pluginruntime

package
v3.1.0-rc.3 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 16, 2026 License: GPL-3.0 Imports: 63 Imported by: 0

Documentation

Overview

Package pluginruntime owns native plugin lifecycle execution.

Index

Constants

View Source 
const (
	// RuntimeDeltaConflictLogLimit bounds per-merge conflict diagnostics.
	RuntimeDeltaConflictLogLimit = 8
)

Variables

View Source 
var (
	// ErrInvalidLDAPScope is returned when a plugin search request uses an unsupported scope.
	ErrInvalidLDAPScope = errors.New("invalid plugin LDAP scope")

	// ErrInvalidLDAPModifyOperation is returned when a plugin modify request uses an unsupported operation.
	ErrInvalidLDAPModifyOperation = errors.New("invalid plugin LDAP modify operation")
)
View Source 
var (
	// ErrInvalidMetricDefinition is returned for unsupported plugin metric definitions.
	ErrInvalidMetricDefinition = errors.New("invalid plugin metric definition")

	// ErrInvalidMetricLabels is recorded when runtime labels do not match declarations.
	ErrInvalidMetricLabels = errors.New("invalid plugin metric labels")
)
View Source 
var (
	// ErrNotReady is returned when request-time components are invoked before lifecycle readiness.
	ErrNotReady = errors.New("plugin runtime is not ready")

	// ErrPluginPanic is returned when a plugin method panics behind the host boundary.
	ErrPluginPanic = errors.New("plugin method panicked")

	// ErrLifecycleFailed wraps startup or shutdown lifecycle failures.
	ErrLifecycleFailed = errors.New("plugin lifecycle failed")

	// ErrComponentNotFound is returned when a qualified component is not registered.
	ErrComponentNotFound = errors.New("plugin component not found")

	// ErrComponentKindMismatch is returned when a component exists under another extension kind.
	ErrComponentKindMismatch = errors.New("plugin component kind mismatch")

	// ErrRestartRequired is returned when reload input changes restart-only plugin fields.
	ErrRestartRequired = errors.New("plugin restart required")
)
View Source 
var (
	// ErrUnsupportedRuntimeValue is returned when runtime data is not JSON/CBOR-compatible.
	ErrUnsupportedRuntimeValue = errors.New("unsupported runtime value")

	// ErrInvalidRuntimeKey is returned when a runtime key is empty.
	ErrInvalidRuntimeKey = errors.New("invalid runtime key")
)
View Source 
var (
	// ErrCompatibilityMetricDenied marks an exact metric request outside its operator allowlist.
	ErrCompatibilityMetricDenied = errors.New("compatibility metric denied")
)
View Source 
var ErrCompatibilityObservabilityDenied = errors.New("compatibility observability denied")

ErrCompatibilityObservabilityDenied marks requests outside verified operator allowlists.

Functions

func MergeRuntimeDeltas 

func MergeRuntimeDeltas(
	ctx context.Context,
	base map[string]any,
	logger pluginapi.Logger,
	deltas ...pluginapi.RuntimeDelta,
) (map[string]any, error)

MergeRuntimeDeltas applies plugin deltas in argument order with deterministic key ordering inside each delta.

func NewBackendManager 

func NewBackendManager(backendName string, deps core.AuthDeps) core.BackendManager

NewBackendManager constructs a backend manager for a fully qualified plugin backend.

func NewBackendServerFacade 

func NewBackendServerFacade(provider BackendServerProvider) pluginapi.BackendServers

NewBackendServerFacade exposes backend-monitoring candidates as API-level values.

func NewCredentialProvider 

func NewCredentialProvider(
	requestContext context.Context,
	password secret.Value,
	capabilities []pluginapi.Capability,
) pluginapi.CredentialProvider

NewCredentialProvider returns a request-bound credential provider for authorized plugin calls.

func NewDeterministicHelperFacade 

func NewDeterministicHelperFacade(options HelperOptions) pluginapi.DeterministicHelpers

NewDeterministicHelperFacade creates a helper facade for native plugin ports.

func NewHookRequestFromHTTPRequest 

func NewHookRequestFromHTTPRequest(
	request *http.Request,
	body []byte,
	metadata HookRequestMetadata,
	options ...SnapshotOption,
) pluginapi.HookRequest

NewHookRequestFromHTTPRequest builds the API-level hook request from an HTTP request.

func NewRedisFacade 

func NewRedisFacade(client rediscli.Client, options ...RedisFacadeOption) pluginapi.Redis

NewRedisFacade exposes read and write handles from the host Redis client.

func NewRequestSnapshotFromAuthState 

func NewRequestSnapshotFromAuthState(auth *core.AuthState, options ...SnapshotOption) pluginapi.RequestSnapshot

NewRequestSnapshotFromAuthState copies safe request values out of AuthState for plugins.

func NewRuntimeContext 

func NewRuntimeContext(values map[string]any) (pluginapi.RuntimeContext, error)

NewRuntimeContext returns an immutable runtime context view.

func SecretBearingHeadersFromConfig 

func SecretBearingHeadersFromConfig(cfg config.File) []string

SecretBearingHeadersFromConfig returns configured request headers that can carry passwords.

func SetDefaultRunner 

func SetDefaultRunner(runner *Runner)

SetDefaultRunner publishes the current process plugin runtime runner.

func ValidateRuntimeDelta 

func ValidateRuntimeDelta(delta pluginapi.RuntimeDelta) error

ValidateRuntimeDelta checks all values in a returned runtime delta.

