feat: Composite configurable mutator cache key per rule.

.schema/config.schema.json

@@ -1127,6 +1127,11 @@
             "enabled": {
               "$ref": "#/definitions/handlerSwitch"
             },
+            "key": {
+              "type": "string",
+              "title": "Cache key",
+              "description": "Define custom cache key, i.e '{{ print .Subject }}'. All properties must be part of AuthenticationSession."
+            },
             "ttl": {
               "type": "string",
               "pattern": "^[0-9]+(ns|us|ms|s|m|h)$",

pipeline/mutate/mutator_hydrator.go

@@ -85,8 +85,8 @@ type externalAPIConfig struct {
 type cacheConfig struct {
 	Enabled bool   `json:"enabled"`
 	TTL     string `json:"ttl"`
-
-	ttl time.Duration
+	Key     string `json:"key"`
+	ttl     time.Duration
 }
 
 type MutatorHydratorConfig struct {
@@ -114,16 +114,16 @@ func (a *MutatorHydrator) GetID() string {
 	return "hydrator"
 }
 
-func (a *MutatorHydrator) cacheKey(config *MutatorHydratorConfig, session string) string {
-	return fmt.Sprintf("%s|%x", config.Api.URL, md5.Sum([]byte(session)))
+func (a *MutatorHydrator) cacheKey(config *MutatorHydratorConfig, key string) string {
+	return fmt.Sprintf("%s|%x", config.Api.URL, md5.Sum([]byte(key)))
 }
 
-func (a *MutatorHydrator) hydrateFromCache(config *MutatorHydratorConfig, session string) (*authn.AuthenticationSession, bool) {
+func (a *MutatorHydrator) hydrateFromCache(config *MutatorHydratorConfig, key string) (*authn.AuthenticationSession, bool) {
 	if !config.Cache.Enabled {
 		return nil, false
 	}
 
-	item, found := a.hydrateCache.Get(a.cacheKey(config, session))
+	item, found := a.hydrateCache.Get(a.cacheKey(config, key))
 	if !found {
 		return nil, false
 	}
@@ -141,12 +141,20 @@ func (a *MutatorHydrator) hydrateToCache(config *MutatorHydratorConfig, key stri
 	}
 }
 
-func (a *MutatorHydrator) Mutate(r *http.Request, session *authn.AuthenticationSession, config json.RawMessage, _ pipeline.Rule) error {
+func (a *MutatorHydrator) Mutate(r *http.Request, session *authn.AuthenticationSession, config json.RawMessage, p pipeline.Rule) error {
 	cfg, err := a.Config(config)
 	if err != nil {
 		return err
 	}
 
+	if len(cfg.Cache.Key) > 0 {
+		if cacheSession, ok := a.hydrateFromCache(cfg, cfg.Cache.Key+p.GetID()); ok {
+			*session = *cacheSession
+			return nil
+		}
+		a.d.Logger().Debugf("Cache key %s in rule %s was not found. Falling back on default.",
+			cfg.Cache.Key, p.GetID())
+	}
 	var b bytes.Buffer
 	if err := json.NewEncoder(&b).Encode(session); err != nil {
 		return errors.WithStack(err)
@@ -234,8 +242,11 @@ func (a *MutatorHydrator) Mutate(r *http.Request, session *authn.AuthenticationS
 	}
 	*session = sessionFromUpstream
 
-	a.hydrateToCache(cfg, encodedSession, session)
-
+	if len(cfg.Cache.Key) > 0 {
+		a.hydrateToCache(cfg, cfg.Cache.Key+p.GetID(), session)
+	} else {
+		a.hydrateToCache(cfg, encodedSession, session)
+	}
 	return nil
 }
 

pipeline/mutate/mutator_hydrator_test.go

@@ -127,6 +127,12 @@ func configWithRetriesForMutator(giveUpAfter, retryDelay string) func(*httptest.
 	}
 }
 
+func configWithSpecialCacheKey(key string) func(*httptest.Server) json.RawMessage {
+	return func(s *httptest.Server) json.RawMessage {
+		return []byte(fmt.Sprintf(`{"api": {"url": "%s"}, "cache": {"key": "%s"}}`, s.URL, key))
+	}
+}
+
 func TestMutatorHydrator(t *testing.T) {
 	conf := internal.NewConfigurationWithDefaults()
 	reg := internal.NewRegistry(conf)
@@ -148,6 +154,7 @@ func TestMutatorHydrator(t *testing.T) {
 		sampleUserId := "user"
 		sampleValidPassword := "passwd1"
 		sampleNotValidPassword := "passwd7"
+
 		var testMap = map[string]struct {
 			Setup   func(*testing.T) http.Handler
 			Session *authn.AuthenticationSession
@@ -346,6 +353,15 @@ func TestMutatorHydrator(t *testing.T) {
 				Match:   newAuthenticationSession(),
 				Err:     nil,
 			},
+			"Custom Cache Key": {
+				Setup:   defaultRouterSetup(),
+				Session: newAuthenticationSession(setSubject(sampleSubject)),
+				Rule:    &rule.Rule{ID: "test-rule"},
+				Config:  configWithSpecialCacheKey(sampleSubject),
+				Request: &http.Request{},
+				Match:   newAuthenticationSession(setSubject(sampleSubject)),
+				Err:     nil,
+			},
 		}
 
 		for testName, specs := range testMap {