You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@dubbo.apache.org by "dubbo-go-bot (via GitHub)" <gi...@apache.org> on 2025/12/01 08:46:42 UTC
[PR] Feature/support opa server [dubbo-go-pixiu]
dubbo-go-bot opened a new pull request, #822:
URL: https://github.com/apache/dubbo-go-pixiu/pull/822
## 🔄 Upstream Sync from Community Fork
This PR automatically syncs changes from the community fork to the upstream repository.
### Original Contribution
- **Author**: @nanjiek
- **Original PR**: https://github.com/dubbo-go-pixiu/dubbo-go-pixiu/pull/43
- **Merged at**: 2025-12-01 08:46:37 UTC
### Original PR Description
---
### **User description**
just for solve conflict
___
### **PR Type**
Enhancement, Bug fix
___
### **Description**
- Add OPA server mode support via HTTP REST API for centralized policy management
- Implement deep copy methods across multiple filters to prevent pointer sharing issues
- Support multiple OPA response formats (boolean, object with allow/result fields)
- Add comprehensive test coverage for server mode, embedded mode, and error handling
- Update documentation with server mode deployment, configuration, and troubleshooting guides
___
### Diagram Walkthrough
```mermaid
flowchart LR
A["OPA Filter"] -->|"Server Mode"| B["HTTP Client"]
B -->|"REST API"| C["OPA Server"]
A -->|"Embedded Mode"| D["Rego Engine"]
E["Multiple Filters"] -->|"Deep Copy Config"| F["Prevent Pointer Sharing"]
G["Response Parser"] -->|"Extract Decision"| H["Boolean/Object Formats"]
```
<details> <summary><h3> File Walkthrough</h3></summary>
<table><thead><tr><th></th><th align="left">Relevant files</th></tr></thead><tbody><tr><td><strong>Enhancement</strong></td><td><details><summary>1 files</summary><table>
<tr>
<td><strong>opa.go</strong><dd><code>Add OPA server mode and deep copy support</code> </dd></td>
<td><a href="https://github.com/dubbo-go-pixiu/dubbo-go-pixiu/pull/43/files#diff-5b789793cfea943bad81711cce2959ed8becead5621ee75745161351742d21d3">+238/-31</a></td>
</tr>
</table></details></td></tr><tr><td><strong>Tests</strong></td><td><details><summary>1 files</summary><table>
<tr>
<td><strong>opa_test.go</strong><dd><code>Add comprehensive tests for server and embedded modes</code> </dd></td>
<td><a href="https://github.com/dubbo-go-pixiu/dubbo-go-pixiu/pull/43/files#diff-0d39e378c6d83b528da9de8bc4addb6d0e8edd912f31578f77c94bf8478c5c1a">+455/-5</a> </td>
</tr>
</table></details></td></tr><tr><td><strong>Bug fix</strong></td><td><details><summary>19 files</summary><table>
<tr>
<td><strong>access_log.go</strong><dd><code>Implement shallow copy for config pointer safety</code> </dd></td>
<td><a href="https://github.com/dubbo-go-pixiu/dubbo-go-pixiu/pull/43/files#diff-b593889e66507bca7bf77c790281875ef34e39c37b78d0abf1c65039417d7694">+3/-1</a> </td>
</tr>
<tr>
<td><strong>jwt.go</strong><dd><code>Add deep copy method for JWT config structures</code> </dd></td>
<td><a href="https://github.com/dubbo-go-pixiu/dubbo-go-pixiu/pull/43/files#diff-94f0a5f3934665494c8cc2084f743961056a15d9b3e574962380b8d187045d6a">+65/-1</a> </td>
</tr>
<tr>
<td><strong>authority.go</strong><dd><code>Implement deep copy for authority config</code> </dd></td>
<td><a href="https://github.com/dubbo-go-pixiu/dubbo-go-pixiu/pull/43/files#diff-24dc3b9f1ddc8f7e0e589453bbd92b2ad8cbf6ba5dad3995064a5fec6e592f83">+2/-1</a> </td>
</tr>
<tr>
<td><strong>config.go</strong><dd><code>Add deep copy methods for authority rules</code> </dd></td>
