luigidemasi commented on code in PR #28155:
URL: https://github.com/apache/camel/pull/28155#discussion_r4322867078
##########
components/camel-ai/camel-a2a/src/main/java/org/apache/camel/component/a2a/A2AConsumer.java:
##########
@@ -1171,6 +1171,8 @@ private SendMessageResponse
processSendMessage(SendMessageRequest request, Excha
Exchange processorExchange = getEndpoint().createExchange();
processorExchange.setProperty(A2AConstants.USER_PROFILE,
exchange.getProperty(A2AConstants.USER_PROFILE));
+
processorExchange.setProperty(A2AConstants.OAUTH_TOKEN_VALIDATION_RESULT,
+
exchange.getProperty(A2AConstants.OAUTH_TOKEN_VALIDATION_RESULT));
Review Comment:
[P2] Clear failed authentication alternatives before forwarding their OAuth
result
For an agent card with requirements `[{oauth: [admin]}, {key: []}]`, send a
valid OAuth token without `admin` and a valid API key. BearerTokenExtractor
sets CamelOAuthTokenValidationResult before validateScopes rejects the OAuth
alternative. validateConsumerAuth then succeeds through the API-key alternative
without clearing that property. This new copy gives the route
`CamelA2AUserProfile={scheme=apiKey}` alongside the OAuth identity from the
failed alternative.
I reproduced this through the dispatch processor: the route receives the
API-key profile and Alice's OAuth result. The assertion that the fallback route
has no OAuth result passes with the pre-PR consumer and fails here. Route
authorization or auditing using the two properties can consequently attribute
the same request to different principals.
Please retain the result only when its complete security requirement
succeeds, or clear it when an alternative fails, and add coverage for OAuth
scope failure followed by successful API-key authentication. The same issue
affects the streaming copy below.
_AI-generated by Codex on behalf of Luigi De Masi (@luigidemasi)._
##########
components/camel-ai/camel-a2a/src/main/java/org/apache/camel/component/a2a/A2AConsumer.java:
##########
@@ -1484,6 +1486,8 @@ private void submitStreamProcessing(
QueueStreamEmitter emitter, Exchange requestExchange) {
Exchange processorExchange = getEndpoint().createExchange();
processorExchange.setProperty(A2AConstants.USER_PROFILE,
requestExchange.getProperty(A2AConstants.USER_PROFILE));
+
processorExchange.setProperty(A2AConstants.OAUTH_TOKEN_VALIDATION_RESULT,
+
requestExchange.getProperty(A2AConstants.OAUTH_TOKEN_VALIDATION_RESULT));
Review Comment:
Optional: add a regression test for validation-result propagation through
message streaming. Deleting just these two new lines leaves all 524 committed
tests green. A focused probe that authenticates through
createDispatchProcessor, calls handleMessageStream, and asserts the route
receives the same OAuthTokenValidationResult passes on this head and fails when
this copy is removed.
_AI-generated by Codex on behalf of Luigi De Masi (@luigidemasi)._
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