Types

type BackendManager 

type BackendManager struct {
	// contains filtered or unexported fields
}

BackendManager adapts one native plugin backend into the internal backend contract.

func (*BackendManager) AccountDB 

func (m *BackendManager) AccountDB(auth *core.AuthState) (core.AccountList, error)

AccountDB lists accounts through one native plugin backend.

func (*BackendManager) AddTOTPRecoveryCodes 

func (m *BackendManager) AddTOTPRecoveryCodes(*core.AuthState, *mfa.TOTPRecovery) error

AddTOTPRecoveryCodes rejects edge-selected recovery-code values; plugin-owned generation must be used.

func (*BackendManager) AddTOTPSecret 

func (m *BackendManager) AddTOTPSecret(*core.AuthState, *mfa.TOTPSecret) error

AddTOTPSecret rejects edge-selected TOTP secrets; plugin-owned registration must use Begin/FinishTOTPRegistration.

func (*BackendManager) BeginTOTPRegistration 

func (m *BackendManager) BeginTOTPRegistration(auth *core.AuthState, idempotencyKey string) (core.TOTPRegistration, error)

BeginTOTPRegistration starts a plugin-owned TOTP registration flow.

func (*BackendManager) ConsumeTOTPRecoveryCode 

func (m *BackendManager) ConsumeTOTPRecoveryCode(auth *core.AuthState, code string) (bool, int, error)

ConsumeTOTPRecoveryCode consumes one recovery code and returns the remaining count when available.

func (*BackendManager) DeleteRecoveryCodes 

func (m *BackendManager) DeleteRecoveryCodes(auth *core.AuthState, idempotencyKey string) error

DeleteRecoveryCodes removes recovery-code state when the plugin implements RecoveryCodeBackend.

func (*BackendManager) DeleteTOTP 

func (m *BackendManager) DeleteTOTP(auth *core.AuthState, idempotencyKey string) error

DeleteTOTP removes TOTP state when the plugin implements TOTPBackend.

func (*BackendManager) DeleteTOTPRecoveryCodes 

func (m *BackendManager) DeleteTOTPRecoveryCodes(auth *core.AuthState) error

DeleteTOTPRecoveryCodes deletes recovery-code state when the plugin implements RecoveryCodeBackend.

func (*BackendManager) DeleteTOTPSecret 

func (m *BackendManager) DeleteTOTPSecret(auth *core.AuthState) error

DeleteTOTPSecret deletes TOTP state when the plugin implements TOTPBackend.

func (*BackendManager) DeleteWebAuthnCredential 

func (m *BackendManager) DeleteWebAuthnCredential(auth *core.AuthState, credential *mfa.PersistentCredential) error

DeleteWebAuthnCredential deletes one WebAuthn credential when the plugin implements WebAuthnBackend.

func (*BackendManager) FinishTOTPRegistration 

func (m *BackendManager) FinishTOTPRegistration(
	auth *core.AuthState,
	pendingRegistrationID string,
	code string,
	idempotencyKey string,
) error

FinishTOTPRegistration completes a plugin-owned TOTP registration flow.

func (*BackendManager) GenerateRecoveryCodes 

func (m *BackendManager) GenerateRecoveryCodes(auth *core.AuthState, count uint32, idempotencyKey string) ([]string, error)

GenerateRecoveryCodes asks a plugin backend to create recovery codes.

func (*BackendManager) GetPublicMFAState 

func (m *BackendManager) GetPublicMFAState(auth *core.AuthState, includeWebAuthn bool) (core.PublicMFAState, error)

GetPublicMFAState loads public MFA state when the plugin implements PublicMFAStateBackend.

func (*BackendManager) GetWebAuthnCredentials 

func (m *BackendManager) GetWebAuthnCredentials(auth *core.AuthState) ([]mfa.PersistentCredential, error)

GetWebAuthnCredentials retrieves WebAuthn credentials when the plugin implements WebAuthnBackend.

func (*BackendManager) PassDB 

func (m *BackendManager) PassDB(auth *core.AuthState) (*core.PassDBResult, error)

PassDB authenticates a user through one native plugin backend.

func (*BackendManager) SaveWebAuthnCredential 

func (m *BackendManager) SaveWebAuthnCredential(auth *core.AuthState, credential *mfa.PersistentCredential) error

