Struct OpaPlugin 

pub struct OpaPlugin {
    host: String,
    policy: String,
    ssl_verify: bool,
    timeout: Duration,
    with_consumer: bool,
    send_headers_upstream: Vec<String>,
    client: Arc<OutboundClient>,
}

Sends an OPA input document to an external policy server and routes on the returned decision: allow: true continues (success port), otherwise rejects (error port).

Fields

host: String

OPA base URL (e.g. http://opa:8181).

policy: String

Decision path appended as /v1/data/<policy>.

ssl_verify: bool

TLS certificate verification for https callouts.

timeout: Duration

Whole-call callout deadline.

with_consumer: bool

Include the matched consumer object in the input document.

send_headers_upstream: Vec<String>

OPA-response header names copied onto the request forwarded upstream on allow (lowercased). Empty means none are copied.

client: Arc<OutboundClient>

Shared pooled HTTP client (from PluginResources).

Implementations

impl OpaPlugin

pub fn from_config( config: &HashMap<String, Value>, resources: &Arc<PluginResources>, ) -> Result<Self, String>

Builds the plugin from node config.

Accepted keys:

• host (string, required): OPA base URL. Missing → config error.
• policy (string, required): decision path appended as /v1/data/<policy>. Missing → config error.
• ssl_verify (bool, default true): verify TLS certificates for https callouts.
• timeout (integer ms, default 3000): whole-call callout deadline.
• with_consumer (bool, default false): include a consumer object (built from context.message’s consumer.* keys) in the input document.
• with_route / with_service (bool, default false): accepted for APISIX compatibility but no-ops — featherbit has no route/service objects.
• send_headers_upstream (array of strings, optional): OPA-response header names copied onto the request forwarded upstream on allow. A configured name absent from the OPA response removes any client-supplied value.

type: opa
config:
  host: http://opa:8181
  policy: example/allow
  with_consumer: true
  send_headers_upstream: [x-user-id]
  ssl_verify: true
  timeout: 3000

fn build_opa_input(&self, ctx: &Context, now_unix: u64) -> Value

Builds the OPA input document from the context, mirroring opa/helper.lua’s build_opa_input as closely as featherbit’s Context allows. now_unix is injected so the (otherwise wall-clock) var.timestamp is testable.

fn apply_allow(&self, ctx: &mut Context, decision: &OpaDecision)

On an allow decision, copies the configured send_headers_upstream from the OPA response onto the request forwarded upstream. A configured header absent from the OPA response removes any client-supplied value.

fn build_deny( &self, ctx: Context, decision: &OpaDecision, ) -> PluginExecutionError

Builds the OPA_DENIED rejection from a deny decision, honoring OPA-supplied status (default 403), headers, and reason (as the body).

fn build_error( &self, ctx: Context, status: u16, message: String, ) -> PluginExecutionError

Builds the OPA_ERROR rejection used when the callout fails or the response cannot be interpreted as a decision.

Trait Implementations

impl Plugin for OpaPlugin

fn plugin_type(&self) -> &str

Unique identifier for the plugin type (e.g., “proxy-rewrite”, “upstream”).

fn execute<'life0, 'life1, 'async_trait>( &'life0 self, ctx: Context, _named_inputs: &'life1 HashMap<String, Value>, ) -> Pin<Box<dyn Future<Output = Result<PluginOutput, PluginExecutionError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Executes the plugin logic against the request/response context.