<td><a href="https://github.com/dubbo-go-pixiu/dubbo-go-pixiu/pull/43/files#diff-95aba67c036186f1804a1c5f76d51089ad04885f394c9bf22bf31937134a0b93">+40/-0</a> </td>
</tr>
<tr>
<td><strong>cors.go</strong><dd><code>Add deep copy for CORS config with allow origins</code> </dd></td>
<td><a href="https://github.com/dubbo-go-pixiu/dubbo-go-pixiu/pull/43/files#diff-513170ba9d3e7b372b5e78bd25644de9a2c0644de78371c998e647f7de3b177c">+21/-1</a> </td>
</tr>
<tr>
<td><strong>csrf.go</strong><dd><code>Add deep copy for CSRF config with ignore methods</code> </dd></td>
<td><a href="https://github.com/dubbo-go-pixiu/dubbo-go-pixiu/pull/43/files#diff-dd67f7422864aa50fb32280176cc47f78a036eeefc67e9e9adcf60eda2038f66">+21/-1</a> </td>
</tr>
<tr>
<td><strong>event.go</strong><dd><code>Implement shallow copy for event filter config</code> </dd></td>
<td><a href="https://github.com/dubbo-go-pixiu/dubbo-go-pixiu/pull/43/files#diff-f11635b1b152b09b8cb86259dc902c41a9c4300cc6747c80de4645a4f257a981">+3/-1</a> </td>
</tr>
<tr>
<td><strong>filter.go</strong><dd><code>Add deep copy for failinject config with rules map</code> </dd></td>
<td><a href="https://github.com/dubbo-go-pixiu/dubbo-go-pixiu/pull/43/files#diff-49159bfa8ccc138025927a77935ce119526d71e94c4396bca34e92ecda9252bc">+28/-1</a> </td>
</tr>
<tr>
<td><strong>header.go</strong><dd><code>Initialize config and implement shallow copy</code> </dd></td>
<td><a href="https://github.com/dubbo-go-pixiu/dubbo-go-pixiu/pull/43/files#diff-d97d7d350a095146818c015a2bc06cb5ed9626ffa4dd701b0c2c9b446c3869d6">+4/-2</a> </td>
</tr>
<tr>
<td><strong>host.go</strong><dd><code>Initialize config and implement shallow copy</code> </dd></td>
<td><a href="https://github.com/dubbo-go-pixiu/dubbo-go-pixiu/pull/43/files#diff-f3ee435b0603f86cdbf96e6838bd16fba990a1e85f0b4160605340a263f0cbb5">+4/-2</a> </td>
</tr>
<tr>
<td><strong>grpc.go</strong><dd><code>Add deep copy for gRPC proxy config with rules</code> </dd></td>
<td><a href="https://github.com/dubbo-go-pixiu/dubbo-go-pixiu/pull/43/files#diff-ddb337191d25183c0a03323062876cf94c374c17167f3f1dcea1ebf08bf77837">+33/-1</a> </td>
</tr>
<tr>
<td><strong>loadbalancer.go</strong><dd><code>Implement shallow copy for loadbalancer config</code> </dd></td>
<td><a href="https://github.com/dubbo-go-pixiu/dubbo-go-pixiu/pull/43/files#diff-d5d99014f6c7294c57ebdf00ad5d609394b6e1bcd383bdf0a4ffa007025cbf78">+3/-1</a> </td>
</tr>
<tr>
<td><strong>tokenizer.go</strong><dd><code>Implement shallow copy for tokenizer config</code> </dd></td>
<td><a href="https://github.com/dubbo-go-pixiu/dubbo-go-pixiu/pull/43/files#diff-dd40584eaee67e6efb5692dc3588230de7da9d5afc8294761b4bf6e7da27732c">+3/-1</a> </td>
</tr>
<tr>
<td><strong>filter.go</strong><dd><code>Add deep copy for MCP server config</code> </dd></td>
<td><a href="https://github.com/dubbo-go-pixiu/dubbo-go-pixiu/pull/43/files#diff-43bef22a883f33fd267afc7e46cb83e95625298996531f7e692cbaa0e6d51167">+2/-1</a> </td>
</tr>
<tr>
<td><strong>metric.go</strong><dd><code>Implement shallow copy for prometheus config</code> </dd></td>
<td><a href="https://github.com/dubbo-go-pixiu/dubbo-go-pixiu/pull/43/files#diff-4ddc37c3dfcb2672088ad1c7d5cd28bdc6c392766d52cffb34fc81d05161b8af">+3/-1</a> </td>
</tr>
<tr>
<td><strong>circuit_breaker.go</strong><dd><code>Add deep copy for circuit breaker config</code> </dd></td>
<td><a href="https://github.com/dubbo-go-pixiu/dubbo-go-pixiu/pull/43/files#diff-0a8f3440b2de2439217b0ca5763b0cde0feaefc3c870c5c1a5e6bd487556c04f">+32/-1</a> </td>
</tr>
<tr>
<td><strong>config.go</strong><dd><code>Add deep copy method for sentinel resources</code> </dd></td>