SaveWebAuthnCredential saves one WebAuthn credential when the plugin implements WebAuthnBackend.

func (*BackendManager) UpdateWebAuthnCredential 

func (m *BackendManager) UpdateWebAuthnCredential(
	auth *core.AuthState,
	oldCredential *mfa.PersistentCredential,
	newCredential *mfa.PersistentCredential,
) error

UpdateWebAuthnCredential updates one WebAuthn credential when the plugin implements WebAuthnBackend.

func (*BackendManager) UseRecoveryCode 

func (m *BackendManager) UseRecoveryCode(auth *core.AuthState, code string, idempotencyKey string) (bool, error)

UseRecoveryCode consumes a recovery code when the plugin implements RecoveryCodeBackend.

func (*BackendManager) VerifyTOTP 

func (m *BackendManager) VerifyTOTP(auth *core.AuthState, code string) (bool, error)

VerifyTOTP verifies a code when the plugin implements TOTPBackend.

type BackendServerProvider 

type BackendServerProvider func() []*config.BackendServer

BackendServerProvider returns the current host-owned backend server slice.

type CallRecord 

type CallRecord struct {
	Err            error
	Duration       time.Duration
	ModuleName     string
	ComponentName  string
	ExtensionPoint string
	Method         string
	Panicked       bool
}

CallRecord describes one host-invoked plugin method call.

type CompatibilityMetricsFacade 

type CompatibilityMetricsFacade struct {
	// contains filtered or unexported fields
}

CompatibilityMetricsFacade dual-publishes allowlisted exact and native plugin metrics.

func NewCompatibilityMetricsFacade 

func NewCompatibilityMetricsFacade(
	native pluginapi.Metrics,
	registerer prometheus.Registerer,
	allowed []pluginapi.MetricDefinition,
) *CompatibilityMetricsFacade

NewCompatibilityMetricsFacade returns a defensive exact-metric allowlist wrapper.

func (*CompatibilityMetricsFacade) Counter 

func (m *CompatibilityMetricsFacade) Counter(definition pluginapi.MetricDefinition) (pluginapi.Counter, error)

Counter returns a dual-publishing exact counter when allowlisted.

func (*CompatibilityMetricsFacade) Gauge 

func (m *CompatibilityMetricsFacade) Gauge(definition pluginapi.MetricDefinition) (pluginapi.Gauge, error)

Gauge returns a dual-publishing exact gauge when allowlisted.

func (*CompatibilityMetricsFacade) Histogram 

func (m *CompatibilityMetricsFacade) Histogram(definition pluginapi.MetricDefinition) (pluginapi.Histogram, error)

Histogram returns a dual-publishing exact histogram when allowlisted.

func (*CompatibilityMetricsFacade) Summary 

func (m *CompatibilityMetricsFacade) Summary(definition pluginapi.MetricDefinition) (pluginapi.Summary, error)

Summary returns a dual-publishing exact summary when allowlisted.

type ConnectionTargetFacade 

type ConnectionTargetFacade struct {
	// contains filtered or unexported fields
}

ConnectionTargetFacade registers plugin-owned network targets with host observability.

func NewConnectionTargetFacade 

func NewConnectionTargetFacade(registrar ConnectionTargetRegistrar) *ConnectionTargetFacade

NewConnectionTargetFacade returns a duplicate-safe connection target facade.

func NewConnectionTargetFacadeForConfig 

func NewConnectionTargetFacadeForConfig(cfg config.File) *ConnectionTargetFacade

NewConnectionTargetFacadeForConfig returns a facade backed by the Lua-compatible connection manager.

func (*ConnectionTargetFacade) Count 

func (f *ConnectionTargetFacade) Count(_ context.Context, name string) (int, bool)

Count returns the current observed count for a named target when available.

func (*ConnectionTargetFacade) Register 

func (f *ConnectionTargetFacade) Register(ctx context.Context, target pluginapi.ConnectionTarget) error

Register validates and records one connection target.

type ConnectionTargetRegistrar 

type ConnectionTargetRegistrar interface {
	Register(context.Context, string, string, string)
	Count(string) (int, bool)
}

ConnectionTargetRegistrar records validated connection target registrations.

type EffectBridge 

type EffectBridge struct {
	// contains filtered or unexported fields
}

EffectBridge adapts policy-selected native plugin effects into core.

func NewEffectBridge 

func NewEffectBridge(runner *Runner) *EffectBridge

NewEffectBridge returns an effect bridge bound to one plugin runner.

func (*EffectBridge) EnqueuePostActionPlan 

func (b *EffectBridge) EnqueuePostActionPlan(
	ctx *gin.Context,
	view *core.StateView,
	steps []core.PostActionPlanStep,
) (bool, bool)

EnqueuePostActionPlan starts one detached worker for ordered post-action steps.

