[ProtoApiScrubber] Add support for enum types (#42199)

Signed-off-by: Sumit Kumar <[email protected]>

Author: sumitkmr2

source/extensions/filters/http/proto_api_scrubber/filter_config.cc

@@ -270,6 +270,23 @@ absl::Status ProtoApiScrubberFilterConfig::initializeMethodFieldRestrictions(
   return absl::OkStatus();
 }
 
+absl::StatusOr<absl::string_view>
+ProtoApiScrubberFilterConfig::getEnumName(absl::string_view enum_type_name, int enum_value) const {
+  const auto* enum_desc = descriptor_pool_->FindEnumTypeByName(std::string(enum_type_name));
+  if (enum_desc == nullptr) {
+    return absl::NotFoundError(
+        absl::StrCat("Enum type '", enum_type_name, "' not found in descriptor pool."));
+  }
+
+  const auto* enum_value_desc = enum_desc->FindValueByNumber(enum_value);
+  if (enum_value_desc == nullptr) {
+    return absl::NotFoundError(absl::StrCat("Enum value '", enum_value,
+                                            "' not found in enum type '", enum_type_name, "'."));
+  }
+
+  return enum_value_desc->name();
+}
+
 MatchTreeHttpMatchingDataSharedPtr
 ProtoApiScrubberFilterConfig::getRequestFieldMatcher(const std::string& method_name,
                                                      const std::string& field_mask) const {

source/extensions/filters/http/proto_api_scrubber/filter_config.h

@@ -107,6 +107,17 @@ class ProtoApiScrubberFilterConfig : public Logger::Loggable<Logger::Id::filter>
   virtual MatchTreeHttpMatchingDataSharedPtr
   getMessageMatcher(const std::string& message_name) const;
 
+  /**
+   * Resolves the human-readable name of a specific enum value.
+   *
+   * @param enum_type_name The fully qualified name of the enum type (e.g., "package.Status").
+   * @param enum_value The integer value of the enum (e.g., 99).
+   * @return The string name of the enum value (e.g., "DEBUG_MODE").
+   * Returns empty string if the type or value is not found.
+   */
+  virtual absl::StatusOr<absl::string_view> getEnumName(absl::string_view enum_type_name,
+                                                        int enum_value) const;
+
   // Returns a constant reference to the type finder which resolves type URL string to the
   // corresponding `Protobuf::Type*`.
   const TypeFinder& getTypeFinder() const { return *type_finder_; };

source/extensions/filters/http/proto_api_scrubber/scrubbing_util_lib/BUILD

@@ -18,6 +18,7 @@ envoy_cc_library(
     ],
     deps = [
         "//source/common/common:minimal_logger_lib",
+        "//source/common/grpc:common_lib",
         "//source/common/http/matching:data_impl_lib",
         "//source/common/protobuf",
         "//source/extensions/filters/http/proto_api_scrubber:filter_config",

source/extensions/filters/http/proto_api_scrubber/scrubbing_util_lib/field_checker.cc

@@ -1,9 +1,13 @@
 #include "source/extensions/filters/http/proto_api_scrubber/scrubbing_util_lib/field_checker.h"
 
+#include "source/common/grpc/common.h"
 #include "source/common/http/matching/data_impl.h"
 #include "source/common/protobuf/protobuf.h"
+#include "source/common/protobuf/utility.h"
 #include "source/extensions/filters/http/proto_api_scrubber/filter_config.h"
 
+#include "absl/strings/numbers.h"
+#include "absl/strings/str_cat.h"
 #include "absl/strings/str_join.h"
 #include "proto_processing_lib/proto_scrubber/field_checker_interface.h"
 
@@ -12,9 +16,56 @@ namespace Extensions {
 namespace HttpFilters {
 namespace ProtoApiScrubber {
 
+absl::StatusOr<absl::string_view>
+FieldChecker::resolveEnumName(absl::string_view value_str, const Protobuf::Field* field) const {
+  int enum_number;
+  if (!absl::SimpleAtoi(value_str, &enum_number)) {
+    return absl::InvalidArgumentError(
+        absl::StrCat("Enum value '", value_str, "' is not a valid integer."));
+  }
+
+  // Extract Type Name from URL "type.googleapis.com/package.Name"
+  absl::string_view type_name = Envoy::TypeUtil::typeUrlToDescriptorFullName(field->type_url());
+
+  // Return the corresponding enum name.
+  return filter_config_ptr_->getEnumName(type_name, enum_number);
+}
+
+std::string FieldChecker::constructFieldMask(const std::vector<std::string>& path,
+                                             const Protobuf::Field* field) const {
+  if (path.empty()) {
+    return "";
+  }
+
+  // Translate the last segment of the `path` wherever required.
+  absl::string_view last_segment = path.back();
+  switch (field->kind()) {
+  case Protobuf::Field::TYPE_ENUM: {
+    if (auto name_or_status = resolveEnumName(last_segment, field);
+        name_or_status.ok() && !name_or_status.value().empty()) {
+      last_segment = name_or_status.value();
+    } else {
+      ENVOY_LOG(warn, "Enum translation skipped for value '{}': {}", last_segment,
+                name_or_status.status().ToString());
+    }
+  } break;
+
+  default:
+    break;
+  }
+
+  // If path has only 1 segment, just return it (translated or original).
+  if (path.size() == 1) {
+    return std::string(last_segment);
+  }
+
+  // Join all segments except the last one, then append the (potentially translated) last segment.
+  return absl::StrCat(absl::StrJoin(path.begin(), path.end() - 1, "."), ".", last_segment);
+}
+
 FieldCheckResults FieldChecker::CheckField(const std::vector<std::string>& path,
                                            const Protobuf::Field* field) const {
-  const std::string field_mask = absl::StrJoin(path, ".");
+  const std::string field_mask = constructFieldMask(path, field);
 
