oscerd commented on code in PR #28155:
URL: https://github.com/apache/camel/pull/28155#discussion_r4325596319
##########
components/camel-ai/camel-a2a/src/main/java/org/apache/camel/component/a2a/auth/A2AUserProfile.java:
##########
@@ -119,14 +122,43 @@ public Map<String, Object> asMap() {
return Collections.unmodifiableMap(map);
}
+ /**
+ * The key of the caller that owns the tasks it creates. A validated token
is keyed by its subject or, for a token
+ * without a subject, by the client it was issued to (the {@code
client_id} or {@code azp} claim). A profile without
+ * a token, such as one of an API key, is keyed by its scheme, which every
caller with that credential shares.
+ */
public String ownerKey() {
- if (issuer != null || subject != null) {
- return String.valueOf(issuer) + "|" + String.valueOf(subject);
+ if (hasSubject()) {
+ return issuer + "|" + subject;
+ }
+ String client = clientId();
Review Comment:
Agreed, done in b8e9543a0e9e. A token without `sub` is now keyed by its
`username` claim, the resource owner of an RFC 7662 introspection response, as
`user|<issuer>|<username>`. Only when there is no `username` does the
`client_id`/`azp` fallback apply, as `client|<issuer>|<client>`. So the users
of one client keep their tasks apart, and a client credentials token is still
keyed by its client. The distinct prefixes keep the three kinds of key from
colliding.
Tests:
`A2AAuthHandlerTest.validateConsumerAuthKeysAnIntrospectedTokenWithoutSubjectByItsUser`
and `A2AConsumerCallerProfileTest.tasksOfTheUsersOfAClientAreSeparate`, which
has two users of the same client. Both fail with the client-only fallback. The
docs and the upgrade-guide notes mention `username` too.
_Claude Code on behalf of Andrea Cosentino (@oscerd)_
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
