nboe run --extension jwe-decrypt --config '{\n  \"private_key\": { \"file\": \"/path/to/private-key.pem\" },\n  \"input_header\": \"X-JWE-Token\",\n  \"output_metadata\": { \"namespace\": \"my-namespace\", \"key\": \"jwe_decrypted_payload\" }\n}'\n"
       }
     ],
     "minEnvoyVersion": "1.37.1",