This is an automated email from the ASF dual-hosted git repository.
shreemaan-abhishek pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/apisix.git
The following commit(s) were added to refs/heads/master by this push:
new f88e1d2389 refactor(wolf-rbac): move header_prefix to route
configuration (#13929)
f88e1d2389 is described below
commit f88e1d2389a2587b6a57b85ac76a1156ee68b913
Author: Shreemaan Abhishek <[email protected]>
AuthorDate: Fri Oct 30 14:11:55 2026 +0800
refactor(wolf-rbac): move header_prefix to route configuration (#13929)
---
apisix/plugins/multi-auth.lua | 9 ++
apisix/plugins/wolf-rbac.lua | 70 +++++++----
docs/en/latest/plugins/wolf-rbac.md | 22 +++-
docs/zh/latest/plugins/wolf-rbac.md | 22 +++-
t/plugin/multi-auth.t | 227 ++++++++++++++++++++++++++++++++++++
t/plugin/security-warning2.t | 6 +-
t/plugin/wolf-rbac.t | 195 ++++++++++++++++++++++++++++++-
7 files changed, 515 insertions(+), 36 deletions(-)
diff --git a/apisix/plugins/multi-auth.lua b/apisix/plugins/multi-auth.lua
index 3b9660d7b4..a015302966 100644
--- a/apisix/plugins/multi-auth.lua
+++ b/apisix/plugins/multi-auth.lua
@@ -72,6 +72,15 @@ function _M.rewrite(conf, ctx)
local status_code
local errors = {}
+ for _, auth_plugin in pairs(auth_plugins) do
+ for auth_plugin_name, auth_plugin_conf in pairs(auth_plugin) do
+ local auth = plugin.get(auth_plugin_name)
+ if auth.clear_auth_headers then
+ auth.clear_auth_headers(auth_plugin_conf, ctx)
+ end
+ end
+ end
+
for k, auth_plugin in pairs(auth_plugins) do
for auth_plugin_name, auth_plugin_conf in pairs(auth_plugin) do
local auth = plugin.get(auth_plugin_name)
diff --git a/apisix/plugins/wolf-rbac.lua b/apisix/plugins/wolf-rbac.lua
index f52faf0cdf..1f2d019bc4 100644
--- a/apisix/plugins/wolf-rbac.lua
+++ b/apisix/plugins/wolf-rbac.lua
@@ -22,6 +22,7 @@ local sleep = core.sleep
local ngx_re = require("ngx.re")
local http = require("resty.http")
local ngx = ngx
+local ipairs = ipairs
local rawget = rawget
local rawset = rawset
local setmetatable = setmetatable
@@ -31,27 +32,34 @@ local req_read_body = ngx.req.read_body
local req_get_body_data = ngx.req.get_body_data
local plugin_name = "wolf-rbac"
+local default_header_prefix = "X-"
local schema = {
+ type = "object",
+ properties = {
+ header_prefix = {
+ type = "string",
+ default = default_header_prefix
+ },
+ }
+}
+
+local consumer_schema = {
type = "object",
properties = {
appid = {
type = "string",
- default = "unset"
},
server = {
type = "string",
default = "http://127.0.0.1:12180";
},
- header_prefix = {
- type = "string",
- default = "X-"
- },
ssl_verify = {
type = "boolean",
},
- }
+ },
+ required = {"appid"},
}
local _M = {
@@ -60,10 +68,21 @@ local _M = {
type = 'auth',
name = plugin_name,
schema = schema,
+ consumer_schema = consumer_schema,
}
local token_version = 'V1'
+local identity_headers = {"UserId", "Username", "Nickname"}
+
+
+function _M.clear_auth_headers(conf, ctx)
+ for _, name in ipairs(identity_headers) do
+ core.request.set_header(ctx, conf.header_prefix .. name, nil)
+ end
+end
+
+
local function create_rbac_token(appid, wolf_token)
return token_version .. "#" .. appid .. "#" .. wolf_token
end
@@ -142,8 +161,19 @@ local function http_get(uri, myheaders, timeout,
ssl_verify)
end
