extensions: add metadata support for the cedar-auth extension (#306)

Same change as #289

Signed-off-by: Ignasi Barrera <ignasi@tetrate.io>

Author: nacx

extensions/composer/cedar/manifest.yaml

@@ -78,6 +78,12 @@ longDescription: |
       "mtls": true,
       "tls_version": "TLSv1.3"
     },
+    "dynamic_metadata": {
+      "envoy.filters.http.jwt_authn": {
+        "sub": "user-123",
+        "iss": "https://issuer.example.com"
+      }
+    },
     "parsed_path": ["api", "v1", "resource"],
     "parsed_query": {"key": ["value"]}
   }
@@ -294,3 +300,15 @@ examples:
         "principal_id_header": "x-user-id",
         "fail_open": true
       }'
+  - title: Include Envoy dynamic metadata in Cedar context
+    description: |
+      Include Envoy dynamic metadata in the Cedar context record under `context.dynamic_metadata`.
+      This allows writing policies that make decisions based on dynamic metadata from other Envoy
+      filters, such as JWT authentication claims.
+    code: |
+      boe run --extension cedar-auth --config '{
+        "policy": {"file": "/tmp/policy.cedar"},
+        "principal_type": "User",
+        "principal_id_header": "x-user-id",
+        "metadata_namespaces": ["envoy.filters.http.jwt_authn"]
+      }'

extensions/composer/cedar/plugin.go

@@ -46,6 +46,9 @@ type cedarConfig struct {
 	FailOpen bool `json:"fail_open"`
 	// DryRun when true logs the decision but always allows the request.
 	DryRun bool `json:"dry_run"`
+	// MetadataNamespaces is an optional list of dynamic metadata namespaces to include in the Cedar
+	// context record under the "dynamic_metadata" key.
+	MetadataNamespaces []string `json:"metadata_namespaces"`
 }
 
 // Metric tag values for authorization decisions.
@@ -274,11 +277,34 @@ func (c *cedarHttpFilter) buildContext(headers shared.HeaderMap) cedarlib.Record
 			"mtls":        cedarlib.Boolean(mtls),
 			"tls_version": cedarlib.String(tlsVersion.ToUnsafeString()),
 		}),
-		"parsed_path":  cedarlib.NewSet(pathValues...),
-		"parsed_query": cedarlib.NewRecord(queryRecord),
+		"dynamic_metadata": c.dynamicMetadataMap(),
+		"parsed_path":      cedarlib.NewSet(pathValues...),
+		"parsed_query":     cedarlib.NewRecord(queryRecord),
 	})
 }
 
+// dynamicMetadataMap extracts dynamic metadata from the filter handle and returns it as a
+// Cedar Record keyed by namespace, where each namespace value is a Record of key-value pairs.
+func (c *cedarHttpFilter) dynamicMetadataMap() cedarlib.Value {
+	dm := cedarlib.RecordMap{}
+	for _, ns := range c.config.MetadataNamespaces {
+		nsMap := cedarlib.RecordMap{}
+		keys := c.handle.GetMetadataKeys(shared.MetadataSourceTypeDynamic, ns)
+		for _, key := range keys {
+			keyStr := key.ToUnsafeString()
+			if value, ok := c.handle.GetMetadataString(shared.MetadataSourceTypeDynamic, ns, keyStr); ok {
+				nsMap[cedarlib.String(keyStr)] = cedarlib.String(value.ToUnsafeString())
+			} else if numValue, ok := c.handle.GetMetadataNumber(shared.MetadataSourceTypeDynamic, ns, keyStr); ok {
+				nsMap[cedarlib.String(keyStr)] = cedarlib.Long(int64(numValue))
+			}
+		}
+		if len(nsMap) > 0 {
+			dm[cedarlib.String(ns)] = cedarlib.NewRecord(nsMap)
+		}
+	}
+	return cedarlib.NewRecord(dm)
+}
+
 // parsePath splits the path into segments and parses query parameters into a map.
 func parsePath(fullPath string) ([]string, map[string][]string) {
 	pathPart := fullPath

extensions/composer/cedar/plugin_test.go

@@ -11,6 +11,7 @@ import (
 	"path/filepath"
 	"testing"
 
