Implement OpenID token expressions evaluation

[ErmakovDmitriy]

This PR implements an OpenID token expression evaluation.

The idea and the use-case is to be able to define different behavior in HAProxy based on OpenID token claims.

An example:

• An OpenID token contains a field roles which is an array of admin, viewer, editor;
• We want to allow access to /admin URL path only for people with admin role;

With this PR, it is possible to define in HAProxy:

acl host1.example.com hdr(host) -i host1.example.com
acl host1.example.com_admin_path path_beg -i /admin
acl host1.example.com-admin-allowed var(sess.auth.token_expression_in_roles_admin) -m bool

http-request send-spoe-group spoe-auth try-auth-all if host1.example.com
http-request set-var(req.oidc_token_expressions) str("in;roles;admin") if host1.example.com
http-request send-spoe-group spoe-auth try-auth-all if host1.example.com

use_backend haproxy-spoe-auth-error if host1.example.com oauth2_error
use_backend haproxy-spoe-auth-redirect if host1.example.com !oauth2_authenticated

http-request deny deny_status 403 if host1.example.com !host1.example.com-admin-allowed host1.example.com_admin_path oauth2_authenticated
use_backend host1.example.com-backend if host1.example.com host1.example.com-admin-allowed

[mougams]

Thank you for the PR, a bit complex since this adds lots of things in the same PR - would have been nice if this could be split, but that's ok.

I've put few remarks, and the patch seems breaking.
Also, you might need to rebase, since I've merged some lib updates.

[ErmakovDmitriy]

Hi mougams,

Thank you and sorry for such a complex PR.

I will try to fix what you requested and update this PR.

[mougams]

Please rebase, and we should be good. Thx

[mougams]

Hi @ErmakovDmitriy, thanks for the rebase and update. It looks like some tests are failing.
Could you please fix those ? Thx

[ErmakovDmitriy]

I will debug, thank you for running the test.

[ErmakovDmitriy]

I think that the issue was with a nil pointer dereference (2854269).

It looks like a pipeline in my fork passes the tests: https://github.com/ErmakovDmitriy/haproxy-spoe-auth/actions/runs/18061087756/job/51397418895
although the "cleanup" part does not finish for some reason. It might be something with my repository or Github actions configuration (I am not very familiar with them).