-function _M.check_schema(conf)
- local ok, err = core.schema.check(schema, conf)
+function _M.check_schema(conf, schema_type)
+ if schema_type ~= core.schema.TYPE_CONSUMER then
+ return core.schema.check(schema, conf)
+ end
+
+ -- the old schema stored the default "X-" on every consumer
+ if conf.header_prefix ~= nil and conf.header_prefix ~=
default_header_prefix then
+ return false, "header_prefix is no longer supported in consumer
configuration, "
+ .. "move it to the route or service wolf-rbac
configuration"
+ end
+ conf.header_prefix = nil
+
+ local ok, err = core.schema.check(consumer_schema, conf)
if not ok then
return false, err
end
@@ -239,6 +269,8 @@ end
function _M.rewrite(conf, ctx)
+ _M.clear_auth_headers(conf, ctx)
+
local url = ctx.var.uri
local action = ctx.var.request_method
local client_ip = core.request.get_remote_client_ip(ctx)
@@ -287,23 +319,11 @@ function _M.rewrite(conf, ctx)
local username = nil
local nickname = nil
- local prefix = cur_consumer.auth_conf.header_prefix or ''
- -- drop client-supplied identity headers before trusting the auth response
- core.request.set_header(ctx, prefix .. "UserId", nil)
- core.request.set_header(ctx, prefix .. "Username", nil)
- core.request.set_header(ctx, prefix .. "Nickname", nil)
if type(res.userInfo) == 'table' then
local userInfo = res.userInfo
ctx.userInfo = userInfo
- local userId = userInfo.id
username = userInfo.username
nickname = userInfo.nickname or userInfo.username
- core.response.set_header(prefix .. "UserId", userId)
- core.response.set_header(prefix .. "Username", username)
- core.response.set_header(prefix .. "Nickname",
ngx.escape_uri(nickname))
- core.request.set_header(ctx, prefix .. "UserId", userId)
- core.request.set_header(ctx, prefix .. "Username", username)
- core.request.set_header(ctx, prefix .. "Nickname",
ngx.escape_uri(nickname))
end
if res.status ~= 200 then
@@ -312,6 +332,16 @@ function _M.rewrite(conf, ctx)
") failed, res status: ", res.status, ", err: ", res.err)
return res.status, fail_response(res.err, { username = username,
nickname = nickname })
end
+ if type(res.userInfo) == 'table' then
+ local prefix = conf.header_prefix
+ local userId = res.userInfo.id
+ core.response.set_header(prefix .. "UserId", userId)
+ core.response.set_header(prefix .. "Username", username)
+ core.response.set_header(prefix .. "Nickname",
ngx.escape_uri(nickname))
+ core.request.set_header(ctx, prefix .. "UserId", userId)
+ core.request.set_header(ctx, prefix .. "Username", username)
+ core.request.set_header(ctx, prefix .. "Nickname",
ngx.escape_uri(nickname))
+ end
consumer.attach_consumer(ctx, cur_consumer, consumer_conf)
core.log.info("wolf-rbac check permission passed")
end
diff --git a/docs/en/latest/plugins/wolf-rbac.md
b/docs/en/latest/plugins/wolf-rbac.md
index 9ee62459c5..680b2649b9 100644
--- a/docs/en/latest/plugins/wolf-rbac.md
+++ b/docs/en/latest/plugins/wolf-rbac.md
@@ -34,11 +34,19 @@ The `wolf-rbac` Plugin provides a [role-based access
control](https://en.wikiped
## Attributes
-| Name | Type | Required | Default | Description
|
-|---------------|--------|----------|--------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| server | string | False | "http://127.0.0.1:12180"; | Service
address of wolf server.
