config: no longer stub out HPKE public key fetch

[kenjenkins]

Summary

This partially reverts commit a138859.

Fetching the authenticate service HPKE public key is required only for the stateless authentication flow. Now that Pomerium will instead use the older (stateful) authentication flow when configured for a self-hosted authenticate service, this logic shouldn't be needed at all.

Removing this logic should also make it easier to test against a local instance of the hosted authenticate service.

Related issues

• https://github.com/pomerium/internal/issues/1628

User Explanation

Checklist

• reference any related issues
• updated docs
• updated unit tests
• updated UPGRADING.md
• add appropriate tag (improvement / bug / etc)
• ready for review

[coveralls]

coverage: 59.928% (+0.04%) from 59.891%
when pulling 762e5b3 on kenjenkins/hpke-key-fetch
into 1dbe441 on main.

[calebdoxsey]

Because the typical flow will be the stateful one, which doesn't use HPKE, this makes sense.

Merely creating the HPKE key fetcher won't initiate an HTTP request right?

[kenjenkins]

Merely creating the HPKE key fetcher won't initiate an HTTP request right?

I believe that's correct. Also, now there should be only one call to Config.GetAuthenticateKeyFetcher(), from authenticateflow.NewStateless():

pomerium/internal/authenticateflow/stateless.go

Line 129 in 1dbe441

s.authenticateKeyFetcher, err = cfg.GetAuthenticateKeyFetcher()