Struct JweDecryptPlugin 

pub struct JweDecryptPlugin {
    header: String,
    forward_header: String,
    strict: bool,
    inline_key: Option<Vec<u8>>,
    use_consumers: bool,
    resources: Arc<PluginResources>,
}

Decrypts a JWE dir+A256GCM token and forwards the plaintext downstream.

On success the decrypted plaintext replaces the value of forward_header in the outbound request; the request otherwise continues unchanged through the success port. On any failure (missing token when strict, malformed compact serialization, unsupported algorithm, unknown kid, or a failed AEAD check) the request is rejected with a 401 JSON response and a JWE_INVALID error routed through the error port.

Fields

header: String

Lowercased header the encrypted token is read from.

forward_header: String

Lowercased header the decrypted plaintext is written to.

strict: bool

When true, a missing token is rejected; when false the request passes through untouched.

inline_key: Option<Vec<u8>>

Inline symmetric key (32 raw bytes) when configured; takes precedence over the consumer store.

use_consumers: bool

When true, resolve the key from the consumer store using the token kid.

resources: Arc<PluginResources>

Implementations

impl JweDecryptPlugin

pub fn from_config( config: &HashMap<String, Value>, resources: &Arc<PluginResources>, ) -> Result<Self, String>

Builds the plugin from node config.

Accepted keys:

• header (string, default "Authorization"): header carrying the JWE token; matched case-insensitively (an optional Bearer prefix is stripped).
• forward_header (string, default "Authorization"): header the decrypted plaintext is written to before proxying.
• strict (bool, default true): when true a missing token is rejected; when false the request passes through unchanged.
• key (string, optional): inline symmetric key, base64-encoded, which must decode to exactly 32 bytes (AES-256). Used for every request.
• use_consumers (bool, default false): resolve the key per request from the gateway consumers: section — the token’s kid selects the consumer’s jwe-decrypt credential ({key: <kid>, secret: <32-byte key>, is_base64_encoded: <bool>}).
• At least one of key / use_consumers must be provided.
• alg (string, default "dir") / enc (string, default "A256GCM"): only these values are supported; any other value is a config error (fail-fast at load), since full JWE is not implemented.

type: jwe-decrypt
config:
  header: Authorization
  forward_header: Authorization
  strict: true
  use_consumers: true

fn reject( ctx: Context, message: &str, ) -> Result<PluginOutput, PluginExecutionError>

Builds the 401 rejection (code JWE_INVALID) carrying the context so the graph engine routes through the error port.

fn consumer_key(&self, kid: Option<&str>) -> Result<Vec<u8>, &'static str>

Resolves the 32-byte AES key for the given token kid from the consumer store. Returns the raw key bytes, or None with a reason.

Trait Implementations

impl Plugin for JweDecryptPlugin

fn plugin_type(&self) -> &str

Unique identifier for the plugin type (e.g., “proxy-rewrite”, “upstream”).

fn execute<'life0, 'life1, 'async_trait>( &'life0 self, ctx: Context, _named_inputs: &'life1 HashMap<String, Value>, ) -> Pin<Box<dyn Future<Output = Result<PluginOutput, PluginExecutionError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Executes the plugin logic against the request/response context.