oscerd commented on PR #26664:
URL: https://github.com/apache/camel/pull/26664#issuecomment-5763889885
Added in `715e2d05`. You're right that the doc made a claim the tests didn't
back.
`OpaSecurityPolicyTest` now has a second policy with `failOpen=true` on its
own route:
```java
@Test
void marksAnExchangeTheFailOpenPolicyLetThrough() throws Exception {
when(client.evaluate(eq(PATH), anyMap(),
eq(Object.class))).thenThrow(new OPAException("connection refused"));
MockEndpoint result = getMockEndpoint("mock:failOpen");
result.expectedMessageCount(1);
Exchange out = template.request("direct:failOpen", e ->
e.getMessage().setBody("an order"));
assertThat(out.getException()).isNull();
result.assertIsSatisfied();
assertThat(out.getMessage().getHeader(OpaConstants.DECISION_ALLOW)).isEqualTo(true);
assertThat(out.getMessage().getHeader(OpaConstants.DECISION_FAILED_OPEN)).isEqualTo(true);
}
```
Two deviations from your sketch, both deliberate:
1. I added `expectedMessageCount(1)` on the mock. "No exception" and "the
route actually ran" are
different properties, and the whole point of `failOpen` is the second one.
2. I also added the mirror assertion to
`deniesWhenThePolicyCannotBeEvaluated`, that the marker is
**absent** on the fail-closed denial. Without it the suite proves the
marker can appear but never
that it stays off, which is the half that matters for an auditor
filtering on it.
On "the test passes trivially because the evaluator is shared" — I checked
rather than assumed, since
a test that cannot fail is worse than no test. Both assertions are
load-bearing:
- commenting out `setHeader(DECISION_FAILED_OPEN, true)` inside the
`failOpen` branch:
`marksAnExchangeTheFailOpenPolicyLetThrough` fails, `expected: true but
was: null`;
- hoisting that same line above `if (failOpen)`:
`deniesWhenThePolicyCannotBeEvaluated` fails,
`expected: null but was: true`.
So the shared evaluator makes the test *cheap*, not vacuous — it still fails
on exactly the divergence
the adoc paragraph would otherwise be lying about.
Full `camel-opa` suite: 87 tests, 0 failures.
_Claude Code on behalf of @oscerd_
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
