Add header cloning for downstream and upstream#2774
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (2)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughThe gateway preserves original downstream request and upstream response headers, exposes them through protobuf and Python policy contexts across request, response, body, and stream phases, translates optional snapshot fields, tests mutation behavior, and documents snapshot access. ChangesContext snapshot propagation
Estimated code review effort: 4 (Complex) | ~45 minutes Sequence Diagram(s)sequenceDiagram
participant PolicyExecutionContext
participant GoPythonBridge
participant PythonTranslator
participant PythonPolicy
PolicyExecutionContext->>GoPythonBridge: attach downstream and upstream snapshots
GoPythonBridge->>PythonTranslator: send protobuf context
PythonTranslator->>PythonPolicy: provide decoded snapshot contexts
Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 3 | ❌ 2❌ Failed checks (2 warnings)
✅ Passed checks (3 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Warning There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure. 🔧 Checkov (3.3.8)gateway/gateway-runtime/policy-engine/go.modTraceback (most recent call last): gateway/gateway-runtime/python-executor/requirements.txtTraceback (most recent call last): 🔧 golangci-lint (2.12.2)level=error msg="[linters_context] typechecking error: pattern ./...: directory prefix . does not contain modules listed in go.work or their selected dependencies" Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
|
@coderabbitai review |
✅ Action performedReview finished.
|
Update go and python sdk core versions
006d3c9 to
0720c07
Compare
|
@coderabbitai review |
✅ Action performedReview finished.
|
3 participants
Purpose
Description
This pull request introduces support for exposing both the original (pristine) and mutated request/response headers to custom Python policies in the gateway. It adds new
downstreamandupstreamcontext fields to all policy context types, ensuring that policies can reliably distinguish between the headers as originally received/sent and those potentially modified by earlier policies. The documentation is updated to explain the correct usage and fallback patterns, and comprehensive tests are added to verify correctness and backward compatibility.API and Protocol Buffer Additions:
DownstreamContext(withDownstreamRequest) andUpstreamRequestContext/UpstreamResponseContext(withUpstreamResponse) messages to the policy engine proto, and threaded these through all request and response context messages. These fields provide snapshots of the original client request and upstream response headers, respectively. [1] [2] [3] [4] [5] [6] [7]Kernel Implementation:
PolicyExecutionContext, captured a snapshot of the original client request headers before any policy mutation, storing it asdownstreamHeadersand exposing it via the new context fields for both request and response phases. [1] [2] [3] [4]Documentation Improvements:
downstreamandupstreamfields, how they differ from the mutableheaders, and how to safely use them with fallback logic for older gateways. Provided code examples and guidance on validating original header values. [1] [2] [3] [4] [5]Testing:
downstream_upstream_test.gowith tests ensuring that the downstream and upstream snapshots are correctly populated, survive header mutations, and are available on all context types. Tests also confirm that the correct (original vs. mutated) header values are observed in all relevant scenarios.These changes ensure that custom policies can reliably validate headers as originally received from the client or backend, regardless of any in-flight mutations by other policies, while maintaining backward compatibility with older gateway versions.