feat: Support resource alias translation in CONNECT message

[clement0010]

Branched out from #363

Related Tickets & Documents

• Issue: Support new upstream and downstream resource configuration in GAT token #342

Changes

Gateway should support translating the alias address in the CONNECT message to the upstream address alongside the existing downstream→upstream port mapping.

It should also validate that the CONNECT address must match the token's resource.address (exact or wildcard) or its resource.alias (exact match).

A GAT carrying an alias for a wildcard address is rejected at token validation, so an alias always maps to a concrete upstream address.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 86.22%. Comparing base (d8e3172) to head (5db3e5b).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@                          Coverage Diff                           @@
##           fix/verify-connect-downstream-port     #382      +/-   ##
======================================================================
- Coverage                               86.26%   86.22%   -0.04%     
======================================================================
  Files                                      40       40              
  Lines                                    2853     2861       +8     
======================================================================
+ Hits                                     2461     2467       +6     
- Misses                                    265      269       +4     
+ Partials                                  127      125       -2     

Flag	Coverage Δ
integration	54.57% <31.57%> (-0.16%)	⬇️
unit	78.78% <100.00%> (+0.09%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
internal/connect/connect.go	98.19% <100.00%> (+4.74%)	⬆️
internal/token/gat_claims.go	100.00% <100.00%> (ø)

... and 2 files with indirect coverage changes

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Copilot]

Pull request overview

This PR extends CONNECT destination validation and upstream resolution to support per-resource alias translation, so clients can CONNECT to a resource alias while the Gateway dials the underlying resource address (in addition to the existing downstream→upstream port rewrite).

Changes:

• Adds resource.alias to GAT token claims.
• Moves CONNECT host validation into resolveUpstreamAddress, allowing either resource.address (exact/wildcard) or resource.alias (exact) and performing alias→address translation.
• Updates/expands unit tests to cover alias rewriting and new validation behavior.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
internal/token/gat_claims.go	Adds Alias field to Resource claims for controller-provided alias support.
internal/connect/connect.go	Validates CONNECT host against resource address/alias and rewrites alias host to upstream address while preserving downstream→upstream port mapping.
internal/connect/connect_test.go	Updates existing expectations and adds coverage for alias rewriting and the new resolver signature.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.