Fix Sandbox API Key requests returning Production Response for API Products #13153
Conversation
Dakshithas
requested review from
tharindu1st,
AnuGayan,
chamilaadhi,
Arshardh,
dushaniw,
tgtshanika,
tharikaGitHub,
senthuran16,
hisanhunais,
HiranyaKavishani,
RakhithaRR,
npamudika,
HeshanSudarshana,
ashera96,
pubudu538 and
Krishanx92
as code owners
📝 WalkthroughWalkthroughThe update enhances the velocity context setup for API products by adding checks for API key and basic authentication security types. Boolean flags are now set to indicate whether these security options are enabled, aligning the logic with what is already present for regular APIs. No public API signatures are modified. Changes
Suggested reviewers
📜 Recent review detailsConfiguration used: .coderabbit.yaml 📒 Files selected for processing (1)
⏰ Context from checks skipped due to timeout of 90000ms (3)
🔇 Additional comments (1)
✨ Finishing Touches
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
Documentation and Community
|
There was a problem hiding this comment.
Pull Request Overview
Fixes incorrect routing of sandbox API key and Basic Auth requests for API Products by adding missing velocity context properties.
- Adds
apiIsApiKeyProtectedandapiIsBasicAuthProtectedflags to the Velocity context - Ensures conditional filters in Synapse configs include API Key and Basic Auth security schemes
Comments suppressed due to low confidence (1)
components/apimgt/org.wso2.carbon.apimgt.rest.api.publisher.v1.common/src/main/java/org/wso2/carbon/apimgt/rest/api/publisher/v1/common/template/APIConfigContext.java:142
- Consider adding unit tests for
setApiProductVelocityContextto verify thatapiIsApiKeyProtectedandapiIsBasicAuthProtectedare correctly set in theVelocityContextwhen the API product includes these security schemes.
if (apiSecurity != null && apiSecurity.contains(APIConstants.API_SECURITY_API_KEY)) {
| @@ -138,6 +138,18 @@ private void setApiProductVelocityContext(APIProduct apiProduct, VelocityContext | |||
| } else { | |||
| context.put("apiIsOauthProtected", Boolean.FALSE); | |||
| } | |||
| // if API is secured with api_Key | |||
There was a problem hiding this comment.
[nitpick] You can simplify these blocks by directly putting the boolean expression into the context. For example: context.put("apiIsApiKeyProtected", apiSecurity != null && apiSecurity.contains(APIConstants.API_SECURITY_API_KEY)); This reduces verbosity and improves readability.
Copilot uses AI. Check for mistakes.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Issue
When an API Product is secured using API Key or Basic Auth (without OAuth2), requests made with a sandbox API key were incorrectly routed to the production endpoint.
Root Cause
Certain velocity context properties, specifically
apiIsApiKeyProtectedandapiIsBasicAuthProtected, were not set during the API Product deployment process. These properties are essential for rendering the Synapse configuration with correct routing logic.As a result, API Products using only API Key or Basic Auth lacked the conditional filters in their Synapse configs, causing all requests—regardless of the key type—to route to production.
Solution
Added the missing velocity context properties (
apiIsApiKeyProtected,apiIsBasicAuthProtected) to ensure the Synapse configuration includes the correct conditional routing logic based on the security scheme.Impact
Files Modified
APIConfigContext.java(publisher v1 common)Testing
Related Issue