Refactor mTLS route options to RFC-0027 compliant flat format

RFC-0027 requires options values to be only strings, numbers, or
booleans - not nested objects/arrays. Updated:

- RegistryMessageOpts: Use flat fields (mtls_allowed_apps,
  mtls_allowed_spaces, mtls_allowed_orgs, mtls_allow_any) with
  comma-separated GUIDs instead of nested MtlsAllowedSources struct

- parseCommaSeparatedGUIDs(): New helper to split comma-separated
  GUID strings into slices

- getEffectiveMtlsAllowedSources(): Parse flat options from Options
  struct while maintaining top-level MtlsAllowedSources precedence
  for route-registrar compatibility

- Tests: Updated to verify flat options parsing

Author: rkoster

src/code.cloudfoundry.org/gorouter/mbus/registry_message_test.go

@@ -100,7 +100,7 @@ var _ = Describe("RegistryMessage", func() {
 			})
 		})
 
-		Describe("With mtls_allowed_sources nested in options (CAPI/Diego format)", func() {
+		Describe("With flat mTLS options in options (RFC-0027 compliant CAPI/Diego format)", func() {
 			BeforeEach(func() {
 				payload = []byte(`{
 					"app":"app1",
@@ -111,24 +111,26 @@ var _ = Describe("RegistryMessage", func() {
 					"private_instance_id":"private_instance_id",
 					"options": {
 						"loadbalancing": "round-robin",
-						"mtls_allowed_sources": {
-							"apps": ["nested-app-guid"],
-							"any": true
-						}
+						"mtls_allowed_apps": "app-guid-1,app-guid-2",
+						"mtls_allowed_spaces": "space-guid-1",
+						"mtls_allowed_orgs": "org-guid-1",
+						"mtls_allow_any": true
 					}
 				}`)
 			})
 
-			It("parses nested mtls_allowed_sources correctly", func() {
+			It("parses flat mTLS options correctly", func() {
 				endpoint, err := message.MakeEndpoint(false)
 				Expect(err).NotTo(HaveOccurred())
 				Expect(endpoint.MtlsAllowedSources).NotTo(BeNil())
-				Expect(endpoint.MtlsAllowedSources.Apps).To(ConsistOf("nested-app-guid"))
+				Expect(endpoint.MtlsAllowedSources.Apps).To(ConsistOf("app-guid-1", "app-guid-2"))
+				Expect(endpoint.MtlsAllowedSources.Spaces).To(ConsistOf("space-guid-1"))
+				Expect(endpoint.MtlsAllowedSources.Orgs).To(ConsistOf("org-guid-1"))
 				Expect(endpoint.MtlsAllowedSources.Any).To(BeTrue())
 			})
 		})
 
-		Describe("With mtls_allowed_sources at both top-level and nested", func() {
+		Describe("With mtls_allowed_sources at top-level and flat options", func() {
 			BeforeEach(func() {
 				payload = []byte(`{
 					"app":"app1",
@@ -141,9 +143,7 @@ var _ = Describe("RegistryMessage", func() {
 						"apps": ["top-level-app"]
 					},
 					"options": {
-						"mtls_allowed_sources": {
-							"apps": ["nested-app"]
-						}
+						"mtls_allowed_apps": "flat-options-app"
 					}
 				}`)
 			})

src/code.cloudfoundry.org/gorouter/mbus/subscriber.go

@@ -42,10 +42,14 @@ type RegistryMessage struct {
 }
 
 type RegistryMessageOpts struct {
-	LoadBalancingAlgorithm string              `json:"loadbalancing"`
-	HashHeaderName         string              `json:"hash_header"`
-	HashBalance            float64             `json:"hash_balance"`
-	MtlsAllowedSources     *MtlsAllowedSources `json:"mtls_allowed_sources,omitempty"`
+	LoadBalancingAlgorithm string  `json:"loadbalancing"`
+	HashHeaderName         string  `json:"hash_header"`
+	HashBalance            float64 `json:"hash_balance"`
+	// RFC-0027 compliant flat mTLS options (comma-separated GUIDs)
+	MtlsAllowedApps   string `json:"mtls_allowed_apps,omitempty"`
+	MtlsAllowedSpaces string `json:"mtls_allowed_spaces,omitempty"`
+	MtlsAllowedOrgs   string `json:"mtls_allowed_orgs,omitempty"`
+	MtlsAllowAny      bool   `json:"mtls_allow_any,omitempty"`
 }
 
 // MtlsAllowedSources contains authorization rules for which sources can communicate
@@ -59,6 +63,25 @@ type MtlsAllowedSources struct {
 	Any    bool     `json:"any,omitempty"`
 }
 
+// parseCommaSeparatedGUIDs splits a comma-separated string into a slice of GUIDs
+func parseCommaSeparatedGUIDs(s string) []string {
+	if s == "" {
+		return nil
+	}
+	parts := strings.Split(s, ",")
+	result := make([]string, 0, len(parts))
+	for _, p := range parts {
+		trimmed := strings.TrimSpace(p)
+		if trimmed != "" {
+			result = append(result, trimmed)
+		}
+	}
+	if len(result) == 0 {
+		return nil
+	}
+	return result
+}
+
 // getMtlsAllowedSources returns the MtlsAllowedSources, or nil if not present
 func getMtlsAllowedSources(as *MtlsAllowedSources) *route.MtlsAllowedSources {
 	if as == nil {
@@ -72,18 +95,30 @@ func getMtlsAllowedSources(as *MtlsAllowedSources) *route.MtlsAllowedSources {
 	}
 }
 
-// getEffectiveMtlsAllowedSources returns MtlsAllowedSources from either top-level or nested in options.
-// Top-level takes precedence (used by route-registrar), nested is used by CAPI/Diego.
+// getEffectiveMtlsAllowedSources returns MtlsAllowedSources from either top-level or flat options.
+// Top-level takes precedence (used by route-registrar), flat options are RFC-0027 compliant (used by CAPI/Diego).
 func (rm *RegistryMessage) getEffectiveMtlsAllowedSources() *route.MtlsAllowedSources {
 	// Top-level mtls_allowed_sources takes precedence (route-registrar uses this)
 	if rm.MtlsAllowedSources != nil {
 		return getMtlsAllowedSources(rm.MtlsAllowedSources)
 	}
-	// Fall back to options.mtls_allowed_sources (CAPI/Diego uses this)
-	if rm.Options.MtlsAllowedSources != nil {
-		return getMtlsAllowedSources(rm.Options.MtlsAllowedSources)
+	// Fall back to RFC-0027 compliant flat options
+	apps := parseCommaSeparatedGUIDs(rm.Options.MtlsAllowedApps)
+	spaces := parseCommaSeparatedGUIDs(rm.Options.MtlsAllowedSpaces)
+	orgs := parseCommaSeparatedGUIDs(rm.Options.MtlsAllowedOrgs)
+	allowAny := rm.Options.MtlsAllowAny
+
+	// If no mTLS options are set, return nil
+	if apps == nil && spaces == nil && orgs == nil && !allowAny {
+		return nil
+	}
+
+	return &route.MtlsAllowedSources{
+		Apps:   apps,
+		Spaces: spaces,
+		Orgs:   orgs,
+		Any:    allowAny,
 	}
-	return nil
 }
 
 func (rm *RegistryMessage) MakeEndpoint(http2Enabled bool) (*route.Endpoint, error) {