Struct AclPlugin 

pub struct AclPlugin {
    allowed_by: Vec<String>,
    denied_by: Vec<String>,
    rejected_code: u16,
    rejected_msg: Option<String>,
}

Admits or blocks requests based on the attached consumer’s group.

Evaluation: with no consumer attached the request is rejected 401. The denied_by list is checked first (deny wins) — a consumer whose group is listed is rejected. Then, when allowed_by is non-empty, a consumer whose group is not listed (including a consumer with no group) is rejected. List rejections use rejected_code (default 403) and carry error code ACL_DENIED.

Fields

allowed_by: Vec<String>

Groups permitted through; when non-empty, all other groups are rejected.

denied_by: Vec<String>

Groups blocked; a match rejects regardless of allowed_by.

rejected_code: u16

HTTP status used for list rejections.

rejected_msg: Option<String>

Optional custom rejection message.

Implementations

impl AclPlugin

pub fn from_config(config: &HashMap<String, Value>) -> Result<Self, String>

Builds the plugin from node config, failing fast when neither list is set.

Accepted keys:

• allowed_by (array of strings): consumer groups permitted through. When non-empty, a consumer whose group is not listed is rejected.
• denied_by (array of strings): consumer groups blocked. Checked before allowed_by — deny wins.
• At least one of allowed_by / denied_by is required.
• rejected_code (integer, default 403): status for list rejections.
• rejected_msg (string, optional): custom rejection message.

type: acl
config:
  allowed_by: ["partners", "internal"]
  denied_by: ["banned"]
  rejected_code: 403

fn reject( &self, ctx: Context, status: u16, message: String, ) -> Result<PluginOutput, PluginExecutionError>

Builds a rejection carrying the context so the graph routes the error port.

Trait Implementations

impl Plugin for AclPlugin

fn plugin_type(&self) -> &str

Unique identifier for the plugin type (e.g., “proxy-rewrite”, “upstream”).

fn execute<'life0, 'life1, 'async_trait>( &'life0 self, ctx: Context, _named_inputs: &'life1 HashMap<String, Value>, ) -> Pin<Box<dyn Future<Output = Result<PluginOutput, PluginExecutionError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Executes the plugin logic against the request/response context.