Claus Ibsen created CAMEL-24830:
-----------------------------------
Summary: camel-opa - OpaSecurityPolicy should support the
in-process WASM evaluation mode
Key: CAMEL-24830
URL: https://issues.apache.org/jira/browse/CAMEL-24830
Project: Camel
Issue Type: Improvement
Reporter: Claus Ibsen
h2. Problem
{{OpaSecurityPolicy}} (an {{AuthorizationPolicy}}) is the idiomatic way to
guard a route segment: {{.policy(opaPolicy)}} and a deny throws
{{CamelAuthorizationException}}. But it only has the server constructor,
{{OpaSecurityPolicy(String serverUrl, String policyPath)}}, so it can only use
the REST evaluator. The producer supports
{{evaluationMode=wasm&policyBundle=...}} for in-process evaluation, and that is
the mode we recommend for hot paths such as AI tool calls (see the blog post
"Authorizing what an AI agent may do in Apache Camel"), which today has to fall
back to {{interceptFrom}} + {{opa:}} producer + {{choice/stop}} because the
policy cannot do it.
h2. Proposal
* Add a WASM mode to {{OpaSecurityPolicy}}, e.g. a constructor/setters for
{{policyBundle}} (and {{evaluationMode}}), reusing
{{OpaWasmEvaluator}}/{{OpaWasmPolicyPool}} from the producer.
* The decision contract ({{CamelOpaDecisionAllow}}, {{CamelOpaDecision}}
headers, {{CamelAuthorizationException}} on deny) must be identical across
modes.
* No health check registered in WASM mode, consistent with CAMEL-24743.
* Document it in {{opa-component.adoc}} under "As a security policy", and
update the {{ai-tools-spiffe-opa}} example in camel-examples to use
{{.policy(...)}} once available.
Related: CAMEL-24743.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
