oscerd commented on code in PR #28155:
URL: https://github.com/apache/camel/pull/28155#discussion_r4324053669
##########
components/camel-ai/camel-a2a/src/main/java/org/apache/camel/component/a2a/A2AConsumer.java:
##########
@@ -1171,6 +1171,8 @@ private SendMessageResponse
processSendMessage(SendMessageRequest request, Excha
Exchange processorExchange = getEndpoint().createExchange();
processorExchange.setProperty(A2AConstants.USER_PROFILE,
exchange.getProperty(A2AConstants.USER_PROFILE));
+
processorExchange.setProperty(A2AConstants.OAUTH_TOKEN_VALIDATION_RESULT,
+
exchange.getProperty(A2AConstants.OAUTH_TOKEN_VALIDATION_RESULT));
Review Comment:
Confirmed, and fixed in 83ef6ac0341a. `A2AAuthHandler.validateConsumerAuth`
now removes `CamelOAuthTokenValidationResult` when a security requirement is
not satisfied, so a result that reaches the route always belongs to the
requirement that authenticated the caller. The streaming path copies the same
exchange property, so it is covered too.
Tests, both failing with the removal reverted:
-
`A2AAuthHandlerTest.validateConsumerAuthDropsTheTokenOfARequirementThatIsNotSatisfied`
-
`A2AConsumerCallerProfileTest.routeDoesNotReceiveTheTokenOfARequirementThatIsNotSatisfied`
- your scenario through `createDispatchProcessor`: requirements `[{oauth:
[admin]}, {agentKey: []}]`, a valid token without `admin` and a valid API key;
the route gets `{scheme=apiKey}` and no OAuth result.
_Claude Code on behalf of Andrea Cosentino (@oscerd)_
##########
components/camel-ai/camel-a2a/src/main/java/org/apache/camel/component/a2a/A2AConsumer.java:
##########
@@ -1484,6 +1486,8 @@ private void submitStreamProcessing(
QueueStreamEmitter emitter, Exchange requestExchange) {
Exchange processorExchange = getEndpoint().createExchange();
processorExchange.setProperty(A2AConstants.USER_PROFILE,
requestExchange.getProperty(A2AConstants.USER_PROFILE));
+
processorExchange.setProperty(A2AConstants.OAUTH_TOKEN_VALIDATION_RESULT,
+
requestExchange.getProperty(A2AConstants.OAUTH_TOKEN_VALIDATION_RESULT));
Review Comment:
Added
`A2AConsumerCallerProfileTest.routeReceivesTheOAuthTokenValidationResultWhenStreaming`
in 83ef6ac0341a: it calls `handleMessageStream`, reads the stream to its end
and asserts that the route received the same `OAuthTokenValidationResult`. It
fails when the copy in `submitStreamProcessing` is removed.
_Claude Code on behalf of Andrea Cosentino (@oscerd)_
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
