feat: Add ext-auth plugin support for authentication blacklists/whitelists

[hanxiantao]

Ⅰ. Describe what this PR did

1）支持配置请求黑白名单
2）优化代码结构，完善单元测试
3）优化文档，添加 endpoint_mode 为 forward_auth 时 X-Forwarded-* 请求头相关的示例，文档中删除 X-Original-* 相关的部分

Ⅱ. Does this pull request fix one issue?

fixes #1691

Ⅲ. Why don't you add test cases (unit test/integration test)?

Ⅳ. Describe how to verify it

认证白名单

apiVersion: extensions.higress.io/v1alpha1
kind: WasmPlugin
metadata:
  name: test
  namespace: higress-system
spec:
  defaultConfig:
    http_service:
      authorization_request:
        allowed_headers:
          - exact: x-user-id
          - prefix: x-custom-
        headers_to_add:
          key1: value1
          key2: value2
        with_request_body: false
      endpoint_mode: forward_auth
      endpoint:
        request_method: POST
        path: /auth
        service_name: ext-auth.static
        service_port: 80
        service_source: ip
    match_type: 'whitelist'
    match_list:
        - match_rule_domain: '*.bar.com'
          match_rule_path: '/foo/health'
          match_rule_type: 'exact'
        - match_rule_path: '/foo/metrics'
          match_rule_type: 'exact'
  imagePullSecret: aliyun
  url: >-
    oci://registry.cn-hangzhou.aliyuncs.com/wasm-plugin/wasm-plugin:ext-auth-0.0.87

认证服务固定返回500

curl -X PUT http://localhost:8082/foo?apikey=9a342114-ba8a-11ec-b1bf-00163e1250b5 -H "foo: bar" -H "Authorization: xxx" -H "Host: foo.bar.com" -o - -w "\n%{http_code}\n" -s -S

curl -X PUT http://localhost:8082/foo/health?apikey=9a342114-ba8a-11ec-b1bf-00163e1250b5 -H "foo: bar" -H "Authorization: xxx" -H "Host: foo.bar.com" -o - -w "\n%{http_code}\n" -s -S

curl -X PUT http://localhost:8082/foo/metrics?apikey=9a342114-ba8a-11ec-b1bf-00163e1250b5 -H "foo: bar" -H "Authorization: xxx" -o /dev/null -w "%{http_code}\n" -s -S

只有第一次curl进入认证，返回401，其他请求均跳过认证

认证黑名单

apiVersion: extensions.higress.io/v1alpha1
kind: WasmPlugin
metadata:
  name: test
  namespace: higress-system
spec:
  defaultConfig:
    http_service:
      authorization_request:
        allowed_headers:
          - exact: x-user-id
          - prefix: x-custom-
        headers_to_add:
          key1: value1
          key2: value2
        with_request_body: false
      endpoint_mode: forward_auth
      endpoint:
        request_method: POST
        path: /auth
        service_name: ext-auth.static
        service_port: 80
        service_source: ip
    match_type: 'blacklist'
    match_list:
        - match_rule_domain: '*.bar.com'
          match_rule_path: '/foo/health'
          match_rule_type: 'exact'
        - match_rule_path: '/foo/metrics'
          match_rule_type: 'exact'
  imagePullSecret: aliyun
  url: >-
    oci://registry.cn-hangzhou.aliyuncs.com/wasm-plugin/wasm-plugin:ext-auth-0.0.87

认证服务固定返回500

curl -X PUT http://localhost:8082/foo?apikey=9a342114-ba8a-11ec-b1bf-00163e1250b5 -H "foo: bar" -H "Authorization: xxx" -H "Host: foo.bar.com" -o - -w "\n%{http_code}\n" -s -S

curl -X PUT http://localhost:8082/foo/health?apikey=9a342114-ba8a-11ec-b1bf-00163e1250b5 -H "foo: bar" -H "Authorization: xxx" -H "Host: foo.bar.com" -o - -w "\n%{http_code}\n" -s -S

curl -X PUT http://localhost:8082/foo/metrics?apikey=9a342114-ba8a-11ec-b1bf-00163e1250b5 -H "foo: bar" -H "Authorization: xxx" -o /dev/null -w "%{http_code}\n" -s -S

