v0.30.0
New: GCP Auth Stubbing
When gcp_auth is active, the proxy now intercepts requests to GCP OAuth2 token endpoints (oauth2.googleapis.com/token and the GCE/GKE metadata server) and answers them with a synthetic stub token. Clients complete the OAuth2 handshake against the proxy without needing real credentials. The proxy mints the real access token from the keyfile it holds and injects it on the upstream API call. Stubbing is always-on whenever gcp_auth is configured, independent of the transform's host rules.
This adds a new ActionStub pipeline action. It short-circuits the request pipeline similarly to ActionReject, but renders as "stub" at INFO level in audit logs (with a stubbed_by field) so you can distinguish proxy-served responses from rejections.