   MatchTreeHttpMatchingDataSharedPtr match_tree;
 
@@ -58,7 +109,7 @@ FieldCheckResults FieldChecker::CheckField(const std::vector<std::string>& path,
 }
 
 FieldCheckResults FieldChecker::matchResultStatusToFieldCheckResult(
-    absl::StatusOr<Matcher::MatchResult>& match_result, const std::string& field_mask) const {
+    absl::StatusOr<Matcher::MatchResult>& match_result, absl::string_view field_mask) const {
   // Preserve the field (i.e., kInclude) if there's any error in evaluating the match.
   // This can happen in two cases:
   // 1. The match tree is corrupt.

source/extensions/filters/http/proto_api_scrubber/scrubbing_util_lib/field_checker.h

@@ -79,7 +79,17 @@ class FieldChecker : public FieldCheckerInterface, public Logger::Loggable<Logge
 
   FieldCheckResults
   matchResultStatusToFieldCheckResult(absl::StatusOr<Matcher::MatchResult>& match_result,
-                                      const std::string& field_mask) const;
+                                      absl::string_view field_mask) const;
+
+  // Resolves the string name of an Enum value.
+  absl::StatusOr<absl::string_view> resolveEnumName(absl::string_view value_str,
+                                                    const Protobuf::Field* field) const;
+
+  // Constructs the field mask, handling translations for different data types.
+  // Currently, it only handles enum data type. Support for protobuf maps and `Any` types will be
+  // added in the future.
+  std::string constructFieldMask(const std::vector<std::string>& path,
+                                 const Protobuf::Field* field) const;
 
   ScrubberContext scrubber_context_;
   Http::Matching::HttpMatchingDataImpl matching_data_;

test/extensions/filters/http/proto_api_scrubber/filter_config_test.cc

@@ -459,6 +459,33 @@ class ProtoApiScrubberFilterConfigTest : public ::testing::Test {
     return proto_config;
   }
 
+  // Helper to create a serialized FileDescriptorSet containing a specific Enum.
+  // Defines: enum test.TestEnum { UNKNOWN = 0; ACTIVE = 1; }
+  std::string createDescriptorWithTestEnum() {
+    Protobuf::FileDescriptorProto file_proto;
+    file_proto.set_name("test_enum.proto");
+    file_proto.set_package("test");
+    file_proto.set_syntax("proto3");
+
+    auto* enum_type = file_proto.add_enum_type();
+    enum_type->set_name("TestEnum");
+
+    auto* val0 = enum_type->add_value();
+    val0->set_name("UNKNOWN");
+    val0->set_number(0);
+
+    auto* val1 = enum_type->add_value();
+    val1->set_name("ACTIVE");
+    val1->set_number(1);
+
+    Envoy::Protobuf::FileDescriptorSet descriptor_set;
+    descriptor_set.add_file()->CopyFrom(file_proto);
+
+    std::string descriptor_bytes;
+    descriptor_set.SerializeToString(&descriptor_bytes);
+    return descriptor_bytes;
+  }
+
   Api::ApiPtr api_;
   ProtoApiScrubberConfig proto_config_;
   std::shared_ptr<const ProtoApiScrubberFilterConfig> filter_config_;
@@ -989,6 +1016,49 @@ TEST_F(ProtoApiScrubberFilterConfigTest, GetResponseType) {
   }
 }
 
+TEST_F(ProtoApiScrubberFilterConfigTest, GetEnumName) {
+  // Setup Config with the custom Enum descriptor
+  ProtoApiScrubberConfig config;
+  *config.mutable_descriptor_set()->mutable_data_source()->mutable_inline_bytes() =
+      createDescriptorWithTestEnum();
+
+  // Initialize filter config.
+  auto filter_config_or_status = ProtoApiScrubberFilterConfig::create(config, factory_context_);
+  ASSERT_THAT(filter_config_or_status, IsOk());
+  auto filter_config = filter_config_or_status.value();
+
+  {
+    // Case 1.1: Valid Lookup (Type and Value exist)
+    auto result = filter_config->getEnumName("test.TestEnum", 1);
+    ASSERT_THAT(result, IsOk());
+    EXPECT_EQ(result.value(), "ACTIVE");
+  }
+
+  {
+    // Case 1.2: Valid Lookup (Type and Value exist)
+    auto result = filter_config->getEnumName("test.TestEnum", 0);
+    ASSERT_THAT(result, IsOk());
+    EXPECT_EQ(result.value(), "UNKNOWN");
+  }
+
+  {
+    // Case 2: Invalid Value (Type exists, Value does not)
+    auto result = filter_config->getEnumName("test.TestEnum", 999);
+    EXPECT_THAT(result,
+                HasStatus(absl::StatusCode::kNotFound,
+                          HasSubstr("Enum value '999' not found in enum type 'test.TestEnum'")));
+  }
+
+  {
+    // Case 3: Invalid Type Name (Type does not exist)
+    auto result = filter_config->getEnumName("test.NonExistentEnum", 1);
+    EXPECT_THAT(
+        result,
+        HasStatus(absl::StatusCode::kNotFound,
+                  HasSubstr("Enum type 'test.NonExistentEnum' not found in descriptor pool")));
+  }
+}
+
 TEST_F(ProtoApiScrubberFilterConfigTest, GetTypeFinder) {
   absl::StatusOr<std::shared_ptr<const ProtoApiScrubberFilterConfig>> config_or_status =
       ProtoApiScrubberFilterConfig::create(proto_config_, factory_context_);