|
-| appid | string | False | "unset" | App id added
in wolf console. This field supports saving the value in Secret Manager using
the [APISIX Secret](../terminology/secret.md) resource. |
-| header_prefix | string | False | "X-" | Prefix for a
custom HTTP header. After authentication is successful, three headers will be
added to the request header (for backend) and response header (for frontend)
namely: `X-UserId`, `X-Username`, and `X-Nickname`. |
+### Consumer
+
+| Name | Type | Required | Default | Description |
+| --- | --- | --- | --- | --- |
+| appid | string | True | | App id added in wolf console. This field supports
saving the value in Secret Manager using the [APISIX
Secret](../terminology/secret.md) resource. |
+| server | string | False | "http://127.0.0.1:12180"; | Service address of wolf
server. |
+| ssl_verify | boolean | False | false | If true, verify the TLS certificate
of the wolf server. |
+
+### Route or Service
+
+| Name | Type | Required | Default | Description |
+| --- | --- | --- | --- | --- |
+| header_prefix | string | False | "X-" | Prefix for the identity headers.
After authentication is successful, three headers will be added to the request
header (for backend) and response header (for frontend) namely:
`{prefix}UserId`, `{prefix}Username`, and `{prefix}Nickname`. Client-supplied
headers with these names are removed before authentication. |
## API
@@ -114,6 +122,10 @@ curl http://127.0.0.1:9180/apisix/admin/routes/1 -H
"X-API-KEY: $admin_key" -X
You can also use the [APISIX Dashboard](/docs/dashboard/USER_GUIDE) to
complete the operation through a web UI.
+## Upgrade
+
+`header_prefix` is configured on the Route or Service and is no longer
accepted on the Consumer. Before upgrading, move a custom `header_prefix` from
each Consumer to every Route or Service that uses `wolf-rbac`, including
`wolf-rbac` configured inside `multi-auth`, and remove it from the Consumer. A
Consumer that still sets a value other than the default `"X-"` fails
validation. `appid`, `server`, and `ssl_verify` stay on the Consumer.
+
<!--
diff --git a/docs/zh/latest/plugins/wolf-rbac.md
b/docs/zh/latest/plugins/wolf-rbac.md
index 058029ca3d..eaf747179b 100644
--- a/docs/zh/latest/plugins/wolf-rbac.md
+++ b/docs/zh/latest/plugins/wolf-rbac.md
@@ -34,11 +34,19 @@ description: 本文介绍了关于 Apache APISIX `wolf-rbac` 插件的基本信
## 属性
-| 名称 | 类型 | 必选项 | 默认值 | 描述
|
-| ------------- | ------ | ------ | ------------------------ |
--------------------------------------------------------------------------------------------------------------------------------------------------
|
-| server | string | 否 | "http://127.0.0.1:12180"; | `wolf-server`
的服务地址。
|
-| appid | string | 否 | "unset" | 在 `wolf-console`
中已经添加的应用 id。该字段支持使用 [APISIX Secret](../terminology/secret.md) 资源，将值保存在 Secret
Manager 中。 |
-| header_prefix | string | 否 | "X-" | 自定义 HTTP
头的前缀。`wolf-rbac` 在鉴权成功后，会在请求头 (用于传给后端) 及响应头 (用于传给前端) 中添加 3 个 header：`X-UserId`,
`X-Username`, `X-Nickname`。|
+### Consumer
+
+| 名称 | 类型 | 必选项 | 默认值 | 描述 |
+| --- | --- | --- | --- | --- |
+| appid | string | 是 | | 在 `wolf-console` 中已经添加的应用 id。该字段支持使用 [APISIX