func (*EffectBridge) ExecutePolicyEffect 

func (b *EffectBridge) ExecutePolicyEffect(ctx *gin.Context, view *core.StateView, effect report.EffectRequest) (bool, bool)

ExecutePolicyEffect dispatches one policy-selected native plugin effect.

func (*EffectBridge) IsPostActionEffect 

func (b *EffectBridge) IsPostActionEffect(effect report.EffectRequest) bool

IsPostActionEffect reports whether a policy effect resolves to a native post-action target.

type EnvironmentSourceBridge 

type EnvironmentSourceBridge struct {
	// contains filtered or unexported fields
}

EnvironmentSourceBridge adapts native plugin environment sources into the pre-auth flow.

func NewEnvironmentSourceBridge 

func NewEnvironmentSourceBridge(runner *Runner) *EnvironmentSourceBridge

NewEnvironmentSourceBridge returns a bridge bound to one plugin runner.

func (*EnvironmentSourceBridge) Evaluate 

func (b *EnvironmentSourceBridge) Evaluate(
	ctx *gin.Context,
	view *core.StateView,
) (triggered bool, abort bool, handled bool, err error)

Evaluate executes registered native environment sources before built-in environment controls.

type HTTPFacade 

type HTTPFacade struct {
	// contains filtered or unexported fields
}

HTTPFacade executes plugin HTTP requests through host-owned instrumentation.

func NewHTTPFacade 

func NewHTTPFacade(scope string, options ...HTTPFacadeOption) *HTTPFacade

NewHTTPFacade returns a scoped host HTTP facade.

func (*HTTPFacade) Do 

func (f *HTTPFacade) Do(ctx context.Context, request pluginapi.HTTPRequest) (pluginapi.HTTPResponse, error)

Do executes one host-managed outbound HTTP request.

type HTTPFacadeOption 

type HTTPFacadeOption func(*HTTPFacade)

HTTPFacadeOption customizes the host-managed HTTP facade.

func HTTPFacadeClient 

func HTTPFacadeClient(client *http.Client) HTTPFacadeOption

HTTPFacadeClient configures the HTTP client used by the facade.

func HTTPFacadeDefaultTimeout 

func HTTPFacadeDefaultTimeout(timeout time.Duration) HTTPFacadeOption

HTTPFacadeDefaultTimeout configures the fallback timeout for requests without an explicit timeout.

func HTTPFacadeLogger 

func HTTPFacadeLogger(logger pluginapi.Logger) HTTPFacadeOption

HTTPFacadeLogger configures the logger used by the facade.

func HTTPFacadeMaxResponseBytes 

func HTTPFacadeMaxResponseBytes(limit int64) HTTPFacadeOption

HTTPFacadeMaxResponseBytes configures the fallback response body limit.

func HTTPFacadeMetrics 

func HTTPFacadeMetrics(metrics pluginapi.Metrics) HTTPFacadeOption

HTTPFacadeMetrics configures the metrics facade used by the HTTP facade.

func HTTPFacadeTracer 

func HTTPFacadeTracer(tracer pluginapi.Tracer) HTTPFacadeOption

HTTPFacadeTracer configures the tracer used by the facade.

type HelperOptions 

type HelperOptions struct {
	AccountTag          helpers.AccountTagOptions
	LuaIPv4CIDR         int
	LuaIPv6CIDR         int
	RWPIPv6CIDR         int
	TolerationsIPv6CIDR int
}

HelperOptions configures deterministic helper behavior for one host.

func HelperOptionsFromConfig 

func HelperOptionsFromConfig(cfg config.File) HelperOptions

HelperOptionsFromConfig derives helper options from the loaded server configuration and Lua-compatible environment knobs.

type HookRequestMetadata 

type HookRequestMetadata struct {
	Session                  string
	ExternalSessionID        string
	Service                  string
	Protocol                 string
	Username                 string
	Account                  string
	AccountField             string
	UniqueUserID             string
	DisplayName              string
	ClientIP                 string
	ClientPort               string
	ClientNet                string
	ClientHost               string
	ClientID                 string
	LocalIP                  string
	LocalPort                string
	OIDCCID                  string
	SAMLEntityID             string
	IDP                      pluginapi.IDPInfo
	BruteForceName           string
	EnvironmentName          string
	StatusMessage            string
	BruteForceCounter        uint
	HTTPStatus               int
	AuthLoginAttempt         uint
	Authenticated            bool
	UserFound                bool
	Authorized               bool
	LocalRequest             bool
	NoAuth                   bool
	Debug                    bool
	Repeating                bool
	RWP                      bool
	EnvironmentRejected      bool
	EnvironmentStageExpected bool
	SubjectStageExpected     bool
}

HookRequestMetadata contains host-owned caller metadata for HTTP hooks.

type Host 

type Host struct {
	// contains filtered or unexported fields
}

Host exposes process-owned services through the public plugin API.

