From 0e3465b8c7c457823af5de564a42312f727c6f03 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Miko=C5=82aj=20Nowak?= <mikolaj.nowak@konghq.com>
Date: Thu, 16 May 2024 19:05:03 +0200
Subject: [PATCH] fix(plugins): add realm to removed fields

Basic-auth added new field "realm" but it was not added to "removed_fields" which
breaks backwards compat between new CPs and old DPs.

KAG-4516

(cherry picked from commit 420b3b6ceb17d84fb84486e0de72635fb4408c45)
---
 .../kong/fix-realm-compat-changes-basic-auth.yml |  3 +++
 kong/clustering/compat/removed_fields.lua        |  3 +++
 .../09-hybrid_mode/09-config-compat_spec.lua     | 16 ++++++++++++++++
 3 files changed, 22 insertions(+)
 create mode 100644 changelog/unreleased/kong/fix-realm-compat-changes-basic-auth.yml

diff --git a/changelog/unreleased/kong/fix-realm-compat-changes-basic-auth.yml b/changelog/unreleased/kong/fix-realm-compat-changes-basic-auth.yml
new file mode 100644
index 000000000000..6f2ce9d7beae
--- /dev/null
+++ b/changelog/unreleased/kong/fix-realm-compat-changes-basic-auth.yml
@@ -0,0 +1,3 @@
+message: "**Basic-Auth**: Fix an issue of realm field not recognized for older kong versions (before 3.6)"
+type: bugfix
+scope: Plugin
diff --git a/kong/clustering/compat/removed_fields.lua b/kong/clustering/compat/removed_fields.lua
index e0083de8a9b1..053935822415 100644
--- a/kong/clustering/compat/removed_fields.lua
+++ b/kong/clustering/compat/removed_fields.lua
@@ -115,5 +115,8 @@ return {
     opentelemetry = {
       "sampling_rate",
     },
+    basic_auth = {
+      "realm"
+    },
   },
 }
diff --git a/spec/02-integration/09-hybrid_mode/09-config-compat_spec.lua b/spec/02-integration/09-hybrid_mode/09-config-compat_spec.lua
index f1180b6884a5..9bb5640df33a 100644
--- a/spec/02-integration/09-hybrid_mode/09-config-compat_spec.lua
+++ b/spec/02-integration/09-hybrid_mode/09-config-compat_spec.lua
@@ -468,6 +468,22 @@ describe("CP/DP config compat transformations #" .. strategy, function()
         end)
       end)
     end)
+
+    describe("www-authenticate header in plugins (realm config)", function()
+      it("[basic-auth] removes realm for versions below 3.6", function()
+        local basic_auth = admin.plugins:insert {
+          name = "basic-auth",
+        }
+
+        local expected_basic_auth_prior_36 = utils.cycle_aware_deep_copy(basic_auth)
+        expected_basic_auth_prior_36.config.realm = nil
+
+        do_assert(utils.uuid(), "3.5.0", expected_basic_auth_prior_36)
+
+        -- cleanup
+        admin.plugins:remove({ id = basic_auth.id })
+      end)
+    end)
   end)
 end)