Secret](../terminology/secret.md) 资源，将值保存在 Secret Manager 中。 |
+| server | string | 否 | "http://127.0.0.1:12180"; | `wolf-server` 的服务地址。 |
+| ssl_verify | boolean | 否 | false | 为 true 时，验证 `wolf-server` 的 TLS 证书。 |
+
+### Route 或 Service
+
+| 名称 | 类型 | 必选项 | 默认值 | 描述 |
+| --- | --- | --- | --- | --- |
+| header_prefix | string | 否 | "X-" | 身份 HTTP 头的前缀。`wolf-rbac` 在鉴权成功后，会在请求头
(用于传给后端) 及响应头 (用于传给前端) 中添加 3 个
header：`{prefix}UserId`、`{prefix}Username`、`{prefix}Nickname`。客户端传入的同名请求头会在鉴权前被移除。
|
## 接口
@@ -117,6 +125,10 @@ curl http://127.0.0.1:9180/apisix/admin/routes/1 \
你还可以通过 [APISIX Dashboard](https://github.com/apache/apisix-dashboard) 的 Web
界面完成上述操作。
+## 升级
+
+`header_prefix` 需要配置在 Route 或 Service 上，Consumer 不再支持该字段。升级前，请将 Consumer 上自定义的
`header_prefix` 移至每个使用 `wolf-rbac` 的 Route 或 Service（包括 `multi-auth` 中的
`wolf-rbac`），并从 Consumer 中删除。如果 Consumer 仍设置了默认值 `"X-"`
以外的值，校验将失败。`appid`、`server` 和 `ssl_verify` 仍配置在 Consumer 上。
+
<!--
diff --git a/t/plugin/multi-auth.t b/t/plugin/multi-auth.t
index 4cb017fe71..a32f6e1e0d 100644
--- a/t/plugin/multi-auth.t
+++ b/t/plugin/multi-auth.t
@@ -655,3 +655,230 @@ GET /t
code: 401
--- no_error_log
[error]
+
+
+
+=== TEST 23: add a Wolf consumer and configure Wolf before key-auth
+--- config
+ location /t {
+ content_by_lua_block {
+ local t = require("lib.test_admin").test
+ local code, body = t('/apisix/admin/consumers',
+ ngx.HTTP_PUT,
+ [[{
+ "username": "wolf-client",
+ "plugins": {
+ "wolf-rbac": {
+ "appid": "multi-auth-wolf-app",
+ "server": "http://127.0.0.1:1982";
+ }
+ }
+ }]]
+ )
+ if code >= 300 then
+ ngx.status = code
+ ngx.say(body)
+ return
+ end
+
+ code, body = t('/apisix/admin/routes/1',
+ ngx.HTTP_PUT,
+ [[{
+ "plugins": {
+ "multi-auth": {
+ "auth_plugins": [
+ {
+ "wolf-rbac": {
+ "header_prefix": "X-Wolf-"
+ }
+ },
+ {
+ "key-auth": {}
+ }
+ ]
+ },
+ "serverless-post-function": {
+ "phase": "access",
+ "functions": [
+ "return function(conf, ctx) local core =
require(\"apisix.core\"); local names = {\"X-Wolf-UserId\",
\"X-Wolf-Username\", \"X-Wolf-Nickname\", \"X-Consumer-Username\"}; local
values = {}; for i, name in ipairs(names) do values[i] =
core.request.header(ctx, name) or \"nil\"; end; core.response.exit(200,
table.concat(values, \",\")); end"
+ ]
+ }
+ },
+ "upstream": {
+ "nodes": {
+ "127.0.0.1:1980": 1
+ },
+ "type": "roundrobin"
+ },
+ "uri": "/hello"
+ }]]
+ )
+
+ if code >= 300 then
+ ngx.status = code
+ end
+ ngx.say(body)
+ }
+ }
+--- request
+GET /t
+--- response_body
+passed
+
+
+
+=== TEST 24: Wolf clears its Route header namespace before fallback
+--- request
+GET /hello
+--- more_headers
+apikey: auth-one
+X-Wolf-UserId: admin-001
+X-Wolf-Username: admin
+X-Wolf-Nickname: administrator
+--- response_body eval
+"nil,nil,nil,foo"
+
+
+
+=== TEST 25: malformed Wolf token does not preserve Route identity headers
+--- request
+GET /hello
+--- more_headers
+x-rbac-token: malformed
+apikey: auth-one
+X-Wolf-UserId: forged
+X-Wolf-Username: forged
+X-Wolf-Nickname: forged
+--- response_body eval
+"nil,nil,nil,foo"
+
+
+