func NewHost 

func NewHost(options ...HostOption) *Host

NewHost returns a minimal host facade for lifecycle-capable plugins.

func (*Host) BackendServers 

func (h *Host) BackendServers() pluginapi.BackendServers

BackendServers returns the host-owned backend candidate facade.

func (*Host) Cache 

func (h *Host) Cache(scope string) (pluginapi.Cache, error)

Cache returns a process-local cache isolated by plugin module scope.

func (*Host) CancelWorkers 

func (h *Host) CancelWorkers()

CancelWorkers asks all host-supervised workers to stop before shutdown waits.

func (*Host) CompatibilityTracer 

func (h *Host) CompatibilityTracer(string) (pluginapi.Tracer, error)

CompatibilityTracer denies exact scope selection outside a verified module-bound host.

func (*Host) Config 

func (h *Host) Config() pluginapi.ConfigView

Config returns a host-wide read-only config view.

func (*Host) ConnectionTargets 

func (h *Host) ConnectionTargets(string) pluginapi.ConnectionTargets

ConnectionTargets returns a host-owned connection target registration facade.

func (*Host) Go 

func (h *Host) Go(ctx context.Context, name string, fn func(context.Context) error)

Go starts a host-supervised goroutine with panic recovery.

func (*Host) HTTP 

func (h *Host) HTTP(scope string) pluginapi.HTTPClient

HTTP returns a scoped host-managed outbound HTTP facade.

func (*Host) Helpers 

func (h *Host) Helpers() pluginapi.DeterministicHelpers

Helpers returns deterministic non-secret helper functions.

func (*Host) LDAP 

func (h *Host) LDAP() pluginapi.LDAP

LDAP returns the configured host LDAP facade.

func (*Host) Logger 

func (h *Host) Logger(scope string) pluginapi.Logger

Logger returns a scoped structured logger facade.

func (*Host) Mail 

func (h *Host) Mail(scope string) pluginapi.Mailer

Mail returns a scoped host-managed SMTP/LMTP mail facade.

func (*Host) Metrics 

func (h *Host) Metrics(scope string) pluginapi.Metrics

Metrics returns a scoped host metrics facade.

func (*Host) Redis 

func (h *Host) Redis() pluginapi.Redis

Redis returns the configured host Redis facade.

func (*Host) ServiceContext 

func (h *Host) ServiceContext() context.Context

ServiceContext returns the host service context.

func (*Host) SetDebugRegistry 

func (h *Host) SetDebugRegistry(registry *pluginregistry.Registry)

SetDebugRegistry updates the host debug selector registry after plugin loading.

func (*Host) Tracer 

func (h *Host) Tracer(scope string) pluginapi.Tracer

Tracer returns a scoped host tracing facade.

func (*Host) WaitWorkers 

func (h *Host) WaitWorkers()

WaitWorkers waits for supervised plugin workers to exit.

func (*Host) WaitWorkersContext 

func (h *Host) WaitWorkersContext(ctx context.Context) error

WaitWorkersContext waits for supervised plugin workers until they exit or the context ends.

type HostOption 

type HostOption func(*Host)

HostOption customizes the minimal plugin host facade.

func WithBackendServers 

func WithBackendServers(backendServers pluginapi.BackendServers) HostOption

WithBackendServers configures the backend candidate facade exposed to plugins.

func WithCompatibilityRegisterer 

func WithCompatibilityRegisterer(registerer prometheus.Registerer) HostOption

WithCompatibilityRegisterer configures the host-owned exact collector registerer.

func WithConfig 

func WithConfig(view pluginapi.ConfigView) HostOption

WithConfig configures the host-wide config view exposed to plugins.

func WithConnectionTargets 

func WithConnectionTargets(targets pluginapi.ConnectionTargets) HostOption

WithConnectionTargets configures the connection-target facade exposed to plugins.

func WithDebugConfig 

func WithDebugConfig(cfg config.File) HostOption

WithDebugConfig configures the server log config used for plugin debug gating.

func WithDebugRegistry 

func WithDebugRegistry(registry *pluginregistry.Registry) HostOption

WithDebugRegistry configures the registered plugin debug selector lookup.

func WithHTTPClient 

func WithHTTPClient(client *http.Client) HostOption

WithHTTPClient configures the HTTP transport used by host-managed plugin HTTP calls.

func WithHelpers 

func WithHelpers(helpers pluginapi.DeterministicHelpers) HostOption

WithHelpers configures deterministic helper behavior exposed to plugins.

func WithLDAP 

func WithLDAP(ldap pluginapi.LDAP) HostOption

WithLDAP configures the LDAP facade exposed to plugins.

func WithLDAPExecutor 

func WithLDAPExecutor(executor LDAPExecutor) HostOption

WithLDAPExecutor configures the LDAP facade from an API-level executor.

func WithLogger 

func WithLogger(logger *slog.Logger) HostOption

WithLogger configures the slog-backed plugin logger facade.

