oscerd opened a new pull request, #27865: URL: https://github.com/apache/camel/pull/27865
## Backport of #27819 Cherry-pick of #27819 onto `camel-4.22.x`. **Original PR:** #27819 - CAMEL-25638: camel-graphql - bind accessToken and basic credentials to the configured httpUri authority **Original author:** @oscerd **Target branch:** `camel-4.22.x` Straight cherry-pick: `GraphqlEndpoint` and `GraphqlProducer` on `camel-4.22.x` are identical to `main` before the change, and the graphql changes of this PR are identical to those of the merge commit `919fbfbeb03d`. The upgrade-guide hunk is left out, as the guides live on `main` (the 4.22.2 note follows in a separate doc PR on `main`). Tested on the branch: the camel-graphql tests (28) and a full reactor build without tests. ### Original description ## Description [CAMEL-25638](https://issues.apache.org/jira/browse/CAMEL-25638): camel-graphql configures authentication on its HTTP client itself, so the authority scoping that [CAMEL-24452](https://issues.apache.org/jira/browse/CAMEL-24452) added to camel-http did not apply to it. - `accessToken` (with `jwtAuthorizationType`) was installed with `HttpClientBuilder.setDefaultHeaders(...)`, so the `Authorization` header was added to every request the client executed, whatever its authority. It is now added by a request interceptor, only when the request goes to the scheme, host and effective port of `httpUri`. As before, it is not added when the request already carries an `Authorization` header. - `username`/`password` were registered under `new AuthScope(null, -1)`, which matches any scheme, host and port. They are now registered for the scheme, host and effective port of `httpUri`, as camel-http does since CAMEL-24452. - The authority of `httpUri` is read the way HttpClient reads it (`URIAuthority`), so a host name that `java.net.URI` does not parse, such as one with an underscore, is still matched. It is read once when the client is configured, and the token check and the `AuthScope` use the same scheme, host and port. When credentials are configured but that authority cannot be read, a warning is logged, since they are then not sent. - Since [CAMEL-22562](https://issues.apache.org/jira/browse/CAMEL-22562) (4.19.0) the producer copies every message header into the internal camel-http exchange, so `CamelHttpUri`, `CamelHttpPath`, `CamelHttpQuery` and the other camel-http control headers changed the request URL, which camel-graphql did not do before. The internal endpoint is now created with `skipControlHeaders=true`. - The internal endpoint URI appended `?httpMethod=POST` to `httpUri`, which already has a query when the endpoint has lenient parameters (such as an api key). The option was then read as part of the previous parameter, and only the `CamelHttpMethod` header kept the request a POST. Since that header is no longer read, the option is now appended with the right separator. The existing `GraphqlComponentTest.checkApiKey` covers it. Upgrade guide (4.24): - A request to another scheme, host or port is sent without the credentials. - With `proxyHost` set, the `username` and `password` are no longer offered to the proxy when it asks for authentication. - The control headers no longer change the request URL. `CamelHttpMethod` and `CamelHttpProtocolVersion` no longer apply either, so the request is always a POST. ## Tests - New `GraphqlCredentialsAuthorityTest`, against local servers: - with `followRedirects=true` on the http component, a request moved to a different host or a different port reaches it without the access token, and without the basic credentials after its 401 challenge (2 cases each); - `CamelHttpUri`, `CamelHttpPath` and `CamelHttpQuery` on the message do not change the target: the request, with its token, goes to `httpUri`. - With the main code reverted, all five cases fail. - The existing `GraphqlTokenAuthenticationTest` and `GraphqlBasicAuthenticationTest` still pass, so the credentials still reach `httpUri`. | Module | Tests | |---|---| | camel-graphql | 28 | Full reactor `mvn clean install -DskipTests -DskipITs`: green, no generated-file changes. The `httpMethod` separator change and the review follow-up (052a368c3d79) came after that run. They touch no options or metadata, and were built and tested at module level. _Claude Code on behalf of oscerd_ 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
