Test: Verify Cortex authz capabilities end-to-end (at least OPA)

[huang195]

Summary

Verify the authorization (authz) capabilities of the CPEX integration in Cortex end-to-end, covering at least OPA (Open Policy Agent).

CPEX = the ContextForge plugin framework (contextforge-org/contextforge-plugins-framework), integrated into Cortex via the CPEX plugin (#493). This issue validates that authz enforcement through CPEX-hosted policies (OPA first) works as intended.

Scope

• Validate CPEX authz enforcement end-to-end, with OPA as the first covered engine.
• Exercise allow/deny policy decisions through the pipeline.
• Ideally verify across the supported proxy modes (Go proxy / Envoy / Praxies) once the shim rearchitecture lands.

Docs to revisit / consolidate

The hook-system + CPEX-integration design proposal — docs/proposals/authbridge-hooks.md (still marked Status: Draft, ~1460 lines) — was added by the same CPEX PR (#493) that also merged the living reference docs. Now that it's implemented, revisit whether the proposal can be removed (or archived as "accepted/implemented") in favor of the living docs, to avoid drift:

• authbridge/docs/cpex-plugin.md — CPEX plugin reference (added in Feat: Add CPEX plugin #493)
• authbridge/docs/framework-architecture.md — hook / pipeline architecture
• authbridge/docs/plugin-reference.md — per-plugin config, session events, action vocabulary
• authbridge/authlib/plugins/cpex/README.md + authbridge/demos/hr-cpex/ demo

Proposal sections that appear to map onto living docs (candidates for deletion vs. archival):

• §3–5 Hook catalog / payloads / dispatch semantics → framework-architecture.md
• §6 Configuration, §7 Integration architecture (incl. §7.5 CPEX-vs-AuthBridge split) → cpex-plugin.md + plugin-reference.md
• §8 Built-in plugin migration, §10 Security invariants → plugin-reference.md / per-plugin docs

Decision to make: delete the proposal, or keep it as a historical record — at minimum flip its stale Status: Draft if it's retained.

Related

• Part of epic: Cortex Phase 1 (epic: Cortex Phase 1 rossoctl#2244)
• CPEX plugin PR (added the proposal + living docs): Feat: Add CPEX plugin #493

[araujof]

@huang195 This is on track. I will update Cortex and run the full regression once I cut the next CPEX release.

Quick updates:

• added in-process OPA support to CPEX: [FEATURE]: OPA/Rego PDP builtin (regorus) contextforge-org/cpex#137
• vault support in progress: [FEATURE]: Secret management plugin (Vault / Infisical) contextforge-org/cpex#139

[huang195]

@araujof thanks for the update. I see OPA support for CPEX issue is merged. Do we need to build a new CPEX image to test if OPA works end-to-end in Cortex? Some doc that walks through a simple OPA scenario using CPEX would be useful as part of this task. Thanks!

[araujof]

@araujof thanks for the update. I see OPA support for CPEX issue is merged. Do we need to build a new CPEX image to test if OPA works end-to-end in Cortex? Some doc that walks through a simple OPA scenario using CPEX would be useful as part of this task. Thanks!

Yes, I'm planning to cut CPEX 0.2.3 soon, then we can update Cortex, and include the OPA use case with docs.