davsclaus opened a new pull request, #29100: URL: https://github.com/apache/camel/pull/29100
Fixes [CAMEL-26255](https://issues.apache.org/jira/browse/CAMEL-26255). ### 1. `cloud=true` without a namespace **Was:** `getSecret` and `listSecrets` built the path only when `namespace` was set in cloud mode. Without it `getSecret` read the path `""` and failed with `Path must not be empty`, and `listSecrets` returned an empty list without calling Vault. The `hashicorp:` properties function had the same code and also read `""`. The secret refresh task already fell back to the engine itself. **Now:** one `getEnginePath()` in the producer: `<namespace>/<engine>` when `cloud=true` and a namespace is set, else the engine. The properties function does the same. This follows the refresh task, so the three agree. **Same methods, also fixed:** with `cloud=true` and a namespace, `createSecret` and `deleteSecret` used `opsForKeyValue(engine)`, so they worked outside the namespace that `getSecret` and `listSecrets` read. They now use the same engine path. ### 2. `createSecret` body **Was:** the body went to `keyValue.put` as is. A JSON text, bytes or stream body was serialized as a JSON string (or failed in Jackson), and Vault rejected it. A null body wrote a new, empty version of the secret. **Now:** a `Map` or POJO goes as before. Text, bytes, a stream, a `Reader`, a stream cache or a file is read as a JSON object into a `Map`; anything else (not JSON, a JSON array) fails with an `IllegalArgumentException`. The Jackson parse error is not chained, because its message can quote the text, which may be the secret. A message without a body fails with `InvalidPayloadException`. ### 3. Secret version **Was:** the `CamelHashicorpVaultSecretVersion` header was appended as `"?version=" + value`. **Now:** it must be a non-negative integer (Vault KV v2 versions are numbers, `0` is the latest). Any other value fails with an `IllegalArgumentException` and nothing is read. ### Tests - New `HashicorpVaultProducerTest` (15 tests, mocked `VaultTemplate`; adds `mockito-junit-jupiter` as a test dependency). 10 of them failed before the fix; the other 5 guard unchanged behaviour (on-premise ignores the namespace, cloud with a namespace, a `Map` body). - `HashicorpVaultPropertiesFunctionTest`: 2 new tests for cloud with and without a namespace; the one without failed before. They use a new package-private constructor that sets `cloud` and `namespace`. - `mvn clean install -Psourcecheck` in the module: 33 unit tests and 32 integration tests (Vault dev server) pass. ### Docs and generated files - Component doc: the namespace is optional, the `createSecret` body formats, the version is a number. - `@BodyTypes` of `createSecret` now lists text, bytes, stream and file, and its text no longer says they fail. Regenerated JSON and doc copied to `camel-catalog`. No header or option changed, so no endpoint DSL change. - Upgrade guide 4.24: new `camel-hashicorp-vault` section on the changed behaviour. ### Not changed - A `List` body still goes to Vault as is and fails there. - The `@version` of a `hashicorp:` property is not checked; it comes from the route author's configuration. ### Open question The issue also proposed failing at endpoint start when `cloud=true` has no namespace. I chose the fallback because the refresh task already does it. If HCP should require a namespace, failing at start is easy to add. _Claude Code on behalf of Claus Ibsen (davsclaus)_ 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
