This is an automated email from the ASF dual-hosted git repository.
davsclaus pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/camel.git
The following commit(s) were added to refs/heads/main by this push:
new dc8e4b7d61e6 CAMEL-26560: camel-openfga - document how to give
conditionContext typed values from YAML (#29138)
dc8e4b7d61e6 is described below
commit dc8e4b7d61e61937e0bdeae7cde85f890b22118b
Author: Andrea Cosentino <[email protected]>
AuthorDate: Thu Nov 5 09:40:31 2026 +0100
CAMEL-26560: camel-openfga - document how to give conditionContext typed
values from YAML (#29138)
Co-Authored-By: Claude Opus 5.5 <[email protected]>
---
.../camel/catalog/docs/openfga-component.adoc | 74 ++++++++++++++++++++++
.../src/main/docs/openfga-component.adoc | 74 ++++++++++++++++++++++
2 files changed, 148 insertions(+)
diff --git
a/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/docs/openfga-component.adoc
b/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/docs/openfga-component.adoc
index 087fc299d502..5bd6f2d3d8ce 100644
---
a/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/docs/openfga-component.adoc
+++
b/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/docs/openfga-component.adoc
@@ -521,6 +521,80 @@ resolved from the registry —
`conditionContext=#myContext`. A map rather than
every condition parameter in the authorization model (`int`, `bool`,
`timestamp`, `ipaddress`), and a map lets you
supply the right Java type instead of a string the server would reject.
+YAML, like a properties file, hands every value over as a string, the entries
of a map included. OpenFGA converts a
+string for an `int`, `uint`, `double`, `duration`, `timestamp` or `ipaddress`
parameter, so those can be written as
+they are, but it rejects one for a `bool` parameter: give that as
`#valueAs(boolean):true`. A `list` or `map` parameter
+cannot be written inline at all; declare it as a bean of its own and refer to
it with `#bean:`:
+
+[tabs]
+====
+Java::
++
+[source,java]
+------------------------------------------------------------
+Map<String, Object> networkContext = Map.of(
+ "trusted", true,
+ "allowed_regions", List.of("eu", "us"));
+context.getRegistry().bind("networkContext", networkContext);
+
+from("direct:checkFromTrustedNetwork")
+ .to("openfga:check?storeId={{fga.store}}&relation=reader"
+ + "&user=user:${exchangeProperty.CamelKeycloakTokenSubject}"
+ +
"&object=document:${header.documentId}&conditionContext=#networkContext");
+------------------------------------------------------------
+
+YAML::
++
+[source,yaml]
+----
+- beans:
+ - name: allowedRegions
+ type: java.util.ArrayList
+ properties:
+ "0": eu
+ "1": us
+ - name: networkContext
+ type: java.util.LinkedHashMap
+ properties:
+ # a bool parameter needs a boolean: the string "true" is rejected
+ trusted: "#valueAs(boolean):true"
+ # a list parameter needs a list
+ allowed_regions: "#bean:allowedRegions"
+- route:
+ from:
+ uri: direct:checkFromTrustedNetwork
+ steps:
+ - to:
+ uri: openfga:check
+ parameters:
+ storeId: "{{fga.store}}"
+ relation: reader
+ user: "user:${exchangeProperty.CamelKeycloakTokenSubject}"
+ object: "document:${header.documentId}"
+ conditionContext: "#networkContext"
+----
+====
+
+`OpenFgaSecurityPolicy` also takes the map inline, under the same rules:
+
+[source,yaml]
+----
+- beans:
+ - name: documentReaders
+ type: org.apache.camel.component.openfga.security.OpenFgaSecurityPolicy
+ properties:
+ storeId: "{{fga.store}}"
+ relation: reader
+ user: "user:${exchangeProperty.CamelKeycloakTokenSubject}"
+ object: "document:${header.documentId}"
+ conditionContext:
+ trusted: "#valueAs(boolean):true"
+ max_amount: 100
+----
+
+A value of the wrong type fails the check with an HTTP 400 from OpenFGA,
naming the parameter it could not convert.
+That is an answer rather than an unavailable decision point, so the exchange
is refused even when `failOpen` is set.
+
[IMPORTANT]
.A contextual tuple grants
====
diff --git a/components/camel-openfga/src/main/docs/openfga-component.adoc
b/components/camel-openfga/src/main/docs/openfga-component.adoc
index 087fc299d502..5bd6f2d3d8ce 100644
--- a/components/camel-openfga/src/main/docs/openfga-component.adoc
+++ b/components/camel-openfga/src/main/docs/openfga-component.adoc
@@ -521,6 +521,80 @@ resolved from the registry —
`conditionContext=#myContext`. A map rather than
every condition parameter in the authorization model (`int`, `bool`,
`timestamp`, `ipaddress`), and a map lets you
supply the right Java type instead of a string the server would reject.
+YAML, like a properties file, hands every value over as a string, the entries
of a map included. OpenFGA converts a
+string for an `int`, `uint`, `double`, `duration`, `timestamp` or `ipaddress`
parameter, so those can be written as
+they are, but it rejects one for a `bool` parameter: give that as
`#valueAs(boolean):true`. A `list` or `map` parameter
+cannot be written inline at all; declare it as a bean of its own and refer to
it with `#bean:`:
+
+[tabs]
+====
+Java::
++
+[source,java]
+------------------------------------------------------------
+Map<String, Object> networkContext = Map.of(
+ "trusted", true,
+ "allowed_regions", List.of("eu", "us"));
+context.getRegistry().bind("networkContext", networkContext);
+
+from("direct:checkFromTrustedNetwork")
+ .to("openfga:check?storeId={{fga.store}}&relation=reader"
+ + "&user=user:${exchangeProperty.CamelKeycloakTokenSubject}"
+ +
"&object=document:${header.documentId}&conditionContext=#networkContext");
+------------------------------------------------------------
+
+YAML::
++
+[source,yaml]
+----
+- beans:
+ - name: allowedRegions
+ type: java.util.ArrayList
+ properties:
+ "0": eu
+ "1": us
+ - name: networkContext
+ type: java.util.LinkedHashMap
+ properties:
+ # a bool parameter needs a boolean: the string "true" is rejected
+ trusted: "#valueAs(boolean):true"
+ # a list parameter needs a list
+ allowed_regions: "#bean:allowedRegions"
+- route:
+ from:
+ uri: direct:checkFromTrustedNetwork
+ steps:
+ - to:
+ uri: openfga:check
+ parameters:
+ storeId: "{{fga.store}}"
+ relation: reader
+ user: "user:${exchangeProperty.CamelKeycloakTokenSubject}"
+ object: "document:${header.documentId}"
+ conditionContext: "#networkContext"
+----
+====
+
+`OpenFgaSecurityPolicy` also takes the map inline, under the same rules:
+
+[source,yaml]
+----
+- beans:
+ - name: documentReaders
+ type: org.apache.camel.component.openfga.security.OpenFgaSecurityPolicy
+ properties:
+ storeId: "{{fga.store}}"
+ relation: reader
+ user: "user:${exchangeProperty.CamelKeycloakTokenSubject}"
+ object: "document:${header.documentId}"
+ conditionContext:
+ trusted: "#valueAs(boolean):true"
+ max_amount: 100
+----
+
+A value of the wrong type fails the check with an HTTP 400 from OpenFGA,
naming the parameter it could not convert.
+That is an answer rather than an unavailable decision point, so the exchange
is refused even when `failOpen` is set.
+
[IMPORTANT]
.A contextual tuple grants
====
