Struct UaRestrictionPlugin 

pub struct UaRestrictionPlugin {
    allowlist: Vec<Regex>,
    denylist: Vec<Regex>,
    bypass_missing: bool,
    rejected_code: u16,
    rejected_msg: String,
}

Restricts access based on the User-Agent request header.

Exactly one of allowlist / denylist is configured (APISIX oneOf parity). Each User-Agent value is trimmed and tested against the regexes; in allowlist mode a request passes when any value matches any rule, in denylist mode a request is rejected when any value matches any rule. A missing User-Agent is rejected unless bypass_missing is set.

Fields

allowlist: Vec<Regex>

Compiled allowlist regexes; non-empty means allowlist mode.

denylist: Vec<Regex>

Compiled denylist regexes; non-empty means denylist mode.

bypass_missing: bool

Pass requests that carry no User-Agent header (default false).

rejected_code: u16

HTTP status for rejections (default 403).

rejected_msg: String

Body message for rejections.

Implementations

impl UaRestrictionPlugin

pub fn from_config(config: &HashMap<String, Value>) -> Result<Self, String>

Builds the plugin from node config.

Accepted keys:

• allowlist (array of regex strings): only matching User-Agents pass.
• denylist (array of regex strings): matching User-Agents are rejected. Exactly one of allowlist / denylist must be non-empty (APISIX rejects both-set and neither-set configs); regexes are compiled here, so an invalid pattern is a config error.
• bypass_missing (bool, default false): pass requests without a User-Agent header instead of rejecting them.
• rejected_code (integer 200–599, default 403): rejection status.
• rejected_msg (string, default "Not allowed"): rejection message, returned as {"message": ...}.

type: ua-restriction
config:
  denylist: ["curl/.*", "(?i)spider"]
  bypass_missing: false
  rejected_msg: Not allowed

fn reject(&self, ctx: Context) -> Result<PluginOutput, PluginExecutionError>

Builds the 403-style rejection: JSON body on the response, error routed through the error port with code UA_RESTRICTED.

Trait Implementations

impl Plugin for UaRestrictionPlugin

fn plugin_type(&self) -> &str

Unique identifier for the plugin type (e.g., “proxy-rewrite”, “upstream”).

fn execute<'life0, 'life1, 'async_trait>( &'life0 self, ctx: Context, _named_inputs: &'life1 HashMap<String, Value>, ) -> Pin<Box<dyn Future<Output = Result<PluginOutput, PluginExecutionError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Executes the plugin logic against the request/response context.