oscerd commented on PR #27719: URL: https://github.com/apache/camel/pull/27719#issuecomment-6128906611
Thanks @davsclaus, all the points of your review are addressed in 9cafb57ea5fc (the branch is also rebased on main): - **LRA id**: when a secret is set, `join()` adds the LRA to the callback URLs as `Camel-Saga-Lra`, and it is part of the signed parameters. After the verification, the route sets `Long-Running-Action` from that signed value, so the step works on the LRA the URL was enlisted for, and a signed URL without an LRA gets 403. `Camel-Saga-Lra` is also a reserved option name. The Saga EIP page now says that a signed URL can still be called again for its own LRA, so the storage and the logs of the coordinator should stay private. As nothing has been released with the signature yet, there is no window where unbound URLs must be accepted. `LRASignedCallbacksIT` passes against the coordinator container with the LRA in the URLs. - **Blank secret**: a `callbackSecret` that is set but blank now fails the start of the service (`LRASagaServiceTest#testBlankCallbackSecretFailsToStart`). - **camel-netty-http**: the route reads `CamelHttpRawQuery` first, then `CamelHttpQuery`, and removes the signature from both headers after the verification (`rawQueryIsReadBeforeTheDecodedOne`, `signatureIsKeptOutOfTheStepRoute`). - **Upgrade notes**: added in the 4.24, 4.22.2 and 4.18.6 sections on main, for the startup warning and for the saga option names that now fail route creation, with or without a secret. - **Starter**: tracked in [CAMEL-25590](https://issues.apache.org/jira/browse/CAMEL-25590), with the same fix versions (4.24.0, 4.22.2 and 4.18.6), so it can ship in the same releases. - **Unsigned path**: `LRASagaRoutesUnsignedCallbackTest` covers it over HTTP, without Docker. _Claude Code on behalf of oscerd_ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
