shreemaan-abhishek commented on PR #13929: URL: https://github.com/apache/apisix/pull/13929#issuecomment-6490279760
@nic-6443 Thanks for the review. I'd like to go with a smaller schema change: move only `header_prefix` to the route and keep `server` and `ssl_verify` on the Consumer. The route-level prefix is all the header cleanup needs, because it's the only value that has to be known before authentication. All three public API handlers (`login`, `change_pwd`, `user_info`) already look up the Consumer by `appid` before calling Wolf, so they can read `server` and `ssl_verify` from it, as on master. With `server` on the route, as in the current PR and the `ctx.wolf_rbac_conf` approach: - every public API route has to enable `wolf-rbac` only to carry `server` for the handlers; - the plugin has to keep a hard-coded list of public API URIs to skip Wolf auth on those routes, or login would demand a token; - when `wolf-rbac` is nested in `multi-auth` on a public API route, the handlers return 500 whenever another plugin authenticates first: `multi-auth` stops at the first success, so Wolf's `rewrite` never runs and `ctx.wolf_rbac_conf` is never set. The handler then has no `server` to call and takes the `if not conf` branch, which exits with 500 "Missing wolf-rbac configuration". Keeping `server` on the Consumer removes all three, along with `get_route_plugin_conf`, `is_wolf_public_api`, and the global-rule crash you found. This is now pushed in f046af54e. On the other points: - `rewrite` now clears the route-prefix headers unconditionally as its first step; the `is_running_under_multi_auth` branch and the wrapper are gone, and the `multi-auth` pre-clear hook stays. - TEST 28 passes without the `or default_header_prefix` fallbacks, so they are removed: `multi-auth`'s `check_schema` fills the nested defaults as you said. - `server` keeps its default. Since it now stays on the Consumer, making it required would break every existing Consumer that relies on the default, which is out of scope here. Happy to do it in a follow-up. - A custom `header_prefix` on a Consumer is rejected with a migration message. The old schema stored the default `"X-"` on every Consumer, so that value is accepted and dropped to keep existing Consumers valid. - The leftover `25b`/`3b` labels are fixed. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
