fix: fix CI failures and address review comments

- Fix trailing whitespace in t/plugin/acl.t line 877 (eclint failure)
- Fix TEST 36 error_log pattern: use eval qr// to properly escape regex
  metacharacters ([, (, )) in the expected PCRE error message
- Rename extra_values_* -> extract_values_* for clarity
- Change core.log.info -> core.log.debug for label logging to avoid
  leaking sensitive user/tenant attributes
- Only apply external_user parser/sep config for ctx.external_user,
  not ctx.consumer, to prevent consumer label matching breakage
- Fix TEST 51/52: change external_user_label_field_key to
  external_user_label_field_separator in test configs and expected
  response bodies so they actually test the separator field validation
- Fix typo in comment: 'dose' -> 'does'
- Clarify docs: external_user_label_field accepts JSONPath or plain
  field name (both English and Chinese docs)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: AlinsRan

apisix/plugins/acl.lua

@@ -92,7 +92,7 @@ local parsers = {
 }
 
 
-local function extra_values_with_parser(value, parser, sep)
+local function extract_values_with_parser(value, parser, sep)
     local values = {}
     if parser == parsers.SEGMENTED_TEXT then
         sep = "\\s*" .. sep .. "\\s*"
@@ -138,20 +138,20 @@ local function extra_values_with_parser(value, parser, sep)
 end
 
 
-local function extra_values_without_parser(value)
+local function extract_values_without_parser(value)
     local values = {}
     local typ = type(value)
 
     if typ == "table" then
-        return extra_values_with_parser(value, parsers.TABLE, "")
+        return extract_values_with_parser(value, parsers.TABLE, "")
     end
 
     if typ == "string" then
         if core.string.has_prefix(value, "[") then
-            return extra_values_with_parser(value, parsers.JSON, "")
+            return extract_values_with_parser(value, parsers.JSON, "")
         end
         if core.string.find(value, ",") then
-            return extra_values_with_parser(value, parsers.SEGMENTED_TEXT, ",")
+            return extract_values_with_parser(value, parsers.SEGMENTED_TEXT, ",")
         end
         core.log.info("the string value can not parsed by ", parsers.JSON,
                       " or ",parsers.SEGMENTED_TEXT)
@@ -166,9 +166,9 @@ end
 local function contains_value(want_values, value, parser, sep)
     local values
     if parser then
-        values = extra_values_with_parser(value, parser, sep)
+        values = extract_values_with_parser(value, parser, sep)
     else
-        values = extra_values_without_parser(value)
+        values = extract_values_without_parser(value)
     end
 
     for _, want in ipairs(want_values) do
@@ -211,6 +211,7 @@ end
 
 function _M.access(conf, ctx)
     local labels
+    local parser, sep
     if ctx.consumer then
         labels = ctx.consumer.labels
     elseif ctx.external_user then
@@ -220,14 +221,13 @@ function _M.access(conf, ctx)
         end
         local label_value = jp.value(ctx.external_user, conf.external_user_label_field)
         labels = { [label_key] = label_value }
+        parser = conf.external_user_label_field_parser
+        sep = conf.external_user_label_field_separator
     else
         return 401, { message = "Missing authentication."}
     end
 
-    core.log.info("consumer's or user's labels: ", core.json.delay_encode(labels))
-
-    local sep = conf.external_user_label_field_separator
-    local parser = conf.external_user_label_field_parser
+    core.log.debug("consumer's or user's labels: ", core.json.delay_encode(labels))
 
     if conf.deny_labels then
         if contains_label(conf.deny_labels, labels, parser, sep) then

docs/en/latest/plugins/acl.md

@@ -51,7 +51,7 @@ At least one of `allow_labels` or `deny_labels` must be configured. When both ar
 | deny_labels | object | False* | | | Labels to deny. Keys are label names, values are arrays of denied label values. At least one of `allow_labels` or `deny_labels` must be configured. |
 | rejected_code | integer | False | 403 | >= 200 | HTTP status code returned when the request is rejected. |
 | rejected_msg | string | False | | | Custom rejection message body. If not set, defaults to `{"message":"The consumer is forbidden."}`. |
-| external_user_label_field | string | False | `groups` | | JSONPath expression used to extract the label value from `ctx.external_user`. |
+| external_user_label_field | string | False | `groups` | | JSONPath expression or plain field name used to extract the label value from `ctx.external_user`. For example, `$..groups` (JSONPath) or `groups` (plain field name). |
 | external_user_label_field_key | string | False | | | The label key name used for the extracted value. Defaults to the value of `external_user_label_field`. |
 | external_user_label_field_parser | string | False | | `segmented_text`, `json`, `table` | How to parse the extracted field value. If not set, the Plugin auto-detects the format. |
 | external_user_label_field_separator | string | False | | | Separator regex for the `segmented_text` parser. Required when `external_user_label_field_parser` is `segmented_text`. |

