Andrea Cosentino created CAMEL-26560:
----------------------------------------
Summary: camel-openfga - document how to give conditionContext
typed values from YAML
Key: CAMEL-26560
URL: https://issues.apache.org/jira/browse/CAMEL-26560
Project: Camel
Issue Type: Improvement
Components: documentation
Reporter: Andrea Cosentino
Assignee: Andrea Cosentino
Fix For: 4.24.0
Found while checking how well the camel-spiffe, camel-opa and camel-openfga
configuration can be written in YAML.
h4. What happens
The YAML DSL hands every bean property to Camel as a string, the entries of a
map included. A {{conditionContext}} written in YAML, either inline on an
{{OpenFgaSecurityPolicy}} bean or as a map bean referenced with
{{conditionContext=#myContext}}, therefore reaches OpenFGA with string values:
{code:yaml}
- beans:
- name: documentReaders
type: org.apache.camel.component.openfga.security.OpenFgaSecurityPolicy
properties:
# apiUrl, storeId, relation, user, object ...
conditionContext:
trusted: true
max_amount: 100
{code}
OpenFGA converts a string for an {{int}}, {{uint}}, {{double}}, {{duration}},
{{timestamp}} or {{ipaddress}} condition parameter, but not for a {{bool}} one.
Against OpenFGA 1.22.1 (the image camel-test-infra-openfga pins), with a
relation conditioned on {{trusted && max_amount >= 50}}:
* {{trusted: true}} from YAML: the check fails with HTTP 400, {{failed to
convert context parameter 'trusted': expected type value 'bool', but found
'string'}}, and the policy denies the exchange.
* {{trusted: "#valueAs(boolean):true"}}: the value is a {{Boolean}} and the
check is allowed.
* {{max_amount: 100}} works either way.
A {{list}} or {{map}} parameter cannot be written inline at all:
{{allowed_regions\[0\]: eu}} and a nested mapping both fail at startup. A
{{java.util.ArrayList}} or {{java.util.LinkedHashMap}} bean referenced with
{{#bean:}} works.
The failure direction is safe (the exchange is denied, never allowed), but the
component page says none of this, and it has no example of building the
{{#myContext}} map at all.
h4. Proposed fix
Documentation only: in the "Contextual tuples and condition context" section of
openfga-component.adoc, add a YAML example of a condition context, say which
parameter types need {{#valueAs}}, and show the {{#bean:}} form for list and
map parameters.
The component cannot convert the values itself. It does not know the parameter
types the authorization model declares, and turning the string {{"true"}} into
a boolean would break a {{string}} parameter whose value happens to be {{true}}.
_Claude Code on behalf of oscerd_
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
