oscerd opened a new pull request, #27819: URL: https://github.com/apache/camel/pull/27819
## Description [CAMEL-25638](https://issues.apache.org/jira/browse/CAMEL-25638): camel-graphql configures authentication on its HTTP client itself, so the authority scoping that [CAMEL-24452](https://issues.apache.org/jira/browse/CAMEL-24452) added to camel-http did not apply to it. - `accessToken` (with `jwtAuthorizationType`) was installed with `HttpClientBuilder.setDefaultHeaders(...)`, so the `Authorization` header was added to every request the client executed, whatever its authority. It is now added by a request interceptor, only when the request goes to the scheme, host and effective port of `httpUri`. As before, it is not added when the request already carries an `Authorization` header. - `username`/`password` were registered under `new AuthScope(null, -1)`, which matches any scheme, host and port. They are now registered for the scheme, host and effective port of `httpUri`, as camel-http does since CAMEL-24452. - The authority of `httpUri` is read the way HttpClient reads it (`URIAuthority`), so a host name that `java.net.URI` does not parse, such as one with an underscore, is still matched. - Since [CAMEL-22562](https://issues.apache.org/jira/browse/CAMEL-22562) (4.19.0) the producer copies every message header into the internal camel-http exchange, so `CamelHttpUri`, `CamelHttpPath`, `CamelHttpQuery` and the other camel-http control headers changed the request URL, which camel-graphql did not do before. The internal endpoint is now created with `skipControlHeaders=true`. - The internal endpoint URI appended `?httpMethod=POST` to `httpUri`, which already has a query when the endpoint has lenient parameters (such as an api key). The option was then read as part of the previous parameter, and only the `CamelHttpMethod` header kept the request a POST. Since that header is no longer read, the option is now appended with the right separator. The existing `GraphqlComponentTest.checkApiKey` covers it. Upgrade guide (4.24): a request to another scheme, host or port is sent without the credentials, and the control headers no longer change the request URL. ## Tests - New `GraphqlCredentialsAuthorityTest`, against local servers: - with `followRedirects=true` on the http component, a request moved to a different host or a different port reaches it without the access token, and without the basic credentials after its 401 challenge (2 cases each); - `CamelHttpUri`, `CamelHttpPath` and `CamelHttpQuery` on the message do not change the target: the request, with its token, goes to `httpUri`. - With the main code reverted, all five cases fail. - The existing `GraphqlTokenAuthenticationTest` and `GraphqlBasicAuthenticationTest` still pass, so the credentials still reach `httpUri`. | Module | Tests | |---|---| | camel-graphql | 28 | Full reactor `mvn clean install -DskipTests -DskipITs`: green, no generated-file changes. The `httpMethod` separator change came after that run and was built and tested at module level only. ## Backports To be backported to camel-4.22.x and camel-4.18.x after the merge. - camel-4.22.x: the sources are identical to main, so it is a straight cherry-pick, without the upgrade-guide hunk. - camel-4.18.x: the component still builds its own HttpClient there (`GraphqlEndpoint.createHttpClient()`), and its producer always uses `httpUri`. The change is a port of the two credential changes, with its own test, so it is not a straight cherry-pick. _Claude Code on behalf of oscerd_ 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