<td><a href="https://github.com/dubbo-go-pixiu/dubbo-go-pixiu/pull/43/files#diff-0b3eb9e85cd4332ccd14026d52fa55d367cbc0d77c81acd86a8468f8f0784361">+19/-0</a> </td>
</tr>
<tr>
<td><strong>rate_limit.go</strong><dd><code>Add deep copy for rate limit config</code> </dd></td>
<td><a href="https://github.com/dubbo-go-pixiu/dubbo-go-pixiu/pull/43/files#diff-02c0cf9813c0fc6b6b418900365ab3d71474b738dceb4e9e600ce22662b0a79d">+31/-1</a> </td>
</tr>
<tr>
<td><strong>mcpserver.go</strong><dd><code>Add deep copy methods for MCP server model structures</code> </dd></td>
<td><a href="https://github.com/dubbo-go-pixiu/dubbo-go-pixiu/pull/43/files#diff-848d0481f0a6483d2b9230f5df804d03f302e12cbc5f4e650ea1bc79a8660488">+184/-0</a> </td>
</tr>
</table></details></td></tr><tr><td><strong>Documentation</strong></td><td><details><summary>2 files</summary><table>
<tr>
<td><strong>opa.md</strong><dd><code>Document OPA server mode and deployment guide</code> </dd></td>
<td><a href="https://github.com/dubbo-go-pixiu/dubbo-go-pixiu/pull/43/files#diff-39aa0f3e321ddcd2fbd994721131b133d80f74024db52ac8904f30122067c358">+300/-16</a></td>
</tr>
<tr>
<td><strong>opa_CN.md</strong><dd><code>Add Chinese documentation for OPA server mode</code> </dd></td>
<td><a href="https://github.com/dubbo-go-pixiu/dubbo-go-pixiu/pull/43/files#diff-46133a593160ee81110a9341b2b0ca956a2eb7463c69620f42dc12c5b7282b6f">+299/-15</a></td>
</tr>
</table></details></td></tr></tr></tbody></table>
</details>
___
<!-- This is an auto-generated comment: release notes by coderabbit.ai -->
## Summary by CodeRabbit
* **New Features**
* OPA filter now supports dual operational modes: Server Mode (external OPA server with hot updates) and Embedded Mode (inline policies), with automatic mode selection.
* New Server Mode configuration options: server URL, decision path, timeout, and bearer token support.
* Enhanced response format handling supporting boolean, object with allow, and object with result formats.
* **Documentation**
* Comprehensive English and Chinese documentation updates covering both modes, configuration examples, deployment guidance (Docker/Docker Compose), policy hot updates, and expanded troubleshooting.
* Added HTTP header canonicalization guidance for policy development.
<sub>✏️ Tip: You can customize this high-level summary in your review settings.</sub>
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---
All commits preserve original authorship.
**Note**: Auto-created when PR #43 was merged into `dubbo-go-pixiu/dubbo-go-pixiu:develop`.
cc @nanjiek
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org
Re: [PR] Feature/support opa server [dubbo-go-pixiu]
Posted by "codecov-commenter (via GitHub)" <gi...@apache.org>.
codecov-commenter commented on PR #822:
URL: https://github.com/apache/dubbo-go-pixiu/pull/822#issuecomment-3595336203
## [Codecov](https://app.codecov.io/gh/apache/dubbo-go-pixiu/pull/822?dropdown=coverage&src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) Report
:x: Patch coverage is `61.94030%` with `51 lines` in your changes missing coverage. Please review.
:white_check_mark: Project coverage is 21.73%. Comparing base ([`26606a8`](https://app.codecov.io/gh/apache/dubbo-go-pixiu/commit/26606a8317ac79fb8ce826138a34908b62beae1c?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)) to head ([`52e85b9`](https://app.codecov.io/gh/apache/dubbo-go-pixiu/commit/52e85b9a4904d7b71b9ffb6ea889a4d1b74fed32?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)).
