ihawu-ktor/org.ihawu.ktor

Package-level declarations

The Ktor server adapter for Ihawu masking — the zero-wiring experience the Spring Boot starter gives Spring, for Ktor apps. It builds on the multiplatform ihawu-kotlinx backend and the serialization-neutral ihawu-core engine (ADR 0009); it adds no new engine.

Entry point

IhawuKtor — the Ktor application plugin. A single install(IhawuKtor) { … } registers a masking ContentNegotiation converter and installs the per-call masking context, so every @IhawuResource response is masked with no per-route code.
IhawuKtorConfig — the plugin DSL: the principal bridge (resolvePrincipal), the field-policy source (policies / policyResolver), and the resource registry (resources).

Extension points

MaskingContentConverter — the ContentConverter that wraps each response type's serializer with the kotlinx masking serializer. Registered for you by IhawuKtor; exposed for advanced setups that drive ContentNegotiation themselves.
ihawuPrincipal — the default identity bridge: reads an org.ihawu.core.policy.IhawuPrincipal from the call's Authentication result. Fail-closed — no authenticated principal yields null, which masks the whole resource.

Types

CompositeMaskingFailureSink

class CompositeMaskingFailureSink(sinks: MaskingFailureSink) : MaskingFailureSink

Fans a fail-closed notification out to several MaskingFailureSinks in order — e.g. a logger and MicrometerMaskingFailureSink, so adding metrics never costs the log line:

IhawuKtorConfig

class IhawuKtorConfig

Configuration for the IhawuKtor plugin — the analogue of the Spring Boot starter's beans.

MaskingContentConverter

class MaskingContentConverter(json: Json, engine: MaskingEngine, registry: Map<String, String>) : ContentConverter

A Ktor ContentConverter that masks responses through the kotlinx backend.

MicrometerMaskingFailureSink

class MicrometerMaskingFailureSink(registry: MeterRegistry) : MaskingFailureSink

A MaskingFailureSink that counts fail-closed drops on a Micrometer MeterRegistry as ihawu.masking.failures, tagged by resource and reason (FailReason) — the same metric the Spring Boot starter emits, for cross-adapter consistency. Records only the resource and reason, never the protected value.

Properties

IhawuKtor

val IhawuKtor: ApplicationPlugin<IhawuKtorConfig>

The Ihawu masking plugin for Ktor. A single install gives @IhawuResource responses per-caller masking with no per-route code:

Functions

ihawuPrincipal

fun ApplicationCall.ihawuPrincipal(): IhawuPrincipal?

The default identity bridge: reads an IhawuPrincipal straight from the call's Authentication result, for apps whose auth provider yields an IhawuPrincipal. Returns null (fail-closed) when the call is unauthenticated. Use as resolvePrincipal = { it.ihawuPrincipal() }.