+	cedarlib "github.com/cedar-policy/cedar-go"
 	"github.com/envoyproxy/envoy/source/extensions/dynamic_modules/sdk/go/shared"
 	"github.com/envoyproxy/envoy/source/extensions/dynamic_modules/sdk/go/shared/fake"
 	"github.com/envoyproxy/envoy/source/extensions/dynamic_modules/sdk/go/shared/mocks"
@@ -1514,3 +1515,104 @@ func TestFilterFactory_Create(t *testing.T) {
 	require.True(t, ok)
 	require.Equal(t, mockHandle, cedarFilter.handle)
 }
+
+// Tests for dynamicMetadataMap / buildContext dynamic metadata
+
+func TestBuildContext_DynamicMetadata_MultipleNamespacesAndKeys(t *testing.T) {
+	policy := `permit(principal, action, resource);`
+	policyFile := createTestPolicyFile(t, policy)
+	cfg := &cedarConfig{
+		Policy:             pkg.DataSource{File: policyFile},
+		PrincipalType:      "User",
+		PrincipalIDHeader:  "x-user-id",
+		MetadataNamespaces: []string{"ns.auth", "ns.ratelimit"},
+	}
+	configJSON, err := json.Marshal(cfg)
+	require.NoError(t, err)
+
+	factory := &CedarHttpFilterConfigFactory{}
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+
+	mockConfigHandle := mocks.NewMockHttpFilterConfigHandle(ctrl)
+	mockConfigHandle.EXPECT().Log(gomock.Any(), gomock.Any(), gomock.Any()).AnyTimes()
+	mockConfigHandle.EXPECT().DefineCounter("cedar_requests_total", "decision").Return(shared.MetricID(1), shared.MetricsSuccess)
+
+	filterFactory, err := factory.Create(mockConfigHandle, configJSON)
+	require.NoError(t, err)
+
+	mockHandle := mocks.NewMockHttpFilterHandle(ctrl)
+	mockHandle.EXPECT().Log(gomock.Any(), gomock.Any(), gomock.Any()).AnyTimes()
+	mockHandle.EXPECT().GetAttributeString(gomock.Any()).Return(pkg.UnsafeBufferFromString(""), false).AnyTimes()
+	mockHandle.EXPECT().GetAttributeBool(gomock.Any()).Return(false, false).AnyTimes()
+
+	// Namespace "ns.auth" has two string keys.
+	mockHandle.EXPECT().GetMetadataKeys(shared.MetadataSourceTypeDynamic, "ns.auth").Return([]shared.UnsafeEnvoyBuffer{
+		pkg.UnsafeBufferFromString("identity"),
+		pkg.UnsafeBufferFromString("role"),
+	})
+	mockHandle.EXPECT().GetMetadataString(shared.MetadataSourceTypeDynamic, "ns.auth", "identity").Return(pkg.UnsafeBufferFromString("user-123"), true)
+	mockHandle.EXPECT().GetMetadataString(shared.MetadataSourceTypeDynamic, "ns.auth", "role").Return(pkg.UnsafeBufferFromString("admin"), true)
+
+	// Namespace "ns.ratelimit" has a string key.
+	mockHandle.EXPECT().GetMetadataKeys(shared.MetadataSourceTypeDynamic, "ns.ratelimit").Return([]shared.UnsafeEnvoyBuffer{
+		pkg.UnsafeBufferFromString("bucket"),
+	})
+	mockHandle.EXPECT().GetMetadataString(shared.MetadataSourceTypeDynamic, "ns.ratelimit", "bucket").Return(pkg.UnsafeBufferFromString("default"), true)
+
+	filter := filterFactory.Create(mockHandle).(*cedarHttpFilter)
+
+	headers := fake.NewFakeHeaderMap(map[string][]string{
+		":method":    {"GET"},
+		":path":      {"/api/resource"},
+		":authority": {"example.com"},
+	})
+
+	ctx := filter.buildContext(headers)
+
+	// Extract the dynamic_metadata record from context.
+	dmVal, ok := ctx.Get("dynamic_metadata")
+	require.True(t, ok, "dynamic_metadata should be present in context")
+
+	// Verify ns.auth namespace.
+	dmRecord, ok := dmVal.(cedarlib.Record)
+	require.True(t, ok)
+	authNs, ok := dmRecord.Get("ns.auth")
+	require.True(t, ok, "ns.auth namespace should be present")
+	authRecord, ok := authNs.(cedarlib.Record)
+	require.True(t, ok)
+	identity, ok := authRecord.Get("identity")
+	require.True(t, ok)
+	require.Equal(t, cedarlib.String("user-123"), identity)
+	role, ok := authRecord.Get("role")
+	require.True(t, ok)
+	require.Equal(t, cedarlib.String("admin"), role)
+
+	// Verify ns.ratelimit namespace.
+	rlNs, ok := dmRecord.Get("ns.ratelimit")
+	require.True(t, ok, "ns.ratelimit namespace should be present")
+	rlRecord, ok := rlNs.(cedarlib.Record)
+	require.True(t, ok)
+	bucket, ok := rlRecord.Get("bucket")
+	require.True(t, ok)
+	require.Equal(t, cedarlib.String("default"), bucket)
+}
+
+func TestBuildContext_DynamicMetadata_Empty(t *testing.T) {
+	policy := `permit(principal, action, resource);`
+	filter, _ := createTestFilter(t, &cedarConfig{Policy: pkg.DataSource{Inline: policy}})
+
+	headers := fake.NewFakeHeaderMap(map[string][]string{
+		":method":    {"GET"},
+		":path":      {"/"},
+		":authority": {"example.com"},
+	})
+
+	ctx := filter.buildContext(headers)
+
+	// When no metadata namespaces are configured, dynamic_metadata should be an empty record.
+	dmVal, ok := ctx.Get("dynamic_metadata")
+	require.True(t, ok, "dynamic_metadata should be present in context")
+	_, ok = dmVal.(cedarlib.Record)
+	require.True(t, ok, "dynamic_metadata should be a Record")
+}