func WithMailSender 

func WithMailSender(sender smtp.Client) HostOption

WithMailSender configures the SMTP/LMTP sender used by host-managed plugin mail calls.

func WithMetricsFactory 

func WithMetricsFactory(factory func(string) pluginapi.Metrics) HostOption

WithMetricsFactory configures scoped metrics construction for plugins.

func WithRedis 

func WithRedis(redis pluginapi.Redis) HostOption

WithRedis configures the Redis facade exposed to plugins.

func WithRedisClient 

func WithRedisClient(client rediscli.Client) HostOption

WithRedisClient configures the Redis facade from the central Redis client.

func WithRedisPrefix 

func WithRedisPrefix(prefix string) HostOption

WithRedisPrefix configures the prefix used by host Redis key builders.

func WithServiceContext 

func WithServiceContext(ctx context.Context) HostOption

WithServiceContext configures the process service context exposed to plugins.

func WithTracerFactory 

func WithTracerFactory(factory func(string) pluginapi.Tracer) HostOption

WithTracerFactory configures scoped tracer construction for plugins.

type LDAPEndpointResolver 

type LDAPEndpointResolver interface {
	Endpoints(context.Context, string) ([]pluginapi.LDAPEndpoint, error)
}

LDAPEndpointResolver resolves current trace-safe endpoint metadata by pool.

func NewLDAPConfigEndpointResolver 

func NewLDAPConfigEndpointResolver(currentConfig func() config.File) LDAPEndpointResolver

NewLDAPConfigEndpointResolver returns a resolver backed by a current-config callback.

type LDAPExecutor 

type LDAPExecutor interface {
	Search(context.Context, pluginapi.LDAPSearchRequest) (pluginapi.LDAPSearchResult, error)
	Modify(context.Context, pluginapi.LDAPModifyRequest) error
}

LDAPExecutor executes API-level LDAP operations behind the host facade.

func NewLDAPQueueExecutor 

func NewLDAPQueueExecutor(queue LDAPQueue) LDAPExecutor

NewLDAPQueueExecutor returns an executor backed by the existing LDAP lookup queue.

type LDAPFacade 

type LDAPFacade struct {
	// contains filtered or unexported fields
}

LDAPFacade validates public LDAP requests before delegating to a host executor.

func NewLDAPFacade 

func NewLDAPFacade(executor LDAPExecutor, endpointResolvers ...LDAPEndpointResolver) *LDAPFacade

NewLDAPFacade returns a validating LDAP facade over a host executor.

func (*LDAPFacade) Endpoints 

func (f *LDAPFacade) Endpoints(ctx context.Context, poolName string) ([]pluginapi.LDAPEndpoint, error)

Endpoints returns detached trace-safe metadata for the requested LDAP pool.

func (*LDAPFacade) Modify 

func (f *LDAPFacade) Modify(ctx context.Context, request pluginapi.LDAPModifyRequest) error

Modify validates and delegates an LDAP modify request.

func (*LDAPFacade) Search 

func (f *LDAPFacade) Search(ctx context.Context, request pluginapi.LDAPSearchRequest) (pluginapi.LDAPSearchResult, error)

Search validates and delegates an LDAP search request.

type LDAPQueue 

type LDAPQueue interface {
	Push(request *bktype.LDAPRequest, priority int)
}

LDAPQueue accepts internal LDAP lookup requests.

type MailFacade 

type MailFacade struct {
	// contains filtered or unexported fields
}

MailFacade sends plugin mail through the host-owned SMTP/LMTP implementation.

func NewMailFacade 

func NewMailFacade(scope string, options ...MailFacadeOption) *MailFacade

NewMailFacade returns a scoped host mail facade.

func (*MailFacade) Send 

func (f *MailFacade) Send(ctx context.Context, message pluginapi.MailMessage) error

Send adapts an API-level mail message and sends it synchronously.

type MailFacadeOption 

type MailFacadeOption func(*MailFacade)

MailFacadeOption customizes a host-managed mail facade.

func MailFacadeLogger 

func MailFacadeLogger(logger pluginapi.Logger) MailFacadeOption

MailFacadeLogger configures the logger used by the facade.

func MailFacadeSender 

func MailFacadeSender(sender smtp.Client) MailFacadeOption

MailFacadeSender configures the SMTP/LMTP sender used by the facade.

type MetricsFacade 

type MetricsFacade struct {
	// contains filtered or unexported fields
}

MetricsFacade validates plugin metric definitions and runtime label values.

func NewMetricsFacade 

func NewMetricsFacade(scope string) *MetricsFacade

NewMetricsFacade returns a scoped metrics facade.

func NewMetricsFacadeWithRegisterer 

func NewMetricsFacadeWithRegisterer(scope string, registerer prometheus.Registerer) *MetricsFacade

NewMetricsFacadeWithRegisterer returns a scoped metrics facade backed by a Prometheus registerer.

