Feat nxe phase

.gitmodules

@@ -1,3 +1,6 @@
 [submodule "nxe-json"]
 	path = nxe-json
 	url = https://github.com/kjdev/nxe-json.git
+[submodule "nxe-phase"]
+	path = nxe-phase
+	url = https://github.com/kjdev/nxe-phase.git

CHANGELOG.md

@@ -3,6 +3,16 @@
 The format is based on [Keep a Changelog](https://keepachangelog.com/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [Unreleased]
+
+### Changed
+
+- The module now registers its PRECONTENT-phase handler at a fixed priority via the new `nxe-phase` submodule instead of relying on module load order, so its position relative to other dynamic modules sharing the same phase (`auth_gate`, `auth_cedar`, `internal_redirect`, ...) no longer depends on `load_module` ordering in `nginx.conf`
+
+### Dependencies
+
+- Add the `nxe-phase` submodule (shared phase-handler-ordering helper)
+
 ## [0.2.1] - 2026-06-04
 
 ### Dependencies

Dockerfile

@@ -31,6 +31,7 @@ EOS
 COPY config /build/
 COPY src/ /build/src/
 COPY nxe-json/ /build/nxe-json/
+COPY nxe-phase/ /build/nxe-phase/
 
 WORKDIR /build/nginx
 RUN sh -ex <<'EOS'

config

@@ -1,23 +1,39 @@
 ngx_addon_name=ngx_http_auth_rbac_module
 
+# --- submodule: nxe-phase ---
+nxe_phase_dir="$ngx_addon_dir/nxe-phase"
+nxe_phase_tag="auth_rbac"
+
+if [ ! -f "$nxe_phase_dir/config.ngx" ]; then
+    echo "$0: error: $nxe_phase_dir/config.ngx not found" >&2
+    exit 1
+fi
+
+. "$nxe_phase_dir/config.ngx"
+
 ngx_module_type=HTTP
-ngx_module_name="ngx_http_auth_rbac_module"
+ngx_module_name="ngx_http_auth_rbac_module $nxe_phase_module_name"
 ngx_module_deps="\
+  $nxe_phase_module_deps \
   $ngx_addon_dir/src/ngx_http_auth_rbac_module.h \
   $ngx_addon_dir/src/ngx_rbac_policy.h \
   $ngx_addon_dir/src/ngx_rbac_matcher.h \
   $ngx_addon_dir/src/ngx_rbac_role.h \
   $ngx_addon_dir/src/ngx_rbac_variable.h \
 "
-ngx_module_incs="$ngx_addon_dir/src"
+ngx_module_incs="\
+  $nxe_phase_module_incs \
+  $ngx_addon_dir/src \
+"
 ngx_module_srcs="\
+  $nxe_phase_module_srcs \
   $ngx_addon_dir/src/ngx_http_auth_rbac_module.c \
   $ngx_addon_dir/src/ngx_rbac_policy.c \
   $ngx_addon_dir/src/ngx_rbac_matcher.c \
   $ngx_addon_dir/src/ngx_rbac_role.c \
   $ngx_addon_dir/src/ngx_rbac_variable.c \
 "
-ngx_module_libs=""
+ngx_module_libs="$nxe_phase_module_libs"
 
 # JSON role parsing via nxe-json (requires jansson).
 # Controlled by NGX_RBAC_JSON:

src/ngx_http_auth_rbac_module.c

@@ -5,6 +5,8 @@
  * nginx RBAC (Role-Based Access Control) module
  */
 
+#include "nxe_phase.h"
+
 #include "ngx_http_auth_rbac_module.h"
 #include "ngx_rbac_policy.h"
 #include "ngx_rbac_matcher.h"
@@ -226,19 +228,16 @@ ngx_http_auth_rbac_merge_loc_conf(ngx_conf_t *cf, void *parent, void *child)
 static ngx_int_t
 ngx_http_auth_rbac_init(ngx_conf_t *cf)
 {
-    ngx_http_handler_pt *h;
-    ngx_http_core_main_conf_t *cmcf;
     ngx_http_variable_t *var, *v;
 
-    cmcf = ngx_http_conf_get_module_main_conf(cf, ngx_http_core_module);
-
-    h = ngx_array_push(&cmcf->phases[NGX_HTTP_PRECONTENT_PHASE].handlers);
-    if (h == NULL) {
+    if (nxe_phase_add_handler(cf, NGX_HTTP_PRECONTENT_PHASE,
+                              NXE_PHASE_PRIO_RBAC, ngx_http_auth_rbac_handler,
+                              "auth_rbac")
+        != NGX_OK)
+    {
         return NGX_ERROR;
     }
 
-    *h = ngx_http_auth_rbac_handler;
-
     /* Register variables */
     for (v = ngx_http_auth_rbac_vars; v->name.len; v++) {
         var = ngx_http_add_variable(cf, &v->name, v->flags);