extensions/composer/integration/envoy.yaml

@@ -1,3 +1,8 @@
+# Copyright Built On Envoy
+# SPDX-License-Identifier: Apache-2.0
+# The full text of the Apache license is available in the LICENSE file at
+# the root of the repo.
+
 admin:
   address:
     socket_address:

extensions/composer/integration/ftw.yml

@@ -1,3 +1,8 @@
+# Copyright Built On Envoy
+# SPDX-License-Identifier: Apache-2.0
+# The full text of the Apache license is available in the LICENSE file at
+# the root of the repo.
+
 ---
 logfile: "envoy.log"
 maxmarkerretries: 500

extensions/composer/integration/main_test.go

@@ -26,7 +26,7 @@ import (
 )
 
 const (
-	envoyLogFile = "envoy.log"
+	envoyLogFile  = "envoy.log"
 	albedoLogFile = "albedo.log"
 
 	envoyAdminPort = 9901

website/public/extensions.json

@@ -168,7 +168,7 @@
     "author": "Tetrate",
     "featured": true,
     "description": "Inline Cedar policy evaluation for HTTP request authorization",
-    "longDescription": "This extension implements [Cedar](https://www.cedarpolicy.com/) policy evaluation\nas an inline Envoy HTTP filter. It uses the [Cedar-Go](https://github.com/cedar-policy/cedar-go)\nlibrary to make authorization decisions on each request without a separate authorization server.\n\n## Key Features\n\n- **Inline Cedar evaluation**: Load and evaluate Cedar policy files directly in the Envoy\n  data path using the Cedar-Go library. No separate authorization server required.\n- **Structured authorization model**: Maps HTTP requests to Cedar's Principal/Action/Resource\n  model with rich context for fine-grained `when` clause conditions.\n- **Entity hierarchies**: Optionally load Cedar entity data to enable group membership and\n  hierarchical authorization checks (e.g., `principal in Group::\"admins\"`).\n- **Dry-run mode**: Log authorization decisions without enforcing them, useful for testing\n  policies in production.\n- **Fail-open mode**: Allow requests through when policy evaluation encounters an error,\n  instead of returning a 500 response.\n- **mTLS and SPIFFE identity**: Access client certificate attributes including SPIFFE IDs\n  (URI SANs), DNS SANs, and certificate subject in policy context.\n- **Configurable deny responses**: Customize the HTTP status code, body, and headers\n  returned when a request is denied.\n\n## Authorization Model\n\nHTTP requests are mapped to Cedar authorization concepts:\n\n- **Principal**: Derived from a configurable request header (e.g., `User::\"alice\"` from\n  the `x-user-id` header). The entity type is set via `principal_type` and the ID is\n  extracted from the header specified by `principal_id_header`.\n- **Action**: Derived from the HTTP method (e.g., `Action::\"GET\"`, `Action::\"POST\"`).\n  The entity type defaults to `Action` and can be customized via `action_type`.\n- **Resource**: Derived from the request path without query string (e.g.,\n  `Resource::\"/api/users\"`). The entity type defaults to `Resource` and can be\n  customized via `resource_type`.\n- **Context**: Rich request attributes available in Cedar `when` clauses.