func (*MetricsFacade) Counter 

func (m *MetricsFacade) Counter(definition pluginapi.MetricDefinition) (pluginapi.Counter, error)

Counter returns a declared counter handle.

func (*MetricsFacade) Gauge 

func (m *MetricsFacade) Gauge(definition pluginapi.MetricDefinition) (pluginapi.Gauge, error)

Gauge returns a declared gauge handle.

func (*MetricsFacade) Histogram 

func (m *MetricsFacade) Histogram(definition pluginapi.MetricDefinition) (pluginapi.Histogram, error)

Histogram returns a declared histogram handle.

func (*MetricsFacade) ObservationCount 

func (m *MetricsFacade) ObservationCount(name string) int

ObservationCount reports valid observations for tests and diagnostics.

func (*MetricsFacade) Summary 

func (m *MetricsFacade) Summary(definition pluginapi.MetricDefinition) (pluginapi.Summary, error)

Summary returns a declared summary handle.

type Observer 

type Observer interface {
	ObservePluginCall(CallRecord)
}

Observer receives automatic plugin call observations.

type OperationalObserver 

type OperationalObserver struct {
	// contains filtered or unexported fields
}

OperationalObserver records bounded metrics and secret-safe structured plugin call logs.

func NewOperationalObserver 

func NewOperationalObserver(logger *slog.Logger, options ...OperationalObserverOption) *OperationalObserver

NewOperationalObserver returns the default operational plugin call observer.

func (*OperationalObserver) ObservePluginCall 

func (o *OperationalObserver) ObservePluginCall(record CallRecord)

ObservePluginCall records one host-invoked plugin method result.

type OperationalObserverOption 

type OperationalObserverOption func(*OperationalObserver)

OperationalObserverOption customizes an operational observer.

func WithOperationalObserverDebugConfig 

func WithOperationalObserverDebugConfig(cfg config.File, registry *pluginregistry.Registry) OperationalObserverOption

WithOperationalObserverDebugConfig configures plugin debug selector gating for success logs.

func WithOperationalObserverMetrics 

func WithOperationalObserverMetrics(metrics stats.Metrics) OperationalObserverOption

WithOperationalObserverMetrics configures metrics recording for tests.

type Option 

type Option func(*Runner)

Option customizes a Runner.

func WithHost 

func WithHost(host pluginapi.Host) Option

WithHost configures the host facade passed to plugin lifecycle methods.

func WithObserver 

func WithObserver(observer Observer) Option

WithObserver configures automatic plugin call observation.

func WithPluginConfig 

func WithPluginConfig(plugins *config.PluginsSection) Option

WithPluginConfig records the restart-only baseline used by later config reloads.

type RedisFacadeOption 

type RedisFacadeOption func(*redisFacade)

RedisFacadeOption customizes the Redis facade.

func RedisFacadePrefix 

func RedisFacadePrefix(prefix string) RedisFacadeOption

RedisFacadePrefix configures the Redis key prefix applied by the key builder.

func RedisFacadeScriptTimeout 

func RedisFacadeScriptTimeout(timeout time.Duration) RedisFacadeOption

RedisFacadeScriptTimeout configures the default timeout for script operations.

type Runner 

type Runner struct {
	// contains filtered or unexported fields
}

Runner coordinates plugin lifecycle and request-time readiness.

func DefaultRunner 

func DefaultRunner() (*Runner, bool)

DefaultRunner returns the current process plugin runtime runner.

func NewRunner 

func NewRunner(state *pluginloader.State, options ...Option) *Runner

NewRunner returns a lifecycle runner for a loader state.

func NewRunnerFromInstances 

func NewRunnerFromInstances(
	registry *pluginregistry.Registry,
	instances []pluginloader.ModuleInstance,
	options ...Option,
) *Runner

NewRunnerFromInstances returns a lifecycle runner from explicit module instances.

func (*Runner) EnqueuePostAction 

func (r *Runner) EnqueuePostAction(
	ctx context.Context,
	qualifiedName string,
	request pluginapi.PostActionRequest,
) (pluginapi.PostActionEnqueueResult, error)

EnqueuePostAction invokes one ready post-action target behind the host panic boundary.

func (*Runner) EvaluateEnvironment 

func (r *Runner) EvaluateEnvironment(
	ctx context.Context,
	qualifiedName string,
	request pluginapi.EnvironmentRequest,
) (pluginapi.EnvironmentResult, error)

EvaluateEnvironment invokes one ready environment source behind the host panic boundary.

func (*Runner) EvaluateSubject 

func (r *Runner) EvaluateSubject(
	ctx context.Context,
	qualifiedName string,
	request pluginapi.SubjectRequest,
) (pluginapi.SubjectResult, error)

EvaluateSubject invokes one ready subject source behind the host panic boundary.

func (*Runner) ExecuteObligation 

func (r *Runner) ExecuteObligation(
	ctx context.Context,
	qualifiedName string,
	request pluginapi.ObligationRequest,
) (pluginapi.ObligationResult, error)

ExecuteObligation invokes one ready obligation target behind the host panic boundary.

func (*Runner) Hooks 

func (r *Runner) Hooks() []pluginregistry.Component

Hooks returns registered native hook components in registration order.

func (*Runner) ListAccounts 

func (r *Runner) ListAccounts(
	ctx context.Context,
	qualifiedName string,
	request pluginapi.AccountListRequest,
) (pluginapi.AccountListResult, error)

ListAccounts invokes one ready backend account listing behind the host panic boundary.

func (*Runner) ModuleCapabilities 

func (r *Runner) ModuleCapabilities(moduleName string) []pluginapi.Capability

ModuleCapabilities returns a copy of the capabilities granted to one module.

func (*Runner) ModuleConfig 

func (r *Runner) ModuleConfig(moduleName string) pluginapi.ConfigView

ModuleConfig returns the current host-owned plugin config view for a module.

func (*Runner) Ready 

func (r *Runner) Ready() bool

Ready reports whether request-time plugin component invocation is enabled.

func (*Runner) Reconfigure 

func (r *Runner) Reconfigure(ctx context.Context, file config.File) error

Reconfigure applies config-only plugin reloads and rejects restart-only loader changes.

func (*Runner) ServeHook 

func (r *Runner) ServeHook(
	ctx context.Context,
	qualifiedName string,
	request pluginapi.HookRequest,
) (pluginapi.HookResponse, error)

ServeHook invokes one ready hook behind the host panic boundary.

func (*Runner) Start 

func (r *Runner) Start(ctx context.Context) error

Start runs plugin Start, registered init tasks, and finally marks request-time execution ready.

func (*Runner) Stop 

func (r *Runner) Stop(ctx context.Context) error

Stop stops init tasks before plugin runtime instances.

func (*Runner) VerifyPassword 

func (r *Runner) VerifyPassword(
	ctx context.Context,
	qualifiedName string,
	request pluginapi.BackendAuthRequest,
) (pluginapi.BackendResult, error)

VerifyPassword invokes one ready backend password check behind the host panic boundary.

type SnapshotOption 

type SnapshotOption func(*snapshotOptions)

SnapshotOption configures request snapshot construction.

func WithSnapshotConfig 

func WithSnapshotConfig(cfg config.File) SnapshotOption

WithSnapshotConfig derives secret-bearing request headers from server configuration.

func WithSnapshotSecretHeaders 

func WithSnapshotSecretHeaders(headers ...string) SnapshotOption

WithSnapshotSecretHeaders adds configured secret-bearing request headers to redact.

type SubjectSourceBridge 

type SubjectSourceBridge struct {
	// contains filtered or unexported fields
}

SubjectSourceBridge adapts native plugin subject sources into the post-backend flow.

func NewSubjectSourceBridge 

func NewSubjectSourceBridge(runner *Runner) *SubjectSourceBridge

NewSubjectSourceBridge returns a bridge bound to one plugin runner.

func (*SubjectSourceBridge) Analyze 

func (b *SubjectSourceBridge) Analyze(
	ctx *gin.Context,
	view *core.StateView,
	passDBResult *core.PassDBResult,
	current definitions.AuthResult,
) (definitions.AuthResult, bool)

Analyze executes registered native subject sources after the existing Lua subject flow.

func (*SubjectSourceBridge) AnalyzeMixed 

func (b *SubjectSourceBridge) AnalyzeMixed(
	ctx *gin.Context,
	view *core.StateView,
	passDBResult *core.PassDBResult,
	lua core.ScheduledLuaSubject,
) (definitions.AuthResult, bool)

AnalyzeMixed coordinates Lua checks that declare a native plugin subject dependency.

type TracerFacade 

type TracerFacade struct {
	// contains filtered or unexported fields
}

TracerFacade starts plugin spans through the host tracing package.

func NewCompatibilityTracerFacade 

func NewCompatibilityTracerFacade(scope string) *TracerFacade

NewCompatibilityTracerFacade returns a tracer with an exact operator-allowlisted instrumentation scope.

func NewTracerFacade 

func NewTracerFacade(scope string) *TracerFacade

NewTracerFacade returns a scoped plugin tracer facade.

func (*TracerFacade) Start 

func (t *TracerFacade) Start(ctx context.Context, name string, attrs ...pluginapi.TraceAttribute) (context.Context, pluginapi.Span)

Start begins a child span using host-owned OpenTelemetry plumbing.

func (*TracerFacade) StartWithOptions 

func (t *TracerFacade) StartWithOptions(ctx context.Context, name string, options pluginapi.SpanStartOptions) (context.Context, pluginapi.Span)

StartWithOptions begins a child span with value-only kind and attribute options.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.