oscerd commented on code in PR #26664:
URL: https://github.com/apache/camel/pull/26664#discussion_r4061629565
##########
components/camel-opa/src/main/docs/opa-component.adoc:
##########
@@ -326,6 +326,25 @@ decision point available".
Setting `failOpen=true` reverses this and lets the exchange proceed when the
policy cannot be evaluated. It exists
for development and for non-critical policies, and should not be enabled in
production.
+An exchange that proceeds that way carries `CamelOpaDecisionFailedOpen=true`.
`CamelOpaDecisionAllow` is `true`
+in both cases, and on its own it cannot tell "a policy allowed this" from "no
policy ran and we were told to
+proceed" — which is exactly the distinction an audit trail needs. The marker
is set only on the fail-open path,
+so a route can branch on it and an operator can alert on its presence:
+
+[source,java]
+------------------------------------------------------------
+from("platform-http:/orders")
+ .to("opa:authz/orders/allow?failOpen=true")
+ .choice()
+ .when(header(OpaConstants.DECISION_FAILED_OPEN).isEqualTo(true))
+ .to("log:unauthorized?level=WARN")
+ .end()
+ .to("direct:orders")
+------------------------------------------------------------
+
+Like the other decision headers it is cleared before every evaluation, so a
message cannot arrive claiming
Review Comment:
Good point — the evaluator is shared, so a policy failing open sets the
marker identically, and the only reason a route author using `.policy(...)`
would know that is if they went looking in the producer's section.
Cross-referenced from the `healthCheckEnabled` note where `failOpen` already
comes up, with an anchor added to the section it points at so the link resolves:
> A policy running `failOpen` marks the exchanges it let through with
`CamelOpaDecisionFailedOpen`, exactly as the producer does; the evaluator is
shared, so everything in <<failure-handling>> about that header applies to
`.policy(...)` too.
Pushed with the regenerated catalog copy of the adoc — a docs-only edit
still needs the full reactor, since the component page is copied verbatim into
`camel-catalog`.
_Claude Code on behalf of @oscerd_
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