:warning: Report is 93 commits behind head on develop.
| [Files with missing lines](https://app.codecov.io/gh/apache/dubbo-go-pixiu/pull/822?dropdown=coverage&src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | Patch % | Lines |
|---|---|---|
| [pkg/filter/opa/opa.go](https://app.codecov.io/gh/apache/dubbo-go-pixiu/pull/822?src=pr&el=tree&filepath=pkg%2Ffilter%2Fopa%2Fopa.go&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache#diff-cGtnL2ZpbHRlci9vcGEvb3BhLmdv) | 61.94% | [46 Missing and 5 partials :warning: ](https://app.codecov.io/gh/apache/dubbo-go-pixiu/pull/822?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) |
> :exclamation: There is a different number of reports uploaded between BASE (26606a8) and HEAD (52e85b9). Click for more details.
>
> <details><summary>HEAD has 1 upload less than BASE</summary>
>
>| Flag | BASE (26606a8) | HEAD (52e85b9) |
>|------|------|------|
>||1|0|
></details>
<details><summary>Additional details and impacted files</summary>
```diff
@@ Coverage Diff @@
## develop #822 +/- ##
============================================
- Coverage 54.67% 21.73% -32.95%
============================================
Files 671 245 -426
Lines 78658 16081 -62577
============================================
- Hits 43006 3495 -39511
+ Misses 31981 12230 -19751
+ Partials 3671 356 -3315
```
| [Flag](https://app.codecov.io/gh/apache/dubbo-go-pixiu/pull/822/flags?src=pr&el=flags&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | Coverage Δ | |
|---|---|---|
| [unittests](https://app.codecov.io/gh/apache/dubbo-go-pixiu/pull/822/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `21.73% <61.94%> (?)` | |
Flags with carried forward coverage won't be shown. [Click here](https://docs.codecov.io/docs/carryforward-flags?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache#carryforward-flags-in-the-pull-request-comment) to find out more.
</details>
[:umbrella: View full report in Codecov by Sentry](https://app.codecov.io/gh/apache/dubbo-go-pixiu/pull/822?dropdown=coverage&src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache).
:loudspeaker: Have feedback on the report? [Share it here](https://about.codecov.io/codecov-pr-comment-feedback/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache).
<details><summary> :rocket: New features to boost your workflow: </summary>
- :snowflake: [Test Analytics](https://docs.codecov.com/docs/test-analytics): Detect flaky tests, report on failures, and find test suite problems.
- :package: [JS Bundle Analysis](https://docs.codecov.com/docs/javascript-bundle-analysis): Save yourself from yourself by tracking and limiting bundle sizes in JS merges.
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org
Re: [PR] Feature/support opa server [dubbo-go-pixiu]
Posted by "sonarqubecloud[bot] (via GitHub)" <gi...@apache.org>.
sonarqubecloud[bot] commented on PR #822:
URL: https://github.com/apache/dubbo-go-pixiu/pull/822#issuecomment-3595419542
## [](https://sonarcloud.io/dashboard?id=apache_dubbo-go-pixiu&pullRequest=822) **Quality Gate passed**
Issues
 [8 New issues](https://sonarcloud.io/project/issues?id=apache_dubbo-go-pixiu&pullRequest=822&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)
 [0 Accepted issues](https://sonarcloud.io/project/issues?id=apache_dubbo-go-pixiu&pullRequest=822&issueStatuses=ACCEPTED)
Measures
 [0 Security Hotspots](https://sonarcloud.io/project/security_hotspots?id=apache_dubbo-go-pixiu&pullRequest=822&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)
 [0.0% Coverage on New Code](https://sonarcloud.io/component_measures?id=apache_dubbo-go-pixiu&pullRequest=822&metric=new_coverage&view=list)
 [21.2% Duplication on New Code](https://sonarcloud.io/component_measures?id=apache_dubbo-go-pixiu&pullRequest=822&metric=new_duplicated_lines_density&view=list)
[See analysis details on SonarQube Cloud](https://sonarcloud.io/dashboard?id=apache_dubbo-go-pixiu&pullRequest=822)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org
Re: [PR] Feature/support opa server [dubbo-go-pixiu]
Posted by "Alanxtl (via GitHub)" <gi...@apache.org>.
