oscerd opened a new pull request, #26195:
URL: https://github.com/apache/camel/pull/26195

   ## What
   
   Adds `OpaBearerTokenIT`, covering the `bearerToken` option against an OPA 
server that actually requires it.
   
   ## Why
   
   `bearerToken` was exercised by no test at all. The unit tests inject a 
mocked `OPAClient`, which bypasses `OpaPolicyEvaluator.createClient` — the only 
place the token is applied — and `OpaIT` runs an unauthenticated OPA container, 
so nothing verified the token reaches the server as an `Authorization` header.
   
   That is the wrong gap to leave in a security option: if it silently failed 
to be applied, a deployment would believe it was authenticating to its policy 
decision point when it was not, and every existing test would still pass.
   
   ## What changed
   
   The new IT starts OPA with `--authentication=token --authorization=basic` 
plus a `system-authz.rego` system authorization policy, so the server genuinely 
rejects callers that do not present the token rather than ignoring the header. 
It asserts both directions:
   
   - the configured token evaluates the policy and returns a decision;
   - no token, and a wrong token, fail closed with 
`OpaPolicyEvaluationException` and no verdict header.
   
   The positive case is the real assertion — it would fail outright if 
`bearerToken` were not wired through — and the two negatives prove the server 
is enforcing rather than allowing everything. Uploading the test policy also 
requires the token, which exercises it a second way.
   
   Two things worth noting:
   
   - **`camel-test-infra-opa` is unchanged.** It deliberately starts a plain 
server so it stays independent of any particular policy. The IT builds its own 
authenticating container and passes it to the existing 
`OpaLocalContainerInfraService(GenericContainer)` constructor, so the service's 
lifecycle and property registration are still reused. The image is resolved 
through `LocalPropertyResolver` + `OpaProperties.OPA_CONTAINER`, so the tag 
stays single-sourced in `container.properties` rather than being duplicated in 
a test.
   - **The system policy lets `/health` through unauthenticated**, otherwise 
`--authorization=basic` would also protect it and the container's own 
Testcontainers wait strategy could never start the server.
   
   ## Testing
   
   10 integration tests in the module (7 existing + 3 new), green against real 
OPA containers. Full reactor build green — as expected for a test-only change, 
it regenerated nothing.
   
   `main` only — test-only.
   
   _Claude Code on behalf of @oscerd_
   
   🤖 Generated with [Claude Code](https://claude.com/claude-code)
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to