feat: support query_parameters_to_set in response

[sedovmik]

Add support for query_parameters_to_set field in response to allow setting/overwriting query parameters before sending upstream. Similar to existing query_parameters_to_remove support.

Example usage in OPA policies:

package envoy.authz

default allow = true

query_parameters_to_set = {
   "user_id": "123",
   "tenant": "acme"
}

query_parameters_to_set = {
   "role": ["admin", "user"],
   "scope": ["read", "write"]
}

query_parameters_to_set = {
   "user_id": "123",
   "role": ["admin", "user"]
}

result["allowed"] = allow
result["query_parameters_to_set"] = query_parameters_to_set

[regeda]

Great contribution!

Could you consider the following API:

query_parameters_to_set := {
  "foo": "value1",
  "bar": "value2",
}

It leads to less iterations and less memory allocations.

[sedovmik]

Thank you for the comment! I agree that the format could be simplified. I intended to keep it aligned with Envoy's config.core.v3.QueryParameter for implementation simplicity, but your suggestion is indeed more ergonomic.

Regarding multi-value parameters - In HTTP, it's possible to have multiple values for the same query parameter (e.g., ?foo=value1&foo=value2). To properly support this, I could add support for both value types (string and array of strings):

query_parameters_to_set := {
  "foo": "value1",             # single value
  "bar": ["value1", "value2"]  # multiple values
}

What are your thoughts? I'd be happy to update the implementation accordingly.

[regeda]

I fully support both value types.

[regeda]

Please add this feature to the official OPA documentation (like open-policy-agent/opa#7241)

[sedovmik]

@regeda Thank you for the review. The documentation PR is available here: open-policy-agent/opa#7405

[sedovmik]

@tjons @ashutosh-narkar

I rework the change with all @regeda's suggestions, including the docs update in the main repo. Everything is ready for another look when you get a chance.

[ashutosh-narkar]

including the docs update in the main repo.

Thanks for the contribution. You'll need to update this page. Is that what you're referring to?

[sedovmik]

You'll need to update this page.

Yes, PR for documentation is ready: open-policy-agent/opa#7405

[ashutosh-narkar]

Can you please squash your commits and we can get this in. Thanks!