Alanxtl commented on PR #822:
URL: https://github.com/apache/dubbo-go-pixiu/pull/822#issuecomment-3595389127
@Copilot
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org
Re: [PR] Feature/support opa server [dubbo-go-pixiu]
Posted by "sonarqubecloud[bot] (via GitHub)" <gi...@apache.org>.
sonarqubecloud[bot] commented on PR #822:
URL: https://github.com/apache/dubbo-go-pixiu/pull/822#issuecomment-3595316479
## [](https://sonarcloud.io/dashboard?id=apache_dubbo-go-pixiu&pullRequest=822) **Quality Gate passed**
Issues
 [9 New issues](https://sonarcloud.io/project/issues?id=apache_dubbo-go-pixiu&pullRequest=822&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)
 [0 Accepted issues](https://sonarcloud.io/project/issues?id=apache_dubbo-go-pixiu&pullRequest=822&issueStatuses=ACCEPTED)
Measures
 [0 Security Hotspots](https://sonarcloud.io/project/security_hotspots?id=apache_dubbo-go-pixiu&pullRequest=822&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)
 [0.0% Coverage on New Code](https://sonarcloud.io/component_measures?id=apache_dubbo-go-pixiu&pullRequest=822&metric=new_coverage&view=list)
 [21.3% Duplication on New Code](https://sonarcloud.io/component_measures?id=apache_dubbo-go-pixiu&pullRequest=822&metric=new_duplicated_lines_density&view=list)
[See analysis details on SonarQube Cloud](https://sonarcloud.io/dashboard?id=apache_dubbo-go-pixiu&pullRequest=822)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org
Re: [PR] Feature/support opa server [dubbo-go-pixiu]
Posted by "Alanxtl (via GitHub)" <gi...@apache.org>.
Alanxtl commented on code in PR #822:
URL: https://github.com/apache/dubbo-go-pixiu/pull/822#discussion_r2576240249
##########
pkg/filter/opa/opa.go:
##########
@@ -127,15 +186,161 @@ func (f *Filter) Decode(c *http.HttpContext) filter.FilterStatus {
"params": c.Params,
}
+ // Server mode (priority)
+ if f.httpClient != nil {
+ return f.evaluateServer(c, input)
+ }
+
+ // Embedded mode (backward compatibility)
+ if f.preparedQuery != nil {
+ return f.evaluateEmbedded(c, input)
+ }
+
+ logger.Error("OPA filter not initialized properly")
+ errResp := contextHttp.InternalError.WithError(fmt.Errorf("OPA filter not initialized"))
+ c.SendLocalReply(errResp.Status, errResp.ToJSON())
+ return filter.Stop
+}
+
+// evaluateEmbedded evaluates the policy using embedded OPA engine
+func (f *Filter) evaluateEmbedded(c *contextHttp.HttpContext, input map[string]any) filter.FilterStatus {
results, err := f.preparedQuery.Eval(c.Ctx, rego.EvalInput(input))
if err != nil {
- logger.Error("OPA evaluation error: %v\n", err)
+ logger.Errorf("OPA embedded evaluation error: %v", err)
+ errResp := contextHttp.InternalError.WithError(err)
+ c.SendLocalReply(errResp.Status, errResp.ToJSON())
return filter.Stop
}
- if len(results) == 0 || results[0].Expressions[0].Value != true {
+ if len(results) == 0 {
+ logger.Debugf("OPA embedded policy returned empty result for request: %s %s", input["method"], input["path"])
+ errResp := contextHttp.Forbidden.New()
+ c.SendLocalReply(errResp.Status, errResp.ToJSON())
+ return filter.Stop
+ }
+
+ // Extract decision from result (supports both boolean and object formats)
+ allow := extractDecision(results[0].Expressions[0].Value)
+ if !allow {
+ logger.Debugf("OPA embedded policy denied request: %s %s", input["method"], input["path"])
+ errResp := contextHttp.Forbidden.New()
+ c.SendLocalReply(errResp.Status, errResp.ToJSON())
return filter.Stop
}
return filter.Continue
}
+
+// evaluateServer evaluates the policy by calling OPA server REST API
