Skip to content

Feat: Declare plugin pipeline directions and complete ConfigSchema coverage - #847

Open
esnible wants to merge 1 commit into
rossoctl:mainfrom
esnible:plugin-directions-and-configschema
Open

Feat: Declare plugin pipeline directions and complete ConfigSchema coverage#847
esnible wants to merge 1 commit into
rossoctl:mainfrom
esnible:plugin-directions-and-configschema

Conversation

@esnible

@esnible esnible commented Sep 2, 2026

Copy link
Copy Markdown
Member

Makes plugin placement and config field metadata machine-readable, so config generators don't have to infer either from source.

Directions

New PluginCapabilities.Directions field. All 14 in-tree plugins declare their intended chain, published on /v1/plugins and /v1/pipeline as directions, and asserted by a test — so the Direction column in docs/plugin-catalog.md now has a source of truth instead of drifting.

Advisory, never fatal. No plugin enforces direction at runtime (opa, the one that cares, only branches on pctx.Direction), so a misplaced plugin is a probable misconfiguration rather than a guaranteed one, and failing the boot would break configs that work today. A mismatch logs a startup WARN (plugins.WarnPluginDirections, called beside the existing WarnEmptyPipelines) and shows an advisory in abctl. Nil Directions means unconstrained, so out-of-tree plugins are unaffected.

Two naming/typing decisions:

  • The wire field is plural. direction (singular) already means "the chain this configured instance sits in" and is untouched; directions is the type-level set a plugin supports.
  • It's []string, not []Direction, because Direction.UnmarshalJSON decodes any unknown value to Inbound without erroring — fine for a single value, but on a slice that turns a future third direction into a false "inbound" claim.

ConfigSchema

mcp-parser, opa, session-budget and litellm-budget-track were Configurable but not SchemaProvider, so /v1/plugins reported no field metadata and abctl rendered them as bare names. All four now implement it; mcp-parser and opa also gained field annotations, with defaults and required flags taken from their applyDefaults/Configure rather than guessed.

a2a-parser and inference-parser are excluded — they have no config at all, and pipeline/schema.go names them as legitimate omissions. (The original ask said six plugins; four is the real count, and two of those were already annotated.)

Also adds a "number" schema type for floats: litellm-budget-track is the first plugin with float config, so without it max_budget and five per-token rates would publish as "unknown" and render as quoted empty strings in templates.

abctl

Templates carry a # chain: line per plugin, and the pre-apply validator flags a plugin pasted into a chain it doesn't declare. ValidationError gains a Severity so advisories render under their own banner — folding them into the existing one would make its "framework reload will reject" claim false.

Testing

go build, go vet, go test clean across all five modules (cpex type-checked with -tags cpex).

I verified the two highest-risk new tests actually fail when the code is broken. The clone-isolation test initially passed with Directions removed from cloneCatalog — it hit its own t.Skip, which is exactly the silent-drop bug it exists to catch; it now fails and names the culprit.

End-to-end: the WARN fires with plugin, both directions and position, and the pipeline still builds; /v1/plugins reports directions for all 11 default-build plugins and number for the six float fields.

Assisted-By: Claude (Anthropic AI) noreply@anthropic.com

Summary by CodeRabbit

  • New Features

    • Plugin catalogs and pipeline details now show supported inbound and outbound directions.
    • Configuration templates include chain guidance and use 0 for numeric fields.
    • Plugin configuration schemas now expose richer field metadata, including floating-point fields as numbers.
  • Bug Fixes

    • Direction mismatches are identified as advisories rather than blocking valid configuration changes.
    • Startup warnings highlight plugins placed in unsupported pipeline directions.
  • Documentation

    • Updated API, catalog, and configuration guidance to explain direction metadata and advisory behavior.

…verage

Make plugin placement and config metadata machine-readable, so config
generators no longer have to infer either from source or from a
hand-maintained table.

Directions (new PluginCapabilities field):

Every plugin has an intended chain -- jwt-validation is inbound,
token-exchange outbound, opa both -- but that lived only in the Direction
column of docs/plugin-catalog.md. All 14 in-tree plugins now declare it
as Capabilities().Directions, published on /v1/plugins and /v1/pipeline
as `directions`, and asserted by a test so the docs table has a source
of truth.

Advisory, never fatal: no plugin enforces direction at runtime (opa, the
one that cares, merely branches on pctx.Direction), so a misplaced
plugin is a probable misconfiguration rather than a guaranteed one, and
failing the boot would break configs that work today. A mismatch logs a
startup WARN (plugins.WarnPluginDirections, called beside the existing
WarnEmptyPipelines) and shows an advisory in abctl. Nil Directions means
unconstrained, so out-of-tree plugins are unaffected.

The wire field is plural and string-typed on purpose. `direction`
(singular) already means "the chain this configured instance sits in" and
stays untouched; `directions` is the type-level set of chains a plugin
supports. Strings rather than []Direction because Direction.UnmarshalJSON
decodes any unknown value to Inbound without erroring, which on a slice
would turn a future third value into a false "inbound" claim.

ConfigSchema:

mcp-parser, opa, session-budget and litellm-budget-track were
Configurable but not SchemaProvider, so /v1/plugins reported no field
metadata and abctl rendered them as bare names. All four now implement
it; mcp-parser and opa also gained the field annotations (defaults and
required flags taken from their applyDefaults/Configure, not guessed).

a2a-parser and inference-parser are deliberately excluded -- they have no
config at all, and pipeline/schema.go names them as legitimate omissions.

Also adds a "number" schema type for floats. litellm-budget-track is the
first plugin to expose float config; without it max_budget and the five
per-token rates would publish as "unknown" and render as quoted empty
strings in templates.

abctl:

Templates carry a `# chain:` line per plugin, and the pre-apply validator
flags a plugin pasted into a chain it doesn't declare. ValidationError
gains a Severity so advisories render under their own banner -- folding
them into the existing one would make its "framework reload will reject"
claim false.

Assisted-By: Claude (Anthropic AI) <noreply@anthropic.com>
Signed-off-by: Ed Snible <snible@us.ibm.com>
@coderabbitai

coderabbitai Bot commented Sep 2, 2026

Copy link
Copy Markdown

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Team

Run ID: 5638fc0c-1859-4101-992f-0c6401e916a9

📥 Commits

Reviewing files that changed from the base of the PR and between 4ce9576 and ce9aff2.

📒 Files selected for processing (39)
  • authbridge/CLAUDE.md
  • authbridge/authlib/pipeline/directions_test.go
  • authbridge/authlib/pipeline/plugin.go
  • authbridge/authlib/pipeline/schema.go
  • authbridge/authlib/pipeline/schema_test.go
  • authbridge/authlib/plugins/a