feat(extauth): evaluate verification CEL rules at request time

[aramase]

What

Wires ServiceTokenRequirement.spec.verification.rules (CEL) end-to-end. Before this PR pkg/extauth/server.go:checkVerificationRules had a placeholder loop with a comment saying "CEL rules are evaluated by the ext auth adapter in production / Full CEL evaluation will be added when we integrate with the controller" — every CEL expression was silently ignored, and the controller's validateCELRules only checked for empty strings.

After this PR:

• New pkg/extauth/celverify subpackage that compiles CEL programs using the documented variables (txtoken, request) and evaluates them against a request-scoped context. Kept import-free of internal/controller and pkg/extauth so both sides share one compile path.
• Server.SetVerificationRules compiles each rule's CEL programs at push time and stores the snapshot in an atomic.Pointer[[]verificationRuleSet] so request handlers swap rule sets without locking. Rules whose CEL fails to compile are dropped and logged; the rest of the snapshot still applies.
• checkVerificationRules evaluates the compiled programs after the existing scope/tctx checks and returns a celverify.DeniedError carrying the rule's configured message — which surfaces verbatim in the PermissionDenied response.
• ServiceTokenRequirementReconciler.validateCELRules now invokes celverify.Compile, so syntactically invalid CEL or non-bool expressions flip ConditionReady=False on the owning STR before the rule ever reaches the runtime. Mirrors what TokenPolicyReconciler does for issuance rules (PR feat(tts): stream TokenPolicy issuance rules from controller #22).

Variables exposed to CEL

Per api/v1alpha1.VerificationRule.CEL doc-comment:

• txtoken — TxToken claims, JSON-shaped (txtoken.sub, txtoken.scope, txtoken.tctx.<key>, txtoken.rctx.<key>, etc.).
• request — HTTP request attributes (request.path, request.method, request.headers["x-foo"]). Header keys are lower-cased to match Envoy normalisation.

Tests

• pkg/extauth/celverify/cel_test.go: 9 unit tests covering compile success/failure, non-bool output, runtime errors, denied error propagation, first-failing-rule semantics.
• pkg/extauth/server_test.go: 4 new end-to-end tests through Check:
  • CEL allow path with txtoken.tctx.classification in [...].
  • CEL deny path with txtoken.tctx.classification != "pii" — asserts PermissionDenied + message + rule name.
  • CEL request.method access (GET allow, DELETE deny).
  • Bad CEL in one rule is dropped without affecting other valid rules in the same snapshot.
• internal/controller/controller_test.go: 4 new validateCELRules cases (syntax error, non-bool expression, unknown variable, empty input).

All tests pass with go test -race ./....

Out of scope / follow-ups

• Surfacing per-rule CEL compile errors on ServiceTokenRequirement.status individually (currently bundled into one Ready=False message). Tracked separately.
• Metrics for extauth_verification_cel_denied_total{rule}. Tracked separately.

[Copilot]

Pull request overview

This PR wires ServiceTokenRequirement.spec.verification.rules (CEL) end-to-end by introducing a shared CEL compile/eval path and executing verification CEL rules at ext-auth request time, with controller-side pre-validation to prevent invalid rules from reaching runtime.

Changes:

• Added pkg/extauth/celverify to compile verification CEL rules (with txtoken / request variables) and evaluate them against request-scoped context.
• Updated pkg/extauth/server.go to compile rules at push time, store compiled snapshots atomically, and evaluate compiled CEL during Check.
• Updated internal/controller CEL validation to compile using celverify.Compile, plus added unit/e2e tests covering compile/eval and request-path behavior.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
pkg/extauth/server.go	Compiles verification CEL at rule-push time, stores compiled snapshot atomically, evaluates CEL during request verification.
pkg/extauth/server_test.go	Adds request-path tests for allow/deny, request variables, and handling of invalid CEL in snapshots.
pkg/extauth/celverify/cel.go	New shared CEL compilation + evaluation implementation for verification rules.
pkg/extauth/celverify/cel_test.go	Unit tests for CEL compile/eval behavior (syntax, type checks, denial semantics, runtime errors).
internal/controller/controller.go	Switches verification CEL validation to compile against the shared CEL env used by runtime.
internal/controller/controller_test.go	Adds tests for controller-side validation failures (syntax/type/unknown vars/empty).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated no new comments.