+func (f *Filter) evaluateServer(c *contextHttp.HttpContext, input map[string]any) filter.FilterStatus {
+ // Construct request body according to OPA REST API specification
+ requestBody := map[string]any{
+ "input": input,
+ }
+
+ jsonData, err := json.Marshal(requestBody)
+ if err != nil {
+ logger.Errorf("Failed to marshal OPA request: %v", err)
+ errResp := contextHttp.InternalError.WithError(err)
+ c.SendLocalReply(errResp.Status, errResp.ToJSON())
+ return filter.Stop
+ }
+
+ // Construct HTTP request
+ url := f.cfg.ServerURL + f.cfg.DecisionPath
+ req, err := http.NewRequestWithContext(c.Ctx, "POST", url, bytes.NewBuffer(jsonData))
+ if err != nil {
+ logger.Errorf("Failed to create OPA request: %v", err)
+ errResp := contextHttp.InternalError.WithError(err)
+ c.SendLocalReply(errResp.Status, errResp.ToJSON())
+ return filter.Stop
+ }
+
+ req.Header.Set("Content-Type", "application/json")
+ if f.cfg.BearerToken != "" {
+ req.Header.Set("Authorization", "Bearer "+f.cfg.BearerToken)
+ }
+
+ // Send request to OPA server
+ resp, err := f.httpClient.Do(req)
+ if err != nil {
+ logger.Errorf("OPA server request failed: %v", err)
+ // Check if it's a timeout error using net.Error interface
+ if netErr, ok := err.(interface{ Timeout() bool }); ok && netErr.Timeout() {
+ errResp := contextHttp.GatewayTimeout.WithError(err)
+ c.SendLocalReply(errResp.Status, errResp.ToJSON())
+ } else {
+ errResp := contextHttp.ServiceUnavailable.WithError(err)
+ c.SendLocalReply(errResp.Status, errResp.ToJSON())
+ }
+ return filter.Stop
+ }
+ defer resp.Body.Close()
+
+ // Check HTTP status code
+ if resp.StatusCode != 200 {
+ body, _ := io.ReadAll(resp.Body)
Review Comment:
```suggestion
body, err := io.ReadAll(resp.Body)
if err != nil {
logger.Errorf("Failed to read OPA server response body: %v", err)
body = []byte("")
}
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org
Re: [PR] Feature/support opa server [dubbo-go-pixiu]
Posted by "Alanxtl (via GitHub)" <gi...@apache.org>.
Alanxtl merged PR #822:
URL: https://github.com/apache/dubbo-go-pixiu/pull/822
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org
Re: [PR] Feature/support opa server [dubbo-go-pixiu]
Posted by "sonarqubecloud[bot] (via GitHub)" <gi...@apache.org>.
sonarqubecloud[bot] commented on PR #822:
URL: https://github.com/apache/dubbo-go-pixiu/pull/822#issuecomment-3595431958
## [](https://sonarcloud.io/dashboard?id=apache_dubbo-go-pixiu&pullRequest=822) **Quality Gate passed**
Issues
 [8 New issues](https://sonarcloud.io/project/issues?id=apache_dubbo-go-pixiu&pullRequest=822&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)
 [0 Accepted issues](https://sonarcloud.io/project/issues?id=apache_dubbo-go-pixiu&pullRequest=822&issueStatuses=ACCEPTED)
Measures
 [0 Security Hotspots](https://sonarcloud.io/project/security_hotspots?id=apache_dubbo-go-pixiu&pullRequest=822&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)
 [0.0% Coverage on New Code](https://sonarcloud.io/component_measures?id=apache_dubbo-go-pixiu&pullRequest=822&metric=new_coverage&view=list)
 [21.2% Duplication on New Code](https://sonarcloud.io/component_measures?id=apache_dubbo-go-pixiu&pullRequest=822&metric=new_duplicated_lines_density&view=list)
[See analysis details on SonarQube Cloud](https://sonarcloud.io/dashboard?id=apache_dubbo-go-pixiu&pullRequest=822)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org
Re: [PR] Feature/support opa server [dubbo-go-pixiu]
Posted by "Alanxtl (via GitHub)" <gi...@apache.org>.