第二、三次curl进入认证，返回401，第一次请求跳过认证

endpoint_mode为envoy时

1）认证成功

apiVersion: extensions.higress.io/v1alpha1
kind: WasmPlugin
metadata:
  name: test
  namespace: higress-system
spec:
  defaultConfig:
    http_service:
      authorization_request:
        allowed_headers:
          - exact: x-user-id
          - prefix: x-custom-
        headers_to_add:
          key1: value1
          key2: value2
        with_request_body: false
      endpoint:
        path_prefix: /auth
        service_name: ext-auth.static
        service_port: 80
        service_source: ip
  imagePullSecret: aliyun
  url: >-
    oci://registry.cn-hangzhou.aliyuncs.com/wasm-plugin/wasm-plugin:ext-auth-0.0.87

curl -kvv -X PUT http://localhost:8082/foo?apikey=9a342114-ba8a-11ec-b1bf-00163e1250b5 -H "foo: bar" -H "Authorization: xxx" -H "Host: foo.bar.com"

认证成功

认证请求Method为原始请求Method，认证请求path为path_prefix+原始path拼接，并添加对应请求头key1和key2到认证服务

2）认证失败

curl -kvv -X PUT http://localhost:8082/foo?apikey=9a342114-ba8a-11ec-b1bf-00163e1250b5 -H "foo: bar" -H "Authorization: xxx" -H "Host: foo.bar.com"

认证失败，响应码和响应体为认证服务返回的内容

认证请求Method为原始请求Method，认证请求path为path_prefix+原始path拼接，并添加对应请求头key1和key2到认证服务

endpoint_mode为forward_auth时

1）认证成功

apiVersion: extensions.higress.io/v1alpha1
kind: WasmPlugin
metadata:
  name: test
  namespace: higress-system
spec:
  defaultConfig:
    http_service:
      authorization_request:
        allowed_headers:
          - exact: x-user-id
          - prefix: x-custom-
        headers_to_add:
          key1: value1
          key2: value2
        with_request_body: false
      endpoint_mode: forward_auth
      endpoint:
        request_method: POST
        path: /auth
        service_name: ext-auth.static
        service_port: 80
        service_source: ip
  imagePullSecret: aliyun
  url: >-
    oci://registry.cn-hangzhou.aliyuncs.com/wasm-plugin/wasm-plugin:ext-auth-0.0.87

curl -kvv -X PUT http://localhost:8082/foo?apikey=9a342114-ba8a-11ec-b1bf-00163e1250b5 -H "foo: bar" -H "Authorization: xxx" -H "Host: foo.bar.com" -H "x-user-id: 111111" -H "x-custom-1: test"

认证成功

认证请求Method为配置的request_method，认证请求path为配置的path

2）认证失败

curl -kvv -X PUT http://localhost:8082/foo?apikey=9a342114-ba8a-11ec-b1bf-00163e1250b5 -H "foo: bar" -H "Authorization: xxx" -H "Host: foo.bar.com" -H "x-user-id: 111111" -H "x-custom-1: test"

认证失败

认证请求Method为配置的request_method，认证请求path为配置的path

Ⅴ. Special notes for reviews

[codecov-commenter]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 43.61%. Comparing base (ef31e09) to head (2bd1133).
Report is 276 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1694      +/-   ##
==========================================
+ Coverage   35.91%   43.61%   +7.70%     
==========================================
  Files          69       76       +7     
  Lines       11576    12358     +782     
==========================================
+ Hits         4157     5390    +1233     
+ Misses       7104     6630     -474     
- Partials      315      338      +23     

see 70 files with indirect coverage changes

[johnlanni]

LGTM, Thanks!