tree c2622e32ef425bf65175dcad9bb8d2702cdcc373
parent 0e8ae300bdb71b9c73399fc7ce1c75884dd5e448
author Saurav <sauravz@google.com> 1788968152 +0530
committer GitHub <noreply@github.com> 1788968152 +0530
gpgsig -----BEGIN PGP SIGNATURE-----
 
 wsFcBAABCAAQBQJqoXzYCRC1aQ7uu5UhlAAAkXsQAJVChSot8wS2YX+MhyUhqYp4
 dt8uDj17rcpafCrYtpSJKxd5DNRKc2TsvfzmBnlU8rBz/ge8qHRY/x36IFHUnkGO
 ljqqnS0eCiiB2oYv29bY/nrxe1Ho/axcU8e+X299ARlYYyTzhaxZ+TLSWhffsr2C
 rmGU29fltj8BtkxmmF94sxr4ATLSjKun89Mu/FO8rY3rx9DmZBYz3xvpMAK4aWuv
 oHyjcHqtbKjQptocnTaoXTlbubovORdibMA4WJeG6L5sp+dhpJxln1x+y5weOe8i
 4vjY5BY1mwXNnzOzev15bGSVyz5sjqVzaUsEAy65XRwdwLRU4+djDYduuBYKuXzp
 YL/rT6R7inNh9Dwat2qIY3tvhTQfwIkFvpS9osTVYi4GR8U/Jjc9jeKQ+O4PMbAW
 StM/FxGzhgHXZyRedaRSCs9bGQ9CfwEtUgGXTmjHq0jgDQFZm6pC8BUR8ZCewyp0
 Y2XLWu0Biw25KFCF4BFUNGOZXsvkvBonlHeSuSJMfQPYMHEGVO+G08fNGql+25vE
 i+xfU2g7hkrP5n+3IDVkHCrRucSC5O5H6qgLwBjkr2cSqsOQSjGQsx2sEyjTCXsg
 gsx2T4062lrOpGcymh8e0vYADIRpI9CpccJ2tXrxaF5AHE1yJopI+aIJ40Zj0Pzv
 BxwhchyJEOPy2ZKyIIf4
 =qhLL
 -----END PGP SIGNATURE-----
 

xds: Add ext_authz response handling (#13037)

Part 2 of the client-side ext_authz filter. Sits on top of #12493
(merged).

> Supersedes #12896, which was auto-closed when its base branch was
deleted and cannot be reopened due to branch rebase. Previously reviewed
and approved by @kannanjgithub in #12896.

Adds `CheckResponseHandler`, which interprets the `CheckResponse` from
the authorization service. It evaluates `OkHttpResponse` vs
`DeniedHttpResponse`, maps HTTP status codes to gRPC statuses, applies
`failure_mode_allow` semantics when the authz server is unreachable, and
validates decoder header mutations against the configured
`HeaderMutationRulesConfig`.

`AuthzResponse` is the resulting value object carrying the allow/deny
decision, the gRPC status for denied calls, and any header/trailer
mutations to apply.