gnodet-bot commented on code in PR #29109:
URL: https://github.com/apache/camel/pull/29109#discussion_r4457983891


##########
components/camel-openstack/src/main/java/org/apache/camel/component/openstack/common/AbstractOpenstackProducer.java:
##########
@@ -26,20 +26,58 @@
 import org.apache.camel.util.ObjectHelper;
 import org.apache.camel.util.StringHelper;
 import org.openstack4j.api.OSClient;
+import org.openstack4j.api.OSClient.OSClientV2;
+import org.openstack4j.api.OSClient.OSClientV3;
 import org.openstack4j.model.common.ActionResponse;
 import org.openstack4j.model.common.Payload;
 import org.openstack4j.model.common.Payloads;
+import org.openstack4j.openstack.OSFactory;
 
 public abstract class AbstractOpenstackProducer extends DefaultProducer {
 
     protected OSClient os;
 
-    private AbstractOpenstackEndpoint endpoint;
+    private final AbstractOpenstackEndpoint endpoint;
+
+    // the session with the newest token, as openstack4j re-authenticates an 
expired token into the session in use
+    private volatile OSClient session;
 
     protected AbstractOpenstackProducer(AbstractOpenstackEndpoint endpoint, 
OSClient client) {
         super(endpoint);
         this.os = client;
         this.endpoint = endpoint;
+        this.session = client;
+    }
+
+    @Override
+    public void process(Exchange exchange) throws Exception {
+        final OSClient current = useSession();
+        try {
+            doProcess(exchange);
+        } finally {
+            session = current;

Review Comment:
   ⚠️ **Potential token-renewal gap:** `current` is captured before 
`doProcess()` runs. If openstack4j replaces the thread-local on 401 re-auth 
(rather than mutating `current` in-place), `session = current` saves the stale 
pre-renewal session. Subsequent threads reuse the old token and trigger 
redundant re-authentication on every request.
   
   Confirm: does openstack4j mutate the existing session object on re-auth, or 
replace the thread-local entirely? If the latter, capturing after `doProcess()` 
via `(OSClient) OSClientSession.getCurrent()` would be safer.



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to