oscerd commented on code in PR #26667: URL: https://github.com/apache/camel/pull/26667#discussion_r4063739084
########## components/camel-opa/src/test/java/org/apache/camel/component/opa/security/OpaSecurityPolicyHealthCheckLifecycleTest.java: ########## @@ -0,0 +1,106 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one or more + * contributor license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright ownership. + * The ASF licenses this file to You under the Apache License, Version 2.0 + * (the "License"); you may not use this file except in compliance with + * the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package org.apache.camel.component.opa.security; + +import java.io.IOException; +import java.io.OutputStream; +import java.net.InetSocketAddress; + +import com.sun.net.httpserver.HttpServer; +import org.apache.camel.builder.RouteBuilder; +import org.apache.camel.health.HealthCheckRegistry; +import org.apache.camel.test.junit6.CamelTestSupport; +import org.junit.jupiter.api.AfterEach; +import org.junit.jupiter.api.Test; + +import static org.assertj.core.api.Assertions.assertThat; + +/** + * The readiness check registered by {@link OpaSecurityPolicy} must follow the lifecycle of the routes it guards: it is + * kept while any guarded route runs, removed once the last one stops, and restored when a route starts again. Otherwise + * a stopped or reloaded route leaves a check behind reporting on a policy that is no longer enforcing anything + * (CAMEL-24751). + */ +public class OpaSecurityPolicyHealthCheckLifecycleTest extends CamelTestSupport { + + private static HttpServer server; + private static String serverUrl; + + private final OpaSecurityPolicy policy = new OpaSecurityPolicy(); + + @AfterEach + void stopServer() { + if (server != null) { + server.stop(0); + server = null; + } + } + + private static String startHealthyServer() throws IOException { + server = HttpServer.create(new InetSocketAddress("localhost", 0), 0); + server.createContext("/health", exchange -> { + exchange.sendResponseHeaders(200, -1); + try (OutputStream out = exchange.getResponseBody()) { + out.flush(); + } + }); + server.start(); + return "http://localhost:"; + server.getAddress().getPort(); + } + + @Override + protected RouteBuilder createRouteBuilder() throws Exception { + serverUrl = startHealthyServer(); + policy.setPolicyPath("authz/allow"); Review Comment: Good catch — addressed in ba51c5d5. Added `doesNotRegisterACheckWhenHealthCheckIsDisabled`, which starts a `healthCheckEnabled=false` policy through a route and asserts nothing registers, so the guard is now exercised through the `onProcessorStart` path rather than only `beforeWrap`. I gave the disabled policy a distinct `serverUrl` so its would-be check can't deduplicate against the one the enabled routes share, and confirmed the test goes red when the `!healthCheckEnabled` guard is removed from `registerHealthCheck`. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
