Baoyuantop commented on code in PR #13929: URL: https://github.com/apache/apisix/pull/13929#discussion_r4356411674
########## docs/en/latest/plugins/wolf-rbac.md: ########## @@ -34,11 +34,12 @@ The `wolf-rbac` Plugin provides a [role-based access control](https://en.wikiped ## Attributes -| Name | Type | Required | Default | Description | -|---------------|--------|----------|--------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| server | string | False | "http://127.0.0.1:12180"; | Service address of wolf server. | -| appid | string | False | "unset" | App id added in wolf console. This field supports saving the value in Secret Manager using the [APISIX Secret](../terminology/secret.md) resource. | -| header_prefix | string | False | "X-" | Prefix for a custom HTTP header. After authentication is successful, three headers will be added to the request header (for backend) and response header (for frontend) namely: `X-UserId`, `X-Username`, and `X-Nickname`. | +| Name | Type | Required | Default | Description | +| --- | --- | --- | --- | --- | +| appid | string | True | N/A | Consumer application ID configured in Wolf. This field supports saving the value in Secret Manager using the [APISIX Secret](../terminology/secret.md) resource. | +| server | string | False | "http://127.0.0.1:12180"; | Route or Service address of the Wolf server. | +| header_prefix | string | False | "X-" | Route or Service prefix for the identity headers added after successful authentication: `{prefix}UserId`, `{prefix}Username`, and `{prefix}Nickname`. | +| ssl_verify | boolean | False | false | Whether to verify the Wolf server's TLS certificate. Configured on a Route or Service. | Review Comment: This table still mixes Consumer (`appid`) and Route/Service (`server`, `header_prefix`, `ssl_verify`) in one place. Please split into two tables (or add a Scope column), same as other dual-schema auth plugins — otherwise the breaking change is easy to misconfigure. ########## docs/zh/latest/plugins/wolf-rbac.md: ########## @@ -34,11 +34,12 @@ description: 本文介绍了关于 Apache APISIX `wolf-rbac` 插件的基本信 ## 属性 -| 名称 | 类型 | 必选项 | 默认值 | 描述 | -| ------------- | ------ | ------ | ------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------- | -| server | string | 否 | "http://127.0.0.1:12180"; | `wolf-server` 的服务地址。 | -| appid | string | 否 | "unset" | 在 `wolf-console` 中已经添加的应用 id。该字段支持使用 [APISIX Secret](../terminology/secret.md) 资源，将值保存在 Secret Manager 中。 | -| header_prefix | string | 否 | "X-" | 自定义 HTTP 头的前缀。`wolf-rbac` 在鉴权成功后，会在请求头 (用于传给后端) 及响应头 (用于传给前端) 中添加 3 个 header：`X-UserId`, `X-Username`, `X-Nickname`。| +| 名称 | 类型 | 必选项 | 默认值 | 描述 | +| --- | --- | --- | --- | --- | +| appid | string | 是 | 无 | Consumer 在 Wolf 中配置的应用 ID。该字段支持使用 [APISIX Secret](../terminology/secret.md) 资源，将值保存在 Secret Manager 中。 | +| server | string | 否 | "http://127.0.0.1:12180"; | Route 或 Service 使用的 Wolf 服务地址。 | +| header_prefix | string | 否 | "X-" | Route 或 Service 的身份 HTTP 头前缀。鉴权成功后添加 `{prefix}UserId`、`{prefix}Username` 和 `{prefix}Nickname`。 | +| ssl_verify | boolean | 否 | false | 是否验证 Wolf 服务的 TLS 证书。在 Route 或 Service 上配置。 | Review Comment: 同上：请把 Consumer 与 Route/Service 属性拆开（两表或加「作用范围」列），与英文档保持一致。 ########## apisix/plugins/wolf-rbac.lua: ########## @@ -31,39 +32,68 @@ local req_read_body = ngx.req.read_body local req_get_body_data = ngx.req.get_body_data local plugin_name = "wolf-rbac" +local default_server = "http://127.0.0.1:12180"; +local default_header_prefix = "X-" local schema = { type = "object", properties = { - appid = { - type = "string", - default = "unset" - }, server = { type = "string", - default = "http://127.0.0.1:12180"; + default = default_server }, header_prefix = { type = "string", - default = "X-" + default = default_header_prefix }, ssl_verify = { type = "boolean", }, } } +local consumer_schema = { + type = "object", + properties = { + appid = { + type = "string", + }, + }, + required = {"appid"}, +} Review Comment: After this move, leftover Consumer keys `server` / `header_prefix` / `ssl_verify` still validate (JSON Schema allows extra properties by default) but are ignored at runtime — traffic can silently hit the default `http://127.0.0.1:12180`. Please fail loud on `TYPE_CONSUMER`: reject those three fields in `check_schema` (clearer than only `additionalProperties = false`, and matches an intentional migration), and add a negative Admin/schema test next to the existing “appid is required” case. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
