Module wolf_rbac 

Wolf-RBAC authorization plugin (wolf-rbac) — token-check subset.

Port of the request-time authorization core of APISIX’s wolf-rbac plugin. On each request it extracts the caller’s wolf RBAC token, parses it, and asks the wolf-server whether that token may perform the request’s method on the request’s path. On allow it copies the returned user identity into request headers and context.message; on deny it exits on the denied port.

Only an actual authorization verdict is a denial: 200 allows, 401/403 denies. A wolf-server callout that fails outright — unreachable, timed out, or answering with any other status (5xx, or a 404 from a mistyped server URL) — is a genuine infrastructure failure and stays on the error port (see classify_access_check).

Only the _M.rewrite authorization path is ported. The interactive /apisix/plugin/wolf-rbac/{login,change_pwd,user_info} admin endpoints — which proxy credential exchange to wolf-server and mint tokens — are a session/login concern and are not implemented. See the Deviations in website/docs/reference/plugins/wolf-rbac.md.

Structs

UserInfo 🔒

The subset of wolf-server’s userInfo payload the plugin propagates.

WolfRbacPlugin

Checks a wolf RBAC token against a wolf-server access_check endpoint.

Enums

AccessCheck 🔒

What a wolf-server access_check reply means.

Constants

TOKEN_VERSION 🔒

The rbac-token version prefix wolf uses (V1#appid#wolf_token).

Functions

build_access_check_url 🔒

Builds the access_check URL with the query arguments wolf-server expects.

classify_access_check 🔒

Classifies a wolf-server access_check status.

extract_rbac_token 🔒

Extracts the rbac token from (in APISIX precedence order): the rbac_token query argument, the Authorization header, the X-RBAC-Token header, then the x-rbac-token cookie.

parse_rbac_token 🔒

Parses a V1#<appid>#<wolf_token> rbac token into (appid, wolf_token). Errors on the wrong version prefix or the wrong number of # segments.

parse_user_info 🔒

Extracts data.userInfo.{id,username,nickname} from a wolf-server response body. nickname falls back to username; a missing username yields None (no identity to propagate).

percent_encode 🔒

Percent-encodes a query-argument value (RFC3986 unreserved chars kept).