Redirect response_code setting does not behave as documented

[kenjenkins]

What happened?

Adding a route with response_code: 302 (or any other HTTP status code) in the redirect option results in an error:

{"level":"error","service":"envoy","name":"config","time":"2024-01-09T14:08:19-08:00","message":"delta config for type.googleapis.com/envoy.config.route.v3.RouteConfiguration rejected: Proto constraint validation failed (RouteConfigurationValidationError.VirtualHosts[4]: embedded message failed validation | caused by VirtualHostValidationError.Routes[7]: embedded message failed validation | caused by RouteValidationError.Redirect: embedded message failed validation | caused by RedirectActionValidationError.ResponseCode: value must be one of the defined enum values): [...]

What did you expect to happen?

According to https://www.pomerium.com/docs/reference/routes/redirect#redirect-options the response_code option accepts an HTTP response code (based on "Defaults to 301."). I would expect response_code: 302 to serve redirects with the status 302 Found.

Additional context

It looks like the response_code value is being interpreted directly as an Envoy RedirectResponseCode proto enum value:

pomerium/config/envoyconfig/routes.go

Line 378 in e6ed4d5

action.ResponseCode = envoy_config_route_v3.RedirectAction_RedirectResponseCode(*r.ResponseCode)

So to achieve a 302 Found status, currently a route would need to be configured with response_code: 1.

I assume instead we ought to check whether the provided integer matches one of 301, 302, 303, 307, 308 and translate to the matching enum value? Unless we want to support the enum value names as well (or instead)?

Either way, I think we'll need to update the documentation to reflect that only these specific HTTP response codes are supported.