222twotwotwo commented on code in PR #947: URL: https://github.com/apache/dubbo-go-pixiu/pull/947#discussion_r3642450729
########## admin/initialize/E2E_OPA.md: ########## @@ -0,0 +1,71 @@ +# Admin OPA → Gateway OPA Full-Link E2E + +**English** | [中文](E2E_OPA_CN.md) + +## What the suite verifies + +The harness stands up: + +1. A **smart in-process OPA mock** (`regoMockOPA`) — uses the real + `github.com/open-policy-agent/opa/rego` library to compile and evaluate + modules, so policy semantics in tests match what a real OPA daemon would + do. No docker, no etcd, no real OPA binary required. +2. **The real admin Gin router** via `initialize.Routers()` with + `adminconfig.Bootstrap.OPA.ServerURL` pointed at the mock. +3. **The real gateway OPA filter** from `pkg/filter/opa` (via the public + `Plugin.CreateFilterFactory()` API) pointed at the same mock URL. + +Each test publishes a policy through the admin REST PUT, then drives one or +more HTTP requests through the gateway filter and asserts the decision. + +| Test | Scenario | What it proves | +|---|---|---| +| `TestE2E_AllowedThroughFullChain` | PUT "allow if GET" → GET request | Admin → OPA → gateway end-to-end allow returns `filter.Continue` with no local reply | +| `TestE2E_DeniedThroughFullChain` | Same policy, POST request | Deny returns `filter.Stop` + 403, short-circuits before upstream | +| `TestE2E_DefaultDenyForAllRequests` | `default allow := false` only | 5-method matrix all denied (no rule shape can sneak past) | +| `TestE2E_PolicyHotReload` | PUT v1, then PUT v2 (no restart) | Behaviour flips on the very next request — the headline OPA-server-mode value | +| `TestE2E_DeleteCausesMissingResultFailClosed` | PUT then DELETE | Gateway returns 502 (matches `test_opa.md` §6.6) | +| `TestE2E_HeaderBasedAllowDeny` | Policy on `input.headers["X-Role"]` | Title-cased header propagation works (admin/user/missing variants) | +| `TestE2E_GatewayTimeoutFailClosed` | 200ms decision delay, 50ms gateway timeout | Returns 504, elapsed time bounded under 180ms | +| `TestE2E_PolicyIDOverrideRoutesThroughGateway` | PUT with form-level `policy_id` override Review Comment: 收到，已补充完整 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