+=== TEST 26: Wolf headers are cleared when key-auth succeeds first
+--- config
+ location /t {
+ content_by_lua_block {
+ local t = require("lib.test_admin").test
+ local code, body = t('/apisix/admin/routes/1',
+ ngx.HTTP_PUT,
+ [[{
+ "plugins": {
+ "multi-auth": {
+ "auth_plugins": [
+ {
+ "key-auth": {}
+ },
+ {
+ "wolf-rbac": {
+ "header_prefix": "X-Wolf-"
+ }
+ }
+ ]
+ },
+ "serverless-post-function": {
+ "phase": "access",
+ "functions": [
+ "return function(conf, ctx) local core =
require(\"apisix.core\"); local names = {\"X-Wolf-UserId\",
\"X-Wolf-Username\", \"X-Wolf-Nickname\", \"X-Consumer-Username\"}; local
values = {}; for i, name in ipairs(names) do values[i] =
core.request.header(ctx, name) or \"nil\"; end; core.response.exit(200,
table.concat(values, \",\")); end"
+ ]
+ }
+ },
+ "upstream": {
+ "nodes": {
+ "127.0.0.1:1980": 1
+ },
+ "type": "roundrobin"
+ },
+ "uri": "/hello"
+ }]]
+ )
+ if code >= 300 then
+ ngx.status = code
+ ngx.say(body)
+ return
+ end
+
+ local code, _, body = t('/hello', ngx.HTTP_GET, nil, nil, {
+ apikey = "auth-one",
+ ["X-Wolf-UserId"] = "admin-001",
+ ["X-Wolf-Username"] = "admin",
+ ["X-Wolf-Nickname"] = "administrator",
+ })
+ ngx.status = code
+ ngx.print(body)
+ }
+ }
+--- request
+GET /t
+--- response_body eval
+"nil,nil,nil,foo"
+
+
+
+=== TEST 27: successful Wolf authentication sets the Route header namespace
+--- request
+GET /hello
+--- more_headers
+x-rbac-token: V1#multi-auth-wolf-app#wolf-rbac-token
+X-Wolf-UserId: forged
+X-Wolf-Username: forged
+X-Wolf-Nickname: forged
+--- response_headers
+X-Wolf-UserId: 100
+X-Wolf-Username: admin
+X-Wolf-Nickname: administrator
+--- response_body eval
+"100,admin,administrator,wolf-client"
+
+
+
+=== TEST 28: empty Wolf configuration uses the default header prefix
+--- config
+ location /t {
+ content_by_lua_block {
+ local t = require("lib.test_admin").test
+ local code, body = t('/apisix/admin/routes/1',
+ ngx.HTTP_PUT,
+ [[{
+ "plugins": {
+ "multi-auth": {
+ "auth_plugins": [
+ {"key-auth": {}},
+ {"wolf-rbac": {}}
+ ]
+ },
+ "serverless-post-function": {
+ "phase": "access",
+ "functions": [
+ "return function(conf, ctx) local core =
require(\"apisix.core\"); local names = {\"X-UserId\", \"X-Username\",
\"X-Nickname\", \"X-Consumer-Username\"}; local values = {}; for i, name in
ipairs(names) do values[i] = core.request.header(ctx, name) or \"nil\"; end;
core.response.exit(200, table.concat(values, \",\")); end"
+ ]
+ }
+ },
+ "upstream": {
+ "nodes": {
+ "127.0.0.1:1980": 1
+ },
+ "type": "roundrobin"
+ },
+ "uri": "/hello"
+ }]]
+ )
+ if code >= 300 then
+ ngx.status = code
+ ngx.say(body)
+ return
+ end
+
+ code, _, body = t('/hello', ngx.HTTP_GET, nil, nil, {
+ apikey = "auth-one",
+ ["X-UserId"] = "forged",
+ ["X-Username"] = "forged",
+ ["X-Nickname"] = "forged",
+ })
+ ngx.status = code
+ ngx.print(body)
+ }
+ }
+--- request
+GET /t
+--- response_body eval
+"nil,nil,nil,foo"
diff --git a/t/plugin/security-warning2.t b/t/plugin/security-warning2.t
index 886452a7b2..7d4c56450d 100644
--- a/t/plugin/security-warning2.t
+++ b/t/plugin/security-warning2.t
