oscerd opened a new pull request, #28703: URL: https://github.com/apache/camel/pull/28703
This fixes [CAMEL-26408](https://issues.apache.org/jira/browse/CAMEL-26408). ## Problem `OpenFgaProducer.batchCheck` authorizes one subject against many objects by issuing one OpenFGA check per object through `clientBatchCheck`, with at most `maxParallelRequests` (default 10) in flight — i.e. `ceil(n / maxParallelRequests)` serialized waves for `n` objects. The whole batch is a single future, but it was awaited with the **single-request** bound from `OpenFgaAuthorizer` — `(connectTimeout + readTimeout) * (maxRetries + 1) + margin`, ~85s by default. So a large batch against a slow or degraded OpenFGA could exceed that single-request budget; the Camel-level `future.get(...)` would then cancel the in-flight batch and surface a misleading `Timed out after 85000ms ...`. It fails closed (`batchCheck` has no `failOpen` — handing back an unfiltered list would be the leak the filtering prevents), so this is a robustness / diagnostics bug, not a security issue, and it only bites under high per-check latency combined with a large batch. ## Fix - Separate the per-request time from the safety margin in `OpenFgaAuthorizer`. - Add `batchAwaitTimeoutMillis(objectCount, maxParallelRequests)`, which multiplies the per-request time by the number of fan-out waves and adds the margin once. - `batchCheck` awaits with that scaled bound via a new `await(..., timeoutMillis)` overload — which also makes the timeout message report the bound that actually applied. ## Notes - No `@UriParam` / `@Metadata` / header / `.adoc` changes, so no catalog/dsl regeneration. - New deterministic unit test `OpenFgaAuthorizerTest` covers the wave scaling and the `maxParallelRequests <= 0` and empty-batch edges (no timing, so not flaky). - Full `camel-openfga` module build + tests green (125 unit, 18 IT). - Related but distinct: CAMEL-26197 (other `batchCheck` bugs, handled separately). _Claude Code on behalf of oscerd_ 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
