oscerd opened a new pull request, #26670: URL: https://github.com/apache/camel/pull/26670
This fixes [CAMEL-24830](https://issues.apache.org/jira/browse/CAMEL-24830). `OpaSecurityPolicy` (an `AuthorizationPolicy`) could only use the REST evaluator, so a route that wanted the in-process WASM engine — the mode to prefer for a hot path such as authorizing an AI tool call — had to fall back to `interceptFrom` + the `opa:` producer + `choice/stop`. The policy now takes `evaluationMode`/`policyBundle` (plus `entrypoint`/`poolSize`/`borrowTimeout`) and builds an `OpaWasmEvaluator` in WASM mode. - **Shared build.** Validation, the entrypoint default and loading the bundle move to a single `OpaWasmEvaluator.create(...)` factory that the producer (`OpaEndpoint`) and the policy both call, so the two construct the evaluator identically. - **Identical decision contract.** Both evaluators extend `OpaPolicyEvaluator`, so the `CamelOpaDecision` headers, the fail-closed default and `failOpen` behaviour are unchanged; a deny still throws `CamelAuthorizationException`. - **No readiness check in WASM mode.** The policy builds no client, so `ownsClient` stays false and the existing `registerHealthCheck` guard skips it — there is no server to probe (consistent with #26669 / CAMEL-24743). **Tests** (`OpaSecurityPolicyWasmTest`): allow and deny through the committed `authz.wasm` bundle, and — with a REST policy as a positive control — that only the REST policy registers a `security-policy:opa-` check (so the WASM skip cannot pass as a trivial empty registry). The `camel-examples` `ai-tools-spiffe-opa` sample the issue also mentions can now use `.policy(...)` instead of the `interceptFrom` workaround; that lives in a separate repository and is left as a follow-up. _Merge note:_ touches `OpaSecurityPolicy` (also in #26667) and `OpaEndpoint` (also in #26669) — trivial rebases once those land, as they touch different methods. 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