Alanxtl commented on code in PR #822:
URL: https://github.com/apache/dubbo-go-pixiu/pull/822#discussion_r2576252157
##########
pkg/filter/opa/opa.go:
##########
@@ -127,15 +186,165 @@ func (f *Filter) Decode(c *http.HttpContext) filter.FilterStatus {
"params": c.Params,
}
+ // Server mode (priority)
+ if f.httpClient != nil {
+ return f.evaluateServer(c, input)
+ }
+
+ // Embedded mode (backward compatibility)
+ if f.preparedQuery != nil {
+ return f.evaluateEmbedded(c, input)
+ }
+
+ logger.Error("OPA filter not initialized properly")
+ errResp := contextHttp.InternalError.WithError(fmt.Errorf("OPA filter not initialized"))
+ c.SendLocalReply(errResp.Status, errResp.ToJSON())
+ return filter.Stop
+}
+
+// evaluateEmbedded evaluates the policy using embedded OPA engine
+func (f *Filter) evaluateEmbedded(c *contextHttp.HttpContext, input map[string]any) filter.FilterStatus {
results, err := f.preparedQuery.Eval(c.Ctx, rego.EvalInput(input))
if err != nil {
- logger.Error("OPA evaluation error: %v\n", err)
+ logger.Errorf("OPA embedded evaluation error: %v", err)
+ errResp := contextHttp.InternalError.WithError(err)
+ c.SendLocalReply(errResp.Status, errResp.ToJSON())
return filter.Stop
}
- if len(results) == 0 || results[0].Expressions[0].Value != true {
+ if len(results) == 0 {
+ logger.Debugf("OPA embedded policy returned empty result for request: %s %s", input["method"], input["path"])
+ errResp := contextHttp.Forbidden.New()
+ c.SendLocalReply(errResp.Status, errResp.ToJSON())
+ return filter.Stop
+ }
+
+ // Extract decision from result (supports both boolean and object formats)
+ allow := extractDecision(results[0].Expressions[0].Value)
+ if !allow {
+ logger.Debugf("OPA embedded policy denied request: %s %s", input["method"], input["path"])
+ errResp := contextHttp.Forbidden.New()
+ c.SendLocalReply(errResp.Status, errResp.ToJSON())
return filter.Stop
}
return filter.Continue
}
+
+// evaluateServer evaluates the policy by calling OPA server REST API
+func (f *Filter) evaluateServer(c *contextHttp.HttpContext, input map[string]any) filter.FilterStatus {
+ // Construct request body according to OPA REST API specification
+ requestBody := map[string]any{
+ "input": input,
+ }
+
+ jsonData, err := json.Marshal(requestBody)
+ if err != nil {
+ logger.Errorf("Failed to marshal OPA request: %v", err)
+ errResp := contextHttp.InternalError.WithError(err)
+ c.SendLocalReply(errResp.Status, errResp.ToJSON())
+ return filter.Stop
+ }
+
+ // Construct HTTP request
+ url := f.cfg.ServerURL + f.cfg.DecisionPath
+ req, err := http.NewRequestWithContext(c.Ctx, "POST", url, bytes.NewBuffer(jsonData))
+ if err != nil {
+ logger.Errorf("Failed to create OPA request: %v", err)
+ errResp := contextHttp.InternalError.WithError(err)
+ c.SendLocalReply(errResp.Status, errResp.ToJSON())
+ return filter.Stop
+ }
+
+ req.Header.Set("Content-Type", "application/json")
+ if f.cfg.BearerToken != "" {
+ req.Header.Set("Authorization", "Bearer "+f.cfg.BearerToken)
+ }
+
+ // Send request to OPA server
+ resp, err := f.httpClient.Do(req)
+ if err != nil {
+ logger.Errorf("OPA server request failed: %v", err)
+ // Check if it's a timeout error using net.Error interface
+ if netErr, ok := err.(interface{ Timeout() bool }); ok && netErr.Timeout() {
+ errResp := contextHttp.GatewayTimeout.WithError(err)
+ c.SendLocalReply(errResp.Status, errResp.ToJSON())
+ } else {
+ errResp := contextHttp.ServiceUnavailable.WithError(err)
+ c.SendLocalReply(errResp.Status, errResp.ToJSON())
+ }
+ return filter.Stop
+ }
+ defer resp.Body.Close()
+
+ // Check HTTP status code
+ if resp.StatusCode != 200 {
+ body, err := io.ReadAll(resp.Body)
+ if err != nil {
+ logger.Errorf("Failed to read OPA server response body: %v", err)
+ body = []byte("")
Review Comment:
```suggestion
body = []byte("")
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org
Re: [PR] Feature/support opa server [dubbo-go-pixiu]
Posted by "baerwang (via GitHub)" <gi...@apache.org>.