docs/zh/latest/plugins/acl.md

@@ -51,7 +51,7 @@ description: acl 插件基于标签实现访问控制，通过检查消费者标
 | deny_labels | object | 否* | | | 拒绝的标签。键为标签名，值为拒绝的标签值数组。`allow_labels` 和 `deny_labels` 至少需配置其中一个。 |
 | rejected_code | integer | 否 | 403 | >= 200 | 请求被拒绝时返回的 HTTP 状态码。 |
 | rejected_msg | string | 否 | | | 自定义拒绝消息体。若未设置，默认返回 `{"message":"The consumer is forbidden."}`。 |
-| external_user_label_field | string | 否 | `groups` | | 用于从 `ctx.external_user` 提取标签值的 JSONPath 表达式。 |
+| external_user_label_field | string | 否 | `groups` | | 用于从 `ctx.external_user` 提取标签值的 JSONPath 表达式或普通字段名称。例如，`$..groups`（JSONPath）或 `groups`（字段名称）。 |
 | external_user_label_field_key | string | 否 | | | 提取值所使用的标签键名。默认为 `external_user_label_field` 的值。 |
 | external_user_label_field_parser | string | 否 | | `segmented_text`、`json`、`table` | 提取字段值的解析方式。若未设置，插件自动检测格式。 |
 | external_user_label_field_separator | string | 否 | | | `segmented_text` 解析器使用的分隔符（正则表达式）。当 `external_user_label_field_parser` 为 `segmented_text` 时必填。 |

t/plugin/acl.t

@@ -689,7 +689,7 @@ passed
 
 
 === TEST 30: test ACL with the invalid separator
-# User may want to split the text "cloud|infra" to be ["cloud", "infra"] by char "|", but it dose not.
+# User may want to split the text "cloud|infra" to be ["cloud", "infra"] by char "|", but it does not.
 # Because the char "|" is a regex expression, the text "cloud|infra" will be split to ['c','l','o','u','d','|','i','n','f','r','a'].
 # If you want to split text by "|" you should use "\\|".
 # This is a normal case, no error_log here.
@@ -873,8 +873,8 @@ passed
 --- request
 GET /hello
 --- error_code: 403
---- error_log
-failed to split labels [cloud,infra], err: pcre_compile() failed: missing ) in "\s*(invalid(pattern\s*" 
+--- error_log eval
+qr/failed to split labels \[cloud,infra\], err: pcre_compile\(\) failed: missing \) in/
 
 
 
@@ -1336,7 +1336,7 @@ GET /t
                               },
                               "external_user_label_field": "team",
                               "external_user_label_field_parser": "segmented_text",
-                              "external_user_label_field_key": {},
+                              "external_user_label_field_separator": {},
                               "rejected_code": 403
                             }
                         }
@@ -1353,7 +1353,7 @@ GET /t
 GET /t
 --- error_code: 400
 --- response_body
-{"error_msg":"failed to check the configuration of plugin acl err: property \"external_user_label_field_key\" validation failed: wrong type: expected string, got table"}
+{"error_msg":"failed to check the configuration of plugin acl err: property \"external_user_label_field_separator\" validation failed: wrong type: expected string, got table"}
 
 
 
@@ -1380,7 +1380,7 @@ GET /t
                               },
                               "external_user_label_field": "team",
                               "external_user_label_field_parser": "segmented_text",
-                              "external_user_label_field_key": "",
+                              "external_user_label_field_separator": "",
                               "rejected_code": 403
                             }
                         }
@@ -1397,7 +1397,7 @@ GET /t
 GET /t
 --- error_code: 400
 --- response_body
-{"error_msg":"failed to check the configuration of plugin acl err: property \"external_user_label_field_key\" validation failed: string too short, expected at least 1, got 0"}
+{"error_msg":"failed to check the configuration of plugin acl err: property \"external_user_label_field_separator\" validation failed: string too short, expected at least 1, got 0"}
 
 
 
@@ -1424,7 +1424,7 @@ GET /t
                               },
                               "external_user_label_field": "team",
                               "external_user_label_field_parser": "segmented_text",
-                              "external_user_label_field_key": {},
+                              "external_user_label_field_separator": {},
                               "rejected_code": 403
                             }
                         }
@@ -1441,7 +1441,7 @@ GET /t
 GET /t
 --- error_code: 400
 --- response_body
-{"error_msg":"failed to check the configuration of plugin acl err: property \"external_user_label_field_key\" validation failed: wrong type: expected string, got table"}
+{"error_msg":"failed to check the configuration of plugin acl err: property \"external_user_label_field_separator\" validation failed: wrong type: expected string, got table"}