feat: add external authorization service (authzd) with JWT authentication

- Add new authzd gRPC service implementing Envoy's external authorization API
- Integrate JWT authentication filter in Envoy configuration with claim extraction
- Update middleware to support both cookie-based and header-based user authentication
- Add comprehensive test coverage for authorization service and server
- Configure proper service orchestration with authzd, sparkled, and Envoy
- Update build system and Docker configuration for multi-service deployment
- Add grpcurl tool for gRPC service debugging and testing

This enables fine-grained authorization control through Envoy's ext_authz filter
while maintaining backward compatibility with existing cookie-based authentication.

1 files changed, 12 insertions, 6 deletions

diff --git a/app/app.go b/app/app.go
index 5bcc69a..c6f1c11 100644
--- a/app/app.go
+++ b/app/app.go
@@ -8,6 +8,7 @@ import (
 	"github.com/rs/zerolog"
 	"github.com/xlgmokha/x/pkg/ioc"
 	"github.com/xlgmokha/x/pkg/log"
+	"github.com/xlgmokha/x/pkg/x"
 	"gitlab.com/gitlab-org/software-supply-chain-security/authorization/sparkled/app/cfg"
 	"gitlab.com/gitlab-org/software-supply-chain-security/authorization/sparkled/app/controllers/dashboard"
 	"gitlab.com/gitlab-org/software-supply-chain-security/authorization/sparkled/app/controllers/sparkles"
@@ -35,10 +36,15 @@ func New(rootDir string) http.Handler {
 
 	logger := ioc.MustResolve[*zerolog.Logger](ioc.Default)
 	users := ioc.MustResolve[domain.Repository[*domain.User]](ioc.Default)
-	chain := middleware.IDToken(
-		ioc.MustResolve[*oidc.Provider](ioc.Default),
-		ioc.MustResolve[*oidc.Config](ioc.Default),
-		middleware.FromCookie(cfg.IDTokenCookie),
-	)(middleware.User(users)(mux))
-	return log.HTTP(logger)(chain)
+
+	return x.Middleware[http.Handler](
+		mux,
+		log.HTTP(logger),
+		middleware.IDToken(
+			ioc.MustResolve[*oidc.Provider](ioc.Default),
+			ioc.MustResolve[*oidc.Config](ioc.Default),
+			middleware.FromCookie(cfg.IDTokenCookie),
+		),
+		middleware.User(users),
+	)
 }