[jira] [Assigned] (CAMEL-24830) camel-opa - OpaSecurityPolicy should support the in-process WASM evaluation mode

["Claus Ibsen (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/CAMEL-24830?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Claus Ibsen reassigned CAMEL-24830:
-----------------------------------

    Assignee: Andrea Cosentino

> camel-opa - OpaSecurityPolicy should support the in-process WASM evaluation mode
> --------------------------------------------------------------------------------
>
>                 Key: CAMEL-24830
>                 URL: https://issues.apache.org/jira/browse/CAMEL-24830
>             Project: Camel
>          Issue Type: Improvement
>            Reporter: Claus Ibsen
>            Assignee: Andrea Cosentino
>            Priority: Major
>
> h2. Problem
> {{OpaSecurityPolicy}} (an {{AuthorizationPolicy}}) is the idiomatic way to guard a route segment: {{.policy(opaPolicy)}} and a deny throws {{CamelAuthorizationException}}. But it only has the server constructor, {{OpaSecurityPolicy(String serverUrl, String policyPath)}}, so it can only use the REST evaluator. The producer supports {{evaluationMode=wasm&policyBundle=...}} for in-process evaluation, and that is the mode we recommend for hot paths such as AI tool calls (see the blog post "Authorizing what an AI agent may do in Apache Camel"), which today has to fall back to {{interceptFrom}} + {{opa:}} producer + {{choice/stop}} because the policy cannot do it.
> h2. Proposal
> * Add a WASM mode to {{OpaSecurityPolicy}}, e.g. a constructor/setters for {{policyBundle}} (and {{evaluationMode}}), reusing {{OpaWasmEvaluator}}/{{OpaWasmPolicyPool}} from the producer.
> * The decision contract ({{CamelOpaDecisionAllow}}, {{CamelOpaDecision}} headers, {{CamelAuthorizationException}} on deny) must be identical across modes.
> * No health check registered in WASM mode, consistent with CAMEL-24743.
> * Document it in {{opa-component.adoc}} under "As a security policy", and update the {{ai-tools-spiffe-opa}} example in camel-examples to use {{.policy(...)}} once available.
> Related: CAMEL-24743.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)