Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Adds support for selecting values that match
google.golang.org/protobuf/types/known/timestamppb.Timestamp
type (i.e.{ "seconds": Number, "nanos": Number }
) from the Authorization JSON. The source values are converted to their corresponding timestamp string representation in RFC3339 format.Breaking change:
Users that previously trusted on selectors/CEL expressions such as
request.time
to resolve to{ "seconds": Number, "nanos": Number }
shall now expect RFC3339 instead.Users can still dig into the details of a timestamp value in the middle of an expression or for extracting only one of the parts of the timestamp (e.g.
request.time.seconds
). However, RFC3339 will be used whenever extracting a value known to be a perfect representation of a timestamp in Google's protobuf format, for example, when building dynamic URLs and request parameters for fetching metadata from external sources, when extending properties of identity objects, and dynamic authorization response attributes (e.g. injected HTTP headers, etc) from these values.Although
google.golang.org/protobuf/types/known/timestamppb.Timestamp
declares bothseconds
andnanos
as optional. For the conversion to RFC3339 to trigger, at least one of these properties must be present in the source value, and no other property other than these two.