Aias00 opened a new issue, #8014: URL: https://github.com/apache/shenyu/issues/8014
## Description Follow-up to the plugin orchestration review against master `34f2ed036` and design PR #8007 (`f2839049c`). Parent proposal: #7993. Owning implementation/design task: #7994. Related tasks: #7995, #7999, #8001. This issue refines the existing work breakdown; it does not assert that GRAPH execution is already implemented or that the proposed design has been accepted. HTTP/RPC API aggregation and parallel plugin execution remain out of scope. ## Problem A required graph node can prove an installed/enabled plugin dependency, but does not prove the current request was authenticated. AbstractShenyuPlugin can continue on missing/unmatched selector/rule; plugin.skip and plugin-specific behavior add more bypass paths. The contract currently claims mandatory authentication cannot be bypassed based on placement/availability alone. Also, a graph author can omit or unmark a node unless mandatory security policy comes from an independently enforced source. ## Code and design evidence - [contract](https://github.com/apache/shenyu/blob/f2839049ca3873cde0b0c8fe6ff519c040dc905a/docs/plugin-graph-orchestration.md) ยง12; [compatibility audit](https://github.com/apache/shenyu/blob/f2839049ca3873cde0b0c8fe6ff519c040dc905a/docs/plugin-graph-compatibility-audit.md) A1 - [early exit and selector/rule-miss continuation](https://github.com/apache/shenyu/blob/34f2ed036/shenyu-plugin/shenyu-plugin-base/src/main/java/org/apache/shenyu/plugin/base/AbstractShenyuPlugin.java) - [JWT rule execution](https://github.com/apache/shenyu/blob/34f2ed036/shenyu-plugin/shenyu-plugin-security/shenyu-plugin-jwt/src/main/java/org/apache/shenyu/plugin/jwt/JwtPlugin.java) - [OAuth2 plugin-specific continuation behavior](https://github.com/apache/shenyu/blob/34f2ed036/shenyu-plugin/shenyu-plugin-security/shenyu-plugin-oauth2/src/main/java/org/apache/shenyu/plugin/oauth2/OAuth2Plugin.java) ## Task List - Define required as dependency availability unless an explicit stronger request-time security contract is implemented. - Specify the authority for mandatory security policy; graph authors must not be able to remove the constraint by omitting a node. - If enforcing authentication, expose a typed request-scoped matching/authentication result rather than infer success from Mono<Void> completion or node presence. - Define no-match, skip, disabled, intentionally public routes and alternative authentication outcomes. - Preserve LEGACY behavior unless changed under a separate explicit policy. ## Acceptance criteria - Enabled required JWT with no matching rule is not reported as authenticated. - Tests cover skip/no-match/disabled/success/rejection/public-route cases and live policy changes. - Mandatory policy omission is rejected when enforcement is enabled. - Contract claims match implemented guarantees, without silently changing existing plugin matching semantics. ## Dependencies and sequencing Resolve the contract portion in #7994 / PR #8007 before depending implementation hardens this assumption. Deliver code and integration coverage under #7994 and the related tasks above. Existing issue dependencies remain in effect; this issue adds a focused review requirement rather than a duplicate full implementation task. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
