oscerd opened a new pull request, #27866: URL: https://github.com/apache/camel/pull/27866
## Backport of #27819 Port of #27819 to `camel-4.18.x`. **Original PR:** #27819 - CAMEL-25638: camel-graphql - bind accessToken and basic credentials to the configured httpUri authority **Original author:** @oscerd **Target branch:** `camel-4.18.x` Not a straight cherry-pick, so it goes through a normal review: - On this branch camel-graphql does not go through camel-http (that came with CAMEL-22562 in 4.19.0): it builds its own HttpClient in `GraphqlEndpoint.createHttpClient()`, and the producer always sends the request to `httpUri`. The two credential changes are ported into a `configureAuthentication` method that `createHttpClient()` calls: the access token is added by a request interceptor only for the scheme, host and effective port of `httpUri`, the basic credentials are registered for that authority, the authority is read once (with `URIAuthority`, so a host name with an underscore still matches), and a warning is logged when credentials are configured but the authority cannot be read. - `skipControlHeaders` and the `httpMethod` separator change do not apply here, as there is no internal camel-http endpoint. - `GraphqlCredentialsAuthorityTest` is written for this branch: it uses `camel-test-junit5` and its own local servers, as the branch has neither `BaseGraphqlTest` nor the camel-http test jar. Besides the four other-authority cases it checks that the token and the basic credentials still reach `httpUri`, since the branch has no other authentication tests for the component. - The upgrade-guide notes are left out, as they live on `main` (the 4.18.6 note follows in a separate doc PR on `main`). Tested on the branch: the camel-graphql tests (19, of which 6 are new) and a full reactor build without tests. With the change reverted, the four other-authority cases fail and the two positive cases pass. ### Original description ## Description [CAMEL-25638](https://issues.apache.org/jira/browse/CAMEL-25638): camel-graphql configures authentication on its HTTP client itself, so the authority scoping that [CAMEL-24452](https://issues.apache.org/jira/browse/CAMEL-24452) added to camel-http did not apply to it. - `accessToken` (with `jwtAuthorizationType`) was installed with `HttpClientBuilder.setDefaultHeaders(...)`, so the `Authorization` header was added to every request the client executed, whatever its authority. It is now added by a request interceptor, only when the request goes to the scheme, host and effective port of `httpUri`. As before, it is not added when the request already carries an `Authorization` header. - `username`/`password` were registered under `new AuthScope(null, -1)`, which matches any scheme, host and port. They are now registered for the scheme, host and effective port of `httpUri`, as camel-http does since CAMEL-24452. - The authority of `httpUri` is read the way HttpClient reads it (`URIAuthority`), so a host name that `java.net.URI` does not parse, such as one with an underscore, is still matched. It is read once when the client is configured, and the token check and the `AuthScope` use the same scheme, host and port. When credentials are configured but that authority cannot be read, a warning is logged, since they are then not sent. - Since [CAMEL-22562](https://issues.apache.org/jira/browse/CAMEL-22562) (4.19.0) the producer copies every message header into the internal camel-http exchange, so `CamelHttpUri`, `CamelHttpPath`, `CamelHttpQuery` and the other camel-http control headers changed the request URL, which camel-graphql did not do before. The internal endpoint is now created with `skipControlHeaders=true`. - The internal endpoint URI appended `?httpMethod=POST` to `httpUri`, which already has a query when the endpoint has lenient parameters (such as an api key). The option was then read as part of the previous parameter, and only the `CamelHttpMethod` header kept the request a POST. Since that header is no longer read, the option is now appended with the right separator. The existing `GraphqlComponentTest.checkApiKey` covers it. Upgrade guide (4.24): - A request to another scheme, host or port is sent without the credentials. - With `proxyHost` set, the `username` and `password` are no longer offered to the proxy when it asks for authentication. - The control headers no longer change the request URL. `CamelHttpMethod` and `CamelHttpProtocolVersion` no longer apply either, so the request is always a POST. ## Tests - New `GraphqlCredentialsAuthorityTest`, against local servers: - with `followRedirects=true` on the http component, a request moved to a different host or a different port reaches it without the access token, and without the basic credentials after its 401 challenge (2 cases each); - `CamelHttpUri`, `CamelHttpPath` and `CamelHttpQuery` on the message do not change the target: the request, with its token, goes to `httpUri`. - With the main code reverted, all five cases fail. - The existing `GraphqlTokenAuthenticationTest` and `GraphqlBasicAuthenticationTest` still pass, so the credentials still reach `httpUri`. | Module | Tests | |---|---| | camel-graphql | 28 | Full reactor `mvn clean install -DskipTests -DskipITs`: green, no generated-file changes. The `httpMethod` separator change and the review follow-up (052a368c3d79) came after that run. They touch no options or metadata, and were built and tested at module level. _Claude Code on behalf of oscerd_ 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
