ihawu-spring-boot-starter/org.ihawu.spring.boot.starter.configuration/IhawuProperties

IhawuProperties

@ConfigurationProperties(prefix = "ihawu")

class IhawuProperties

Typed configuration for the Ihawu starter, bound from ihawu.*.

Constructors

IhawuProperties

constructor()

Types

FieldPolicyProperties

data class FieldPolicyProperties(val field: String, val strategy: MaskingStrategy = MaskingStrategy.HIDE, val placeholder: String? = null)

The config representation of a single field's masking rule, bound from ihawu.policies[].roles.<role>[] and mapped to a core org.ihawu.core.policy.FieldPolicy by the default provider.

PolicyProperties

data class PolicyProperties(val resource: String, val roles: Map<String, List<IhawuProperties.FieldPolicyProperties>> = emptyMap())

The config representation of one resource's masking rules, bound from ihawu.policies[] and mapped to a core ResourcePolicy by the default provider.

Properties

enabled

var enabled: Boolean

Master switch for the Ihawu integration - when false the auto-config backs off.

onPolicyFailure

var onPolicyFailure: ResolverErrorMode

How a policy-resolver failure (a policy-store outage or misconfiguration) is handled, bound from ihawu.on-policy-failure (mask-all / fail-request). Defaults to ResolverErrorMode.MASK_ALL — mask the whole resource fail-closed and return 200. ResolverErrorMode.FAIL_REQUEST instead lets the error surface (a 5xx), so an outage is not silent — see ADR 0011 for the committed-response caveat. Only the resolver-error path is affected; a missing principal always masks fail-closed.

policies

var policies: List<IhawuProperties.PolicyProperties>

The static masking rules, bound from ihawu.policies[] and mapped to core org.ihawu.core.policy.ResourcePolicy rules by the default provider. Defaults to empty — no rules, so nothing is masked — until the application supplies them here or replaces the provider with its own bean (see ADR 0004).

resourceBasePackages

var resourceBasePackages: List<String>

Packages to scan for org.ihawu.core.annotation.IhawuResource types during startup contract validation. Defaults to empty — the application's auto-configuration base packages are used. Set this when resources live outside those packages.

validateResourceContract

var validateResourceContract: Boolean

Whether to check, at startup, that every configured masking policy can satisfy its resource's declared type contract — failing the application context (see ADR 0005) on a policy that would emit schema-invalid output (e.g. REDACT on a non-nullable Int, HIDE on a non-nullable field). Defaults to true; set false to defer such a policy to the runtime fail-closed backstop.