oscerd opened a new pull request, #26195: URL: https://github.com/apache/camel/pull/26195
## What Adds `OpaBearerTokenIT`, covering the `bearerToken` option against an OPA server that actually requires it. ## Why `bearerToken` was exercised by no test at all. The unit tests inject a mocked `OPAClient`, which bypasses `OpaPolicyEvaluator.createClient` — the only place the token is applied — and `OpaIT` runs an unauthenticated OPA container, so nothing verified the token reaches the server as an `Authorization` header. That is the wrong gap to leave in a security option: if it silently failed to be applied, a deployment would believe it was authenticating to its policy decision point when it was not, and every existing test would still pass. ## What changed The new IT starts OPA with `--authentication=token --authorization=basic` plus a `system-authz.rego` system authorization policy, so the server genuinely rejects callers that do not present the token rather than ignoring the header. It asserts both directions: - the configured token evaluates the policy and returns a decision; - no token, and a wrong token, fail closed with `OpaPolicyEvaluationException` and no verdict header. The positive case is the real assertion — it would fail outright if `bearerToken` were not wired through — and the two negatives prove the server is enforcing rather than allowing everything. Uploading the test policy also requires the token, which exercises it a second way. Two things worth noting: - **`camel-test-infra-opa` is unchanged.** It deliberately starts a plain server so it stays independent of any particular policy. The IT builds its own authenticating container and passes it to the existing `OpaLocalContainerInfraService(GenericContainer)` constructor, so the service's lifecycle and property registration are still reused. The image is resolved through `LocalPropertyResolver` + `OpaProperties.OPA_CONTAINER`, so the tag stays single-sourced in `container.properties` rather than being duplicated in a test. - **The system policy lets `/health` through unauthenticated**, otherwise `--authorization=basic` would also protect it and the container's own Testcontainers wait strategy could never start the server. ## Testing 10 integration tests in the module (7 existing + 3 new), green against real OPA containers. Full reactor build green — as expected for a test-only change, it regenerated nothing. `main` only — test-only. _Claude Code on behalf of @oscerd_ 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
