[
https://issues.apache.org/jira/browse/CAMEL-24645?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18112698#comment-18112698
]
Andrea Cosentino commented on CAMEL-24645:
------------------------------------------
Merged via https://github.com/apache/camel/pull/26195
_Claude Code on behalf of oscerd_
> camel-opa - cover the bearerToken option with an integration test
> -----------------------------------------------------------------
>
> Key: CAMEL-24645
> URL: https://issues.apache.org/jira/browse/CAMEL-24645
> Project: Camel
> Issue Type: Test
> Reporter: Andrea Cosentino
> Assignee: Andrea Cosentino
> Priority: Minor
> Fix For: 4.23.0
>
>
> h2. Problem
> {{camel-opa}} (CAMEL-24634) exposes a {{bearerToken}} option for an OPA
> server that has its API authentication enabled. It is wired through
> {{OpaPolicyEvaluator.createClient}}:
> {code:java}
> if (ObjectHelper.isNotEmpty(bearerToken)) {
> return new OPAClient(serverUrl, Map.of("Authorization", "Bearer " +
> bearerToken));
> }
> return new OPAClient(serverUrl);
> {code}
> No test exercises it. The unit tests all inject a mocked {{OPAClient}}, which
> bypasses {{createClient}} entirely, and {{OpaIT}} runs an unauthenticated OPA
> container. So nothing verifies that the token actually reaches the server as
> an {{Authorization}} header.
> This is a security-relevant option - if it silently failed to be applied, a
> deployment would believe it was authenticating to its policy decision point
> when it was not.
> h2. Proposal
> Extend {{OpaIT}} (or add a sibling IT) with a case that starts OPA with token
> authentication enabled and asserts both directions:
> * a request carrying the configured {{bearerToken}} is authorized and returns
> a decision;
> * a request without it, or with the wrong token, is rejected - and the
> component fails closed on that rejection rather than treating it as a deny.
> OPA is started with {{--authentication=token}} plus an authorization policy
> over {{input.identity}}. The existing {{camel-test-infra-opa}} service starts
> a plain server, so this likely needs either a second container configuration
> or a parameter on the local container service.
> h2. Scope
> {{main}} only. Test-only change.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
