ssh: implement authorization policy evaluation (#5665)

Implement the pkg/ssh.AuthInterface. Add logic for converting from the
ssh stream state to an evaluator request, and for interpreting the
results of policy evaluation. Refactor some of the existing authorize
logic to make it easier to reuse.

internal/authenticateflow/authenticateflow.go

@@ -5,18 +5,14 @@ package authenticateflow
 
 import (
 	"context"
-	"fmt"
 	"time"
 
 	oteltrace "go.opentelemetry.io/otel/trace"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/stats"
 	"google.golang.org/grpc/status"
-	"google.golang.org/protobuf/types/known/structpb"
 
 	"github.com/pomerium/pomerium/pkg/grpc"
-	"github.com/pomerium/pomerium/pkg/grpc/user"
-	"github.com/pomerium/pomerium/pkg/identity"
 	"github.com/pomerium/pomerium/pkg/telemetry/trace"
 )
 
@@ -25,21 +21,6 @@ var timeNow = time.Now
 
 var outboundGRPCConnection = new(grpc.CachedOutboundGRPClientConn)
 
-func populateUserFromClaims(u *user.User, claims map[string]any) {
-	if v, ok := claims["name"]; ok {
-		u.Name = fmt.Sprint(v)
-	}
-	if v, ok := claims["email"]; ok {
-		u.Email = fmt.Sprint(v)
-	}
-	if u.Claims == nil {
-		u.Claims = make(map[string]*structpb.ListValue)
-	}
-	for k, vs := range identity.Claims(claims).Flatten().ToPB() {
-		u.Claims[k] = vs
-	}
-}
-
 var outboundDatabrokerTraceClientOpts = []trace.ClientStatsHandlerOption{
 	trace.WithStatsInterceptor(ignoreNotFoundErrors),
 }

internal/authenticateflow/stateful.go

@@ -208,7 +208,7 @@ func (s *Stateful) PersistSession(
 			Id: sess.GetUserId(),
 		}
 	}
-	populateUserFromClaims(u, claims.Claims)
+	u.PopulateFromClaims(claims.Claims)
 	_, err := databroker.Put(ctx, s.dataBrokerClient, u)
 	if err != nil {
 		return fmt.Errorf("authenticate: error saving user: %w", err)

internal/authenticateflow/stateless.go

@@ -422,7 +422,7 @@ func (s *Stateless) Callback(w http.ResponseWriter, r *http.Request) error {
 	if err != nil {
 		u = &user.User{Id: ss.UserID()}
 	}
-	populateUserFromClaims(u, profile.GetClaims().AsMap())
+	u.PopulateFromClaims(profile.Claims.AsMap())
 
 	redirectURI, err := getRedirectURIFromValues(values)
 	if err != nil {