ihawu-jackson/org.ihawu.jackson

Package-level declarations

The Jackson backend for Ihawu masking — the write half of the engine. It executes the decisions the serialization-neutral ihawu-core engine makes, at Jackson's serialization boundary.

Entry point

IhawuModule — the Jackson Module you register on an ObjectMapper to activate masking. It wires the neutral masking engine into Jackson via a BeanSerializerModifier, so every @IhawuResource-annotated type is masked with no per-handler code.
IhawuSerialization — the per-call attribute key under which the caller's IhawuPrincipal is supplied for a single write (ObjectWriter.withAttribute).

Startup validation & config

MaskingContractValidator — checks configured policies against a resource's declared type contract using Jackson's introspection, so an unenforceable policy is caught up front rather than at runtime.
JacksonPolicyConfig — loads a RoleBasedResourcePolicyResolver from JSON configuration.

Types

IhawuModule

class IhawuModule(resolver: ResourcePolicyResolver, failureSink: MaskingFailureSink = Slf4jMaskingFailureSink(), resolverErrorMode: ResolverErrorMode = ResolverErrorMode.MASK_ALL) : SimpleModule

Jackson module that activates Ihawu masking on an ObjectMapper.

IhawuSerialization

object IhawuSerialization

Keys for the per-call Jackson attributes that carry request context into Ihawu's masking serializer.

JacksonPolicyConfig

object JacksonPolicyConfig

Loads a RoleBasedResourcePolicyResolver from JSON configuration.

MaskingContractValidator

object MaskingContractValidator

Checks masking policies against the declared type contract of their resource, so a policy that would emit schema-invalid output is caught up front rather than at serialization time.

MaskingContractViolation

data class MaskingContractViolation(val resource: String, val field: String, val reason: String)

A masking policy whose output cannot satisfy the field's declared type contract.

Slf4jMaskingFailureSink

class Slf4jMaskingFailureSink : MaskingFailureSink

The JVM MaskingFailureSink: logs each fail-closed drop via SLF4J with the resource (and field) name only — never the protected value. Resource-level failures (FailReason.NO_PRINCIPAL, FailReason.RESOLVER_ERROR) log once per (call, resource); per-field failures log per field.