\n\n## Context Record Structure\n\nThe `context` record passed to Cedar policies contains the following structure:\n\n```json\n{\n  \"request\": {\n    \"method\": \"GET\",\n    \"path\": \"/api/v1/resource?key=value\",\n    \"host\": \"example.com\",\n    \"scheme\": \"https\",\n    \"protocol\": \"HTTP/1.1\",\n    \"headers\": {\n      \"authorization\": \"Bearer ...\",\n      \"content-type\": \"application/json\"\n    }\n  },\n  \"source\": {\n    \"address\": \"10.0.0.1:5000\",\n    \"certificate\": {\n      \"uri_san\": \"spiffe://cluster.local/ns/default/sa/client\",\n      \"dns_san\": \"client.default.svc.cluster.local\",\n      \"subject\": \"CN=client,O=example\",\n      \"sha256_digest\": \"abc123...\"\n    }\n  },\n  \"destination\": {\n    \"address\": \"10.0.0.2:443\"\n  },\n  \"connection\": {\n    \"mtls\": true,\n    \"tls_version\": \"TLSv1.3\"\n  },\n  \"parsed_path\": [\"api\", \"v1\", \"resource\"],\n  \"parsed_query\": {\"key\": [\"value\"]}\n}\n```\n\n## Metrics\n\nThe extension exposes the `cedar_requests_total` counter metric with a `decision` tag that\ntracks authorization outcomes. The possible tag values are:\n\n| Decision | Description |\n|--------|------|\n| `allowed` | The policy allowed the request. |\n| `denied` | The policy denied the request (or an error occurred with fail-open disabled). |\n| `failopen` | An error occurred during policy evaluation and the request was allowed because fail-open mode is enabled. |\n| `dryrun_allow` | The policy denied the request but it was allowed because dry-run mode is enabled. |\n",
+    "longDescription": "This extension implements [Cedar](https://www.cedarpolicy.com/) policy evaluation\nas an inline Envoy HTTP filter. It uses the [Cedar-Go](https://github.com/cedar-policy/cedar-go)\nlibrary to make authorization decisions on each request without a separate authorization server.\n\n## Key Features\n\n- **Inline Cedar evaluation**: Load and evaluate Cedar policy files directly in the Envoy\n  data path using the Cedar-Go library. No separate authorization server required.\n- **Structured authorization model**: Maps HTTP requests to Cedar's Principal/Action/Resource\n  model with rich context for fine-grained `when` clause conditions.\n- **Entity hierarchies**: Optionally load Cedar entity data to enable group membership and\n  hierarchical authorization checks (e.g., `principal in Group::\"admins\"`).\n- **Dry-run mode**: Log authorization decisions without enforcing them, useful for testing\n  policies in production.\n- **Fail-open mode**: Allow requests through when policy evaluation encounters an error,\n  instead of returning a 500 response.\n- **mTLS and SPIFFE identity**: Access client certificate attributes including SPIFFE IDs\n  (URI SANs), DNS SANs, and certificate subject in policy context.\n- **Configurable deny responses**: Customize the HTTP status code, body, and headers\n  returned when a request is denied.\n\n## Authorization Model\n\nHTTP requests are mapped to Cedar authorization concepts:\n\n- **Principal**: Derived from a configurable request header (e.g., `User::\"alice\"` from\n  the `x-user-id` header). The entity type is set via `principal_type` and the ID is\n  extracted from the header specified by `principal_id_header`.\n- **Action**: Derived from the HTTP method (e.g., `Action::\"GET\"`, `Action::\"POST\"`).\n  The entity type defaults to `Action` and can be customized via `action_type`.