@@ -568,10 +568,12 @@ Keeping tls disabled in tcp-logger configuration is a
security risk
content_by_lua_block {
local plugin = require("apisix.plugins.wolf-rbac")
local conf = {
+ appid = "wolf-rbac-app",
server = "http://127.0.0.1:12180";
}
- local ok, err = plugin.check_schema(conf)
+ local ok, err = plugin.check_schema(conf,
+ require("apisix.core").schema.TYPE_CONSUMER)
if not ok then
ngx.say(err)
end
@@ -580,7 +582,7 @@ Keeping tls disabled in tcp-logger configuration is a
security risk
}
}
--- response_body_like eval
-qr/\{"appid":"unset","header_prefix":"X-","server":"http:\/\/127\.0\.0\.1:12180"\}/
+qr/\{"appid":"wolf-rbac-app","server":"http:\/\/127\.0\.0\.1:12180"\}/
--- error_log
Using wolf-rbac server with no TLS is a security risk
diff --git a/t/plugin/wolf-rbac.t b/t/plugin/wolf-rbac.t
index cb8638b994..396c214fa5 100644
--- a/t/plugin/wolf-rbac.t
+++ b/t/plugin/wolf-rbac.t
@@ -51,10 +51,18 @@ __DATA__
end
ngx.say(require("toolkit.json").encode(conf))
+
+ local consumer_conf = {appid = "wolf-rbac-app"}
+ ok, err = plugin.check_schema(consumer_conf,
+ require("apisix.core").schema.TYPE_CONSUMER)
+ if not ok then
+ ngx.say(err)
+ end
+ ngx.say(require("toolkit.json").encode(consumer_conf))
}
}
--- response_body_like eval
-qr/\{"appid":"unset","header_prefix":"X-","server":"http:\/\/127\.0\.0\.1:12180"\}/
+qr/\{"header_prefix":"X-"\}\n\{"appid":"wolf-rbac-app","server":"http:\/\/127\.0\.0\.1:12180"\}/
@@ -63,7 +71,8 @@
qr/\{"appid":"unset","header_prefix":"X-","server":"http:\/\/127\.0\.0\.1:12180"
location /t {
content_by_lua_block {
local plugin = require("apisix.plugins.wolf-rbac")
- local ok, err = plugin.check_schema({appid = 123})
+ local ok, err = plugin.check_schema({appid = 123},
+ require("apisix.core").schema.TYPE_CONSUMER)
if not ok then
ngx.say(err)
end
@@ -847,8 +856,9 @@ ssl_verify: true
location /t {
content_by_lua_block {
local plugin = require("apisix.plugins.wolf-rbac")
- local conf = {ssl_verify = "true"}
- local ok, err = plugin.check_schema(conf)
+ local conf = {appid = "wolf-rbac-app", ssl_verify = "true"}
+ local ok, err = plugin.check_schema(conf,
+ require("apisix.core").schema.TYPE_CONSUMER)
if not ok then
ngx.say(err)
return
@@ -961,3 +971,180 @@ X-Username: spoofadmin
qr/(?s)^(?!.*spoofid007)(?!.*spoofadmin).*authorization/
--- no_error_log
[error]
+
+
+
+=== TEST 45: appid is required in Consumer configuration
+--- config
+ location /t {
+ content_by_lua_block {
+ local plugin = require("apisix.plugins.wolf-rbac")
+ local ok, err = plugin.check_schema({},
+ require("apisix.core").schema.TYPE_CONSUMER)
+ if not ok then
+ ngx.say(err)
+ end
+ }
+ }
+--- response_body_like eval
+qr/property "appid" is required/
+
+
+
+=== TEST 46: custom header_prefix is rejected in Consumer configuration
+--- config
+ location /t {
+ content_by_lua_block {
+ local t = require("lib.test_admin").test
+ local code, body = t('/apisix/admin/consumers',
+ ngx.HTTP_PUT,
+ [[{
+ "username": "wolf_rbac_custom_prefix",
+ "plugins": {
+ "wolf-rbac": {
+ "appid": "wolf-rbac-app-prefix",
+ "header_prefix": "X-Wolf-"
+ }
+ }
+ }]]
+ )
+ ngx.status = code
+ ngx.print(body)
+ }
+ }
+--- error_code: 400
+--- response_body_like eval
+qr/header_prefix is no longer supported in consumer configuration/
+
+
+
+=== TEST 47: legacy default header_prefix in Consumer configuration is dropped
+--- config
+ location /t {
+ content_by_lua_block {
+ local plugin = require("apisix.plugins.wolf-rbac")
+ local conf = {appid = "wolf-rbac-app", header_prefix = "X-"}
+ local ok, err = plugin.check_schema(conf,
+ require("apisix.core").schema.TYPE_CONSUMER)
+ if not ok then
+ ngx.say(err)
+ end
+ ngx.say(require("toolkit.json").encode(conf))
+ }
+ }
+--- response_body
+{"appid":"wolf-rbac-app","server":"http://127.0.0.1:12180"}
+
+
+
+=== TEST 48: route with a custom header_prefix
+--- config
+ location /t {
+ content_by_lua_block {
+ local t = require("lib.test_admin").test
+ local code, body = t('/apisix/admin/consumers',
+ ngx.HTTP_PUT,
+ [[{
+ "username": "wolf_rbac_route_prefix",
+ "plugins": {
+ "wolf-rbac": {
+ "appid": "wolf-rbac-app-prefix",
+ "server": "http://127.0.0.1:1982";
+ }
+ }
+ }]]
+ )
+ if code >= 300 then
+ ngx.status = code
+ ngx.say(body)
+ return
+ end
+
+ code, body = t('/apisix/admin/routes/1',
+ ngx.HTTP_PUT,
+ [[{
+ "plugins": {
+ "wolf-rbac": {
+ "header_prefix": "X-Wolf-"
+ },
+ "serverless-post-function": {
+ "phase": "access",
+ "functions": [
+ "return function(conf, ctx) local core =
require(\"apisix.core\"); local names = {\"X-Wolf-UserId\",
\"X-Wolf-Username\", \"X-Wolf-Nickname\"}; local values = {}; for i, name in
ipairs(names) do values[i] = core.request.header(ctx, name) or \"nil\"; end;
core.response.exit(200, table.concat(values, \",\")); end"
+ ]
+ }
+ },
+ "upstream": {
+ "nodes": {
+ "127.0.0.1:1980": 1
+ },
+ "type": "roundrobin"
+ },
+ "uri": "/hello"
+ }]]
+ )
+
+ if code >= 300 then
+ ngx.status = code
+ end
+ ngx.say(body)
+ }
+ }
+--- response_body
+passed
+
+
+
+=== TEST 49: route header_prefix replaces client-supplied identity headers
+--- request
+GET /hello
+--- more_headers
+Authorization: V1#wolf-rbac-app-prefix#wolf-rbac-token
+X-Wolf-UserId: forged
+X-Wolf-Username: forged
+X-Wolf-Nickname: forged
+--- response_headers
+X-Wolf-UserId: 100
+X-Wolf-Username: admin
+X-Wolf-Nickname: administrator
+--- response_body chomp
+100,admin,administrator
+
+
+
+=== TEST 50: public API uses the server of the matched Consumer
+--- config
+ location /t {
+ content_by_lua_block {
+ local t = require("lib.test_admin").test
+ local code, body = t('/apisix/admin/consumers',
+ ngx.HTTP_PUT,
+ [[{
+ "username": "wolf_rbac_other_server",
+ "plugins": {
+ "wolf-rbac": {
+ "appid": "wolf-rbac-app-other",
+ "server": "http://127.0.0.1:1983";
+ }
+ }
+ }]]
+ )
+ if code >= 300 then
+ ngx.status = code
+ ngx.say(body)
+ return
+ end
+
+ code, body = t('/apisix/plugin/wolf-rbac/login',
+ ngx.HTTP_POST,
+ [[{"appid": "wolf-rbac-app-other", "username": "admin",
"password": "123456"}]],
+ nil,
+ {["Content-Type"] = "application/json"}
+ )
+ ngx.say(code)
+ }
+ }
+--- response_body
+500
+--- error_log eval
+qr/request \[.*127\.0\.0\.1:1983.*login\.rest.*\] failed/
