feat: Ability to Configure Remote Authorizers to set Headers in AuthenticationSession

[wesleyfantinel]

Related issue

Proposed changes

The remote authorizers may have useful context from user's permissions. So with this changes, custom authorizers using remote and remote_json can return some useful headers to be forward into the AuthenticationSession, meaning that these headers will be passed to upstream services.

For example, an user containing scopes/branches inside an organization profile has some level of data addressed to him. In this case, the upstream service need to know that, and "filter" the data according to his "branch_id". The permission that is given to the user (and the remote authorizers manages) has a record of the "branch_id", for the following responses will be returned as status code 200 (if granted) and containing a header like X-Branch-Id.

The upstream service receives the X-Branch-Id and does your thing.

The configuration requires to configure a list of "allowed headers" returning from remote authorizer, that will be accepted in the pipeline.

---

Without this, we have to perform another request using the mutator Hydrador to retrieve the users' "branch_id", that is not a good performance approach in my vision for this set.

Checklist

• I have read the contributing guidelines.
• I have read the security policy.
• I confirm that this pull request does not address a security
  vulnerability. If this pull request addresses a security. vulnerability, I
  confirm that I got green light (please contact
  [email protected]) from the maintainers to push
  the changes.
• I have added tests that prove my fix is effective or that my feature
  works.
• I have added or changed the documentation.

Further comments

[aeneasr]

Thank you for the contribution! Unfortunately we can not accept contributions without tests. These are important to ensure that your feature does what it should, and it ensures that it keeps working even if others change your code!

if you need help with the tests feel free to ping a maintainer!

[wesleyfantinel]

Ok, sending the tests.

[aeneasr]

Looks like tests are failing for the new feature, could you take a look maybe? 🧐

[wesleyfantinel]

Alright, got it fixed.

[aeneasr]

This looks ready to be merged! The tests look great and the implementation too. I just would like to ask to rename the field to make it more obvious what it does :)

[aeneasr]

Great job, thank you for your hard work!