Struct DingtalkAuthPlugin 

pub struct DingtalkAuthPlugin {
    app_key: String,
    app_secret: String,
    code_header: String,
    code_query: String,
    token_url: String,
    userinfo_url: String,
    set_userinfo_header: bool,
    timeout: Duration,
    ssl_verify: bool,
    resources: Arc<PluginResources>,
    token_cache: Mutex<Option<(String, Instant)>>,
}

Authenticates requests by resolving a DingTalk authorization code to a DingTalk user via the OAuth accessToken + getuserinfo APIs.

Fields

app_key: String

app_secret: String

code_header: String

Lowercased header the code is read from first.

code_query: String

Query parameter the code falls back to.

token_url: String

userinfo_url: String

set_userinfo_header: bool

timeout: Duration

ssl_verify: bool

resources: Arc<PluginResources>

token_cache: Mutex<Option<(String, Instant)>>

In-process cache of the app-level access token: (token, fetched_at).

Implementations

impl DingtalkAuthPlugin

pub fn from_config( config: &HashMap<String, Value>, resources: &Arc<PluginResources>, ) -> Result<Self, String>

Builds the plugin from node config.

Accepted keys:

• app_key (string, required): DingTalk application key.
• app_secret (string, required): DingTalk application secret.
• code_header (string, default "X-DingTalk-Code"): header the authorization code is read from first (matched case-insensitively).
• code_query (string, default "code"): query parameter the code falls back to when the header is absent.
• access_token_url (string, default DingTalk’s oauth2/accessToken).
• userinfo_url (string, default DingTalk’s v2/user/getuserinfo).
• set_userinfo_header (bool, default true): when true the resolved userinfo JSON is base64-encoded into the X-Userinfo request header for the upstream.
• timeout (integer ms, default 6000): per-callout timeout.
• ssl_verify (bool, default true): verify DingTalk’s TLS certificate.

Session-only APISIX keys (secret, secret_fallbacks, redirect_uri, cookie_expires_in) are not accepted — see the module docs.

type: dingtalk-auth
config:
  app_key: ${DINGTALK_APP_KEY}
  app_secret: ${DINGTALK_APP_SECRET}
  code_header: X-DingTalk-Code

fn extract_code(&self, ctx: &Context) -> Option<String>

Reads the authorization code from the configured header, falling back to the query parameter.

async fn access_token(&self) -> Result<String, DingtalkError>

Returns a valid access token, using the in-process cache when fresh and fetching a new one from DingTalk otherwise.

async fn fetch_userinfo( &self, access_token: &str, code: &str, ) -> Result<Value, DingtalkError>

Exchanges the code for DingTalk userinfo using access_token.

fn reject( ctx: Context, message: &str, ) -> Result<PluginOutput, PluginExecutionError>

Builds the 401 rejection carrying the context so the graph engine routes through the error port.

Trait Implementations

impl Plugin for DingtalkAuthPlugin

fn plugin_type(&self) -> &str

Unique identifier for the plugin type (e.g., “proxy-rewrite”, “upstream”).

fn execute<'life0, 'life1, 'async_trait>( &'life0 self, ctx: Context, _named_inputs: &'life1 HashMap<String, Value>, ) -> Pin<Box<dyn Future<Output = Result<PluginOutput, PluginExecutionError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Executes the plugin logic against the request/response context.