You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@camel.apache.org by "oscerd (via GitHub)" <gi...@apache.org> on 2026/09/08 09:26:58 UTC
[PR] CAMEL-24645: camel-opa - cover the bearerToken option with an integration test [camel]
oscerd opened a new pull request, #26195:
URL: https://github.com/apache/camel/pull/26195
## What
Adds `OpaBearerTokenIT`, covering the `bearerToken` option against an OPA server that actually requires it.
## Why
`bearerToken` was exercised by no test at all. The unit tests inject a mocked `OPAClient`, which bypasses `OpaPolicyEvaluator.createClient` — the only place the token is applied — and `OpaIT` runs an unauthenticated OPA container, so nothing verified the token reaches the server as an `Authorization` header.
That is the wrong gap to leave in a security option: if it silently failed to be applied, a deployment would believe it was authenticating to its policy decision point when it was not, and every existing test would still pass.
## What changed
The new IT starts OPA with `--authentication=token --authorization=basic` plus a `system-authz.rego` system authorization policy, so the server genuinely rejects callers that do not present the token rather than ignoring the header. It asserts both directions:
- the configured token evaluates the policy and returns a decision;
- no token, and a wrong token, fail closed with `OpaPolicyEvaluationException` and no verdict header.
The positive case is the real assertion — it would fail outright if `bearerToken` were not wired through — and the two negatives prove the server is enforcing rather than allowing everything. Uploading the test policy also requires the token, which exercises it a second way.
Two things worth noting:
- **`camel-test-infra-opa` is unchanged.** It deliberately starts a plain server so it stays independent of any particular policy. The IT builds its own authenticating container and passes it to the existing `OpaLocalContainerInfraService(GenericContainer)` constructor, so the service's lifecycle and property registration are still reused. The image is resolved through `LocalPropertyResolver` + `OpaProperties.OPA_CONTAINER`, so the tag stays single-sourced in `container.properties` rather than being duplicated in a test.
- **The system policy lets `/health` through unauthenticated**, otherwise `--authorization=basic` would also protect it and the container's own Testcontainers wait strategy could never start the server.
## Testing
10 integration tests in the module (7 existing + 3 new), green against real OPA containers. Full reactor build green — as expected for a test-only change, it regenerated nothing.
`main` only — test-only.
_Claude Code on behalf of @oscerd_
🤖 Generated with [Claude Code](https://claude.com/claude-code)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CAMEL-24645: camel-opa - cover the bearerToken option with an integration test [camel]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #26195:
URL: https://github.com/apache/camel/pull/26195#issuecomment-5583765831
<!-- ci-tested-modules -->
:test_tube: **CI tested the following changed modules:**
- `components/camel-opa`
---
<details><summary>:microscope: Scalpel shadow comparison — Scalpel: 1 tested, 0 compile-only — current: 9 all tested</summary>
[Maveniverse Scalpel](https://github.com/maveniverse/scalpel) detected **1 affected modules** (current approach: 9).
<details><summary>Modules only in current approach (8)</summary>
- `camel-jbang-mcp`
- `camel-jbang-plugin-mcp`
- `camel-jbang-plugin-route-parser`
- `camel-jbang-plugin-tui`
- `camel-jbang-plugin-validate`
- `camel-launcher-container`
- `camel-yaml-dsl-validator`
- `camel-yaml-dsl-validator-maven-plugin`
</details>
**Skip-tests mode would test 1 modules** (1 direct + 0 downstream), **skip tests for 0** (generated code, meta-modules)
<details><summary>Modules Scalpel would test (1)</summary>
- `camel-opa`
</details>
> :information_source: Shadow mode — Scalpel observes but does not affect test execution. [Learn more](https://github.com/maveniverse/scalpel)
</details>
<details><summary>All tested modules (9 modules, 1m 49s total)</summary>
**Total reactor time:** 1m 49s
| Module | Duration | Status |
| --- | --- | --- |
| Camel :: JBang :: Plugin :: TUI | 35.1s | SUCCESS |
| Camel :: JBang :: MCP | 34.8s | SUCCESS |
| Camel :: OPA | 19.9s | SUCCESS |
| Camel :: YAML DSL :: Validator | 5.9s | SUCCESS |
| Camel :: YAML DSL :: Validator Maven Plugin | 4.3s | SUCCESS |
| Camel :: JBang :: Plugin :: MCP | 3.2s | SUCCESS |
| Camel :: Launcher :: Container | 2.7s | SUCCESS |
| Camel :: JBang :: Plugin :: Route Parser | 1.9s | SUCCESS |
| Camel :: JBang :: Plugin :: Validate | 1.3s | SUCCESS |
**Top 20 slowest modules:**
- `Camel :: JBang :: Plugin :: TUI` (35.1s)
- `Camel :: JBang :: MCP` (34.8s)
- `Camel :: OPA` (19.9s)
- `Camel :: YAML DSL :: Validator` (5.9s)
- `Camel :: YAML DSL :: Validator Maven Plugin` (4.3s)
- `Camel :: JBang :: Plugin :: MCP` (3.2s)
- `Camel :: Launcher :: Container` (2.7s)
- `Camel :: JBang :: Plugin :: Route Parser` (1.9s)
- `Camel :: JBang :: Plugin :: Validate` (1.3s)
</details>
---
:gear: [View full build and test results](https://github.com/apache/camel/actions/runs/34210050962)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CAMEL-24645: camel-opa - cover the bearerToken option with an integration test [camel]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #26195:
URL: https://github.com/apache/camel/pull/26195#issuecomment-5583596800
:star2: Thank you for your contribution to the Apache Camel project! :star2:
:robot: CI automation will test this PR automatically.
:camel: Apache Camel Committers, please review the following items:
* First-time contributors **require MANUAL approval** for the GitHub Actions to run
* You can use the command `/component-test (camel-)component-name1 (camel-)component-name2..` to request a test from the test bot although they are normally detected and executed by CI.
* You can label PRs using `skip-tests` and `test-dependents` to fine-tune the checks executed by this PR.
* Build and test logs are available in the summary page. **Only** [Apache Camel committers](https://camel.apache.org/community/team/#committers) have access to the summary.
:warning: Be careful when sharing logs. Review their contents before sharing them publicly.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CAMEL-24645: camel-opa - cover the bearerToken option with an integration test [camel]
Posted by "oscerd (via GitHub)" <gi...@apache.org>.
oscerd merged PR #26195:
URL: https://github.com/apache/camel/pull/26195
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org