plugin/tsig: expose validated TSIG key identity (#8471)

Store the normalized key name in the request context only after successful TSIG verification. This lets downstream plugins distinguish unsigned requests from authenticated requests and authorize by key without relying on the stripped TSIG RR or exposing secret material.

Signed-off-by: houyuwushang <liuluoqianqiu@outlook.com>

plugin/tsig/context.go

@@ -0,0 +1,17 @@
+package tsig
+
+import "context"
+
+type validatedKeyNameKey struct{}
+
+// ValidatedKeyName returns the normalized name of the TSIG key validated by
+// the tsig plugin. The boolean is false for unsigned requests and requests the
+// plugin did not validate.
+func ValidatedKeyName(ctx context.Context) (string, bool) {
+	name, ok := ctx.Value(validatedKeyNameKey{}).(string)
+	return name, ok
+}
+
+func withValidatedKeyName(ctx context.Context, name string) context.Context {
+	return context.WithValue(ctx, validatedKeyNameKey{}, name)
+}