[
https://issues.apache.org/jira/browse/CAMEL-26560?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Claus Ibsen resolved CAMEL-26560.
---------------------------------
Resolution: Fixed
Fixed by https://github.com/apache/camel/pull/29138 (merged to main as
dc8e4b7d61e6).
_Claude Code on behalf of davsclaus_
> camel-openfga - document how to give conditionContext typed values from YAML
> ----------------------------------------------------------------------------
>
> Key: CAMEL-26560
> URL: https://issues.apache.org/jira/browse/CAMEL-26560
> Project: Camel
> Issue Type: Improvement
> Components: documentation
> Reporter: Andrea Cosentino
> Assignee: Andrea Cosentino
> Priority: Minor
> Fix For: 4.24.0
>
>
> Found while checking how well the camel-spiffe, camel-opa and camel-openfga
> configuration can be written in YAML.
> h4. What happens
> The YAML DSL hands every bean property to Camel as a string, the entries of a
> map included. A {{conditionContext}} written in YAML, either inline on an
> {{OpenFgaSecurityPolicy}} bean or as a map bean referenced with
> {{conditionContext=#myContext}}, therefore reaches OpenFGA with string values:
> {code:yaml}
> - beans:
> - name: documentReaders
> type: org.apache.camel.component.openfga.security.OpenFgaSecurityPolicy
> properties:
> # apiUrl, storeId, relation, user, object ...
> conditionContext:
> trusted: true
> max_amount: 100
> {code}
> OpenFGA converts a string for an {{int}}, {{uint}}, {{double}}, {{duration}},
> {{timestamp}} or {{ipaddress}} condition parameter, but not for a {{bool}}
> one. Against OpenFGA 1.22.1 (the image camel-test-infra-openfga pins), with a
> relation conditioned on {{trusted && max_amount >= 50}}:
> * {{trusted: true}} from YAML: the check fails with HTTP 400, {{failed to
> convert context parameter 'trusted': expected type value 'bool', but found
> 'string'}}, and the policy denies the exchange.
> * {{trusted: "#valueAs(boolean):true"}}: the value is a {{Boolean}} and the
> check is allowed.
> * {{max_amount: 100}} works either way.
> A {{list}} or {{map}} parameter cannot be written inline at all:
> {{allowed_regions\[0\]: eu}} and a nested mapping both fail at startup. A
> {{java.util.ArrayList}} or {{java.util.LinkedHashMap}} bean referenced with
> {{#bean:}} works.
> The failure direction is safe (the exchange is denied, never allowed), but
> the component page says none of this, and it has no example of building the
> {{#myContext}} map at all.
> h4. Proposed fix
> Documentation only: in the "Contextual tuples and condition context" section
> of openfga-component.adoc, add a YAML example of a condition context, say
> which parameter types need {{#valueAs}}, and show the {{#bean:}} form for
> list and map parameters.
> The component cannot convert the values itself. It does not know the
> parameter types the authorization model declares, and turning the string
> {{"true"}} into a boolean would break a {{string}} parameter whose value
> happens to be {{true}}.
> _Claude Code on behalf of oscerd_
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