baerwang commented on code in PR #822:
URL: https://github.com/apache/dubbo-go-pixiu/pull/822#discussion_r2579459923
##########
pkg/filter/opa/opa.go:
##########
@@ -127,15 +186,165 @@ func (f *Filter) Decode(c *http.HttpContext) filter.FilterStatus {
"params": c.Params,
}
+ // Server mode (priority)
+ if f.httpClient != nil {
+ return f.evaluateServer(c, input)
+ }
+
+ // Embedded mode (backward compatibility)
+ if f.preparedQuery != nil {
+ return f.evaluateEmbedded(c, input)
+ }
+
+ logger.Error("OPA filter not initialized properly")
+ errResp := contextHttp.InternalError.WithError(fmt.Errorf("OPA filter not initialized"))
+ c.SendLocalReply(errResp.Status, errResp.ToJSON())
+ return filter.Stop
+}
+
+// evaluateEmbedded evaluates the policy using embedded OPA engine
+func (f *Filter) evaluateEmbedded(c *contextHttp.HttpContext, input map[string]any) filter.FilterStatus {
results, err := f.preparedQuery.Eval(c.Ctx, rego.EvalInput(input))
if err != nil {
- logger.Error("OPA evaluation error: %v\n", err)
+ logger.Errorf("OPA embedded evaluation error: %v", err)
+ errResp := contextHttp.InternalError.WithError(err)
+ c.SendLocalReply(errResp.Status, errResp.ToJSON())
return filter.Stop
}
- if len(results) == 0 || results[0].Expressions[0].Value != true {
+ if len(results) == 0 {
+ logger.Debugf("OPA embedded policy returned empty result for request: %s %s", input["method"], input["path"])
+ errResp := contextHttp.Forbidden.New()
+ c.SendLocalReply(errResp.Status, errResp.ToJSON())
+ return filter.Stop
+ }
+
+ // Extract decision from result (supports both boolean and object formats)
+ allow := extractDecision(results[0].Expressions[0].Value)
+ if !allow {
+ logger.Debugf("OPA embedded policy denied request: %s %s", input["method"], input["path"])
+ errResp := contextHttp.Forbidden.New()
+ c.SendLocalReply(errResp.Status, errResp.ToJSON())
return filter.Stop
}
return filter.Continue
}
+
+// evaluateServer evaluates the policy by calling OPA server REST API
+func (f *Filter) evaluateServer(c *contextHttp.HttpContext, input map[string]any) filter.FilterStatus {
+ // Construct request body according to OPA REST API specification
+ requestBody := map[string]any{
+ "input": input,
+ }
+
+ jsonData, err := json.Marshal(requestBody)
+ if err != nil {
+ logger.Errorf("Failed to marshal OPA request: %v", err)
+ errResp := contextHttp.InternalError.WithError(err)
+ c.SendLocalReply(errResp.Status, errResp.ToJSON())
+ return filter.Stop
+ }
+
+ // Construct HTTP request
+ url := f.cfg.ServerURL + f.cfg.DecisionPath
+ req, err := http.NewRequestWithContext(c.Ctx, "POST", url, bytes.NewBuffer(jsonData))
+ if err != nil {
+ logger.Errorf("Failed to create OPA request: %v", err)
+ errResp := contextHttp.InternalError.WithError(err)
+ c.SendLocalReply(errResp.Status, errResp.ToJSON())
+ return filter.Stop
+ }
+
+ req.Header.Set("Content-Type", "application/json")
+ if f.cfg.BearerToken != "" {
+ req.Header.Set("Authorization", "Bearer "+f.cfg.BearerToken)
+ }
+
+ // Send request to OPA server
+ resp, err := f.httpClient.Do(req)
+ if err != nil {
+ logger.Errorf("OPA server request failed: %v", err)
+ // Check if it's a timeout error using net.Error interface
+ if netErr, ok := err.(interface{ Timeout() bool }); ok && netErr.Timeout() {
+ errResp := contextHttp.GatewayTimeout.WithError(err)
+ c.SendLocalReply(errResp.Status, errResp.ToJSON())
+ } else {
+ errResp := contextHttp.ServiceUnavailable.WithError(err)
+ c.SendLocalReply(errResp.Status, errResp.ToJSON())
+ }
+ return filter.Stop
+ }
+ defer resp.Body.Close()
+
+ // Check HTTP status code
+ if resp.StatusCode != 200 {
Review Comment:
`200` changed `http.StatusOK`
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org