oscerd opened a new pull request, #26437:
URL: https://github.com/apache/camel/pull/26437
## What
`allowKey` can now reach a verdict nested inside the decision document, and
an unreadable decision is logged where an operator will see it.
## Why
```java
if (decision instanceof Map<?, ?> map && map.get(allowKey) instanceof
Boolean b) {
```
A single top-level lookup, so a policy returning `{"result": {"allow":
true}}` — a common shape when querying a package rather than a specific rule
head — could not be read, and the component denied.
Failing closed is correct. The problem is that the failure is
**indistinguishable from a genuine denial**: the route sees
`CamelOpaDecisionAllow=false` either way, so a misconfigured `allowKey` looks
exactly like an authorization decision, and the only hint sat at DEBUG.
## What changed
- **`allowKey` accepts a dotted path.** `allowKey=result.allow` walks into
the document; a key with no dot is looked up directly, exactly as before, so
this is backwards compatible. A path that does not resolve, or that runs past a
non-map value, still denies.
- **The unreadable-decision log moves DEBUG → WARN** and names the header
carrying the raw document, so the operator is pointed at what the policy
actually returned instead of having to guess.
## Testing
Three new cases in `OpaProducerTest` (15 total):
- a nested verdict resolves through the dotted path
- a dotted path that does not resolve fails closed, with the raw document
still on the exchange
- a dotted path that runs past a non-map fails closed rather than throwing
The first was confirmed to **fail with the change reverted**. Full reactor
build green.
`main` only. Backwards compatible.
_Claude Code on behalf of @oscerd_
🤖 Generated with [Claude Code](https://claude.com/claude-code)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