\n- **Resource**: Derived from the request path without query string (e.g.,\n  `Resource::\"/api/users\"`). The entity type defaults to `Resource` and can be\n  customized via `resource_type`.\n- **Context**: Rich request attributes available in Cedar `when` clauses.\n\n## Context Record Structure\n\nThe `context` record passed to Cedar policies contains the following structure:\n\n```json\n{\n  \"request\": {\n    \"method\": \"GET\",\n    \"path\": \"/api/v1/resource?key=value\",\n    \"host\": \"example.com\",\n    \"scheme\": \"https\",\n    \"protocol\": \"HTTP/1.1\",\n    \"headers\": {\n      \"authorization\": \"Bearer ...\",\n      \"content-type\": \"application/json\"\n    }\n  },\n  \"source\": {\n    \"address\": \"10.0.0.1:5000\",\n    \"certificate\": {\n      \"uri_san\": \"spiffe://cluster.local/ns/default/sa/client\",\n      \"dns_san\": \"client.default.svc.cluster.local\",\n      \"subject\": \"CN=client,O=example\",\n      \"sha256_digest\": \"abc123...\"\n    }\n  },\n  \"destination\": {\n    \"address\": \"10.0.0.2:443\"\n  },\n  \"connection\": {\n    \"mtls\": true,\n    \"tls_version\": \"TLSv1.3\"\n  },\n  \"dynamic_metadata\": {\n    \"envoy.filters.http.jwt_authn\": {\n      \"sub\": \"user-123\",\n      \"iss\": \"https://issuer.example.com\"\n    }\n  },\n  \"parsed_path\": [\"api\", \"v1\", \"resource\"],\n  \"parsed_query\": {\"key\": [\"value\"]}\n}\n```\n\n## Metrics\n\nThe extension exposes the `cedar_requests_total` counter metric with a `decision` tag that\ntracks authorization outcomes. The possible tag values are:\n\n| Decision | Description |\n|--------|------|\n| `allowed` | The policy allowed the request. |\n| `denied` | The policy denied the request (or an error occurred with fail-open disabled). |\n| `failopen` | An error occurred during policy evaluation and the request was allowed because fail-open mode is enabled. |\n| `dryrun_allow` | The policy denied the request but it was allowed because dry-run mode is enabled. |\n",
     "type": "go",
     "tags": [
       "go",
@@ -222,6 +222,11 @@
         "title": "Fail-Open Mode",
         "description": "Enable fail-open mode to allow requests through when policy evaluation\nencounters an error, instead of returning a 500 response. Useful for\nnon-critical authorization checks where availability is prioritized\nover enforcement.\n",
         "code": "boe run --extension cedar-auth --config '{\n  \"policy\": {\"file\": \"/tmp/policy.cedar\"},\n  \"principal_type\": \"User\",\n  \"principal_id_header\": \"x-user-id\",\n  \"fail_open\": true\n}'\n"
+      },
+      {
+        "title": "Include Envoy dynamic metadata in Cedar context",
+        "description": "Include Envoy dynamic metadata in the Cedar context record under `context.dynamic_metadata`.\nThis allows writing policies that make decisions based on dynamic metadata from other Envoy\nfilters, such as JWT authentication claims.\n",
+        "code": "boe run --extension cedar-auth --config '{\n  \"policy\": {\"file\": \"/tmp/policy.cedar\"},\n  \"principal_type\": \"User\",\n  \"principal_id_header\": \"x-user-id\",\n  \"metadata_namespaces\": [\"envoy.filters.http.jwt_authn\"]\n}'\n"
       }
     ],
     "minEnvoyVersion": "1.37.1",