Struct ConsumerRestrictionPlugin 

pub struct ConsumerRestrictionPlugin {
    restriction_type: RestrictionType,
    whitelist: Vec<String>,
    blacklist: Vec<String>,
    allowed_by_methods: Vec<AllowedByMethod>,
    rejected_code: u16,
    rejected_msg: Option<String>,
}

Restricts access based on the attached consumer’s name or group.

Evaluation mirrors APISIX: the blacklist is checked first (a match rejects), then the whitelist (a non-match rejects), then — only for consumers not already cleared by the whitelist — allowed_by_methods. When no consumer is attached the request is rejected 401; list rejections use rejected_code (default 403). All rejections carry error code CONSUMER_RESTRICTED.

Fields

restriction_type: RestrictionType

Which consumer attribute the lists match (consumer_name / consumer_group_id).

whitelist: Vec<String>

When non-empty, the value must be present or the request is rejected.

blacklist: Vec<String>

When non-empty, a matching value is rejected.

allowed_by_methods: Vec<AllowedByMethod>

Per-consumer HTTP-method allowlists.

rejected_code: u16

HTTP status used for list rejections.

rejected_msg: Option<String>

Optional custom rejection message.

Implementations

impl ConsumerRestrictionPlugin

pub fn from_config(config: &HashMap<String, Value>) -> Result<Self, String>

Builds the plugin from node config, failing fast on invalid combinations.

Accepted keys:

• type (string, default "consumer_name"): the consumer attribute the lists match. Supported: consumer_name (matches consumer.name) and consumer_group_id (matches consumer.group). service_id and route_id exist in APISIX but have no featherbit analogue and are rejected at config load.
• whitelist (array of strings): values allowed through; a consumer whose value is absent is rejected. Mutually exclusive with blacklist.
• blacklist (array of strings): values rejected on match.
• allowed_by_methods (array of { user, methods }): restricts the named consumer to the listed HTTP methods.
• At least one of whitelist / blacklist / allowed_by_methods is required.
• rejected_code (integer, default 403): status for list rejections.
• rejected_msg (string, optional): custom rejection message.

type: consumer-restriction
config:
  type: consumer_name
  whitelist: ["alice", "bob"]
  allowed_by_methods:
    - user: alice
      methods: ["GET", "POST"]
  rejected_code: 403
  rejected_msg: "You shall not pass"

fn value_key(&self) -> &'static str

The context.message key holding the value this instance matches on.

fn type_label(&self) -> &'static str

Human label for the configured type, used in default messages.

fn reject( &self, ctx: Context, status: u16, message: String, ) -> Result<PluginOutput, PluginExecutionError>

Builds a rejection carrying the context so the graph routes the error port.

Trait Implementations

impl Plugin for ConsumerRestrictionPlugin

fn plugin_type(&self) -> &str

Unique identifier for the plugin type (e.g., “proxy-rewrite”, “upstream”).

fn execute<'life0, 'life1, 'async_trait>( &'life0 self, ctx: Context, _named_inputs: &'life1 HashMap<String, Value>, ) -> Pin<Box<dyn Future<Output = Result<PluginOutput, PluginExecutionError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Executes the plugin logic against the request/response context.