grpc: refresh trusted headers from continuous auth responses

[matthewdarwin]

With continuous=true, the grpc plugin calls Authenticate again on every interval, but it only looks at the error. The response is discarded, so a stream's trusted headers are whatever the first call returned.

If that first call returns an empty success, the stream keeps no x-user-id/x-meta for its whole lifetime, even after later continuous calls return the full headers. An authenticator answers with an empty success when it chooses to fail open, for example a local sidecar that cannot reach its own upstream within its deadline. Metering then emits events without identity until the client disconnects. On long-lived Substreams/Firehose streams that can be hours of usage.

Change

• continuousAuth merges each response's headers into the stream's trusted headers. Keys are added or updated, never removed. An empty response is a no-op, and an unchanged one skips the swap.
• The headers are stored in an atomic.Pointer holder on the context. The new ReplaceTrustedHeaders(ctx, h) swaps them, and FromContext returns the current snapshot. Metering reads the headers concurrently with the refresh, so the map is not mutated in place.
• FromContext's signature and return type are unchanged. Callers that copy values once at stream start keep the old values; to pick up refreshed headers they need to read them per event. Firehose already does this (firehose/server/server.go); Substreams tier1 does not, see the linked PR.

No extra calls: the continuous requests already happen; only their responses are now used.

Tests

• TestReplaceTrustedHeaders: derived contexts see the replacement, and earlier snapshots are unchanged.
• TestAuthenticatorPlugin_ContinuousAuthenticate_RefreshesHeaders: the first call returns empty and the second returns headers, which then appear on the context. Later empty responses do not remove them. The test reads concurrently with the refresh.
• go test -race -count=50 ./ ./grpc/ passes. middleware/connect's Test_validAuth is flaky on develop without this change (it fails intermittently with "987" != "123").

🤖 Generated with Claude Code