Alternative solution for tracking unconsumed parameters

[peternied]

Description

Alternative solution for tracking unconsumed parameters

Testing

✅ ./gradlew integrationTest --tests org.opensearch.security.http.JwtAuthenticationWithUrlParamTests

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

[cwperks]

Shouldn't this method remain as getConsumedParams()? The method returns the keys that have been accessed.

[peternied]

I ran into this when thinking about the interface - I think parameters are either unconsumed and consumed; furthermore unconsumed parameters need to be consumed by something. This makes the overall design to transition parameters from accessed -> unconsumed -> consumed.

Since OpenSearchRequest has a way to consume parameters, returning an empty set is correct, whereas if it was accessed or consumed parameters it would return a list to be actioned on - which isn't needed.

I'd prefer the new name, but don't want to hold up your on this topic. What do you think about this?

[cwperks]

This makes the overall design to transition parameters from accessed -> unconsumed -> consumed

I see what you are saying. I'm getting confused since it clashes with the RestRequest object where these are referred to as consumed params, but in this case they are accessed in the header verifier, but finally consumed in the SecurityRestFilter. I wonder if we should refer to them as accessed params to avoid a naming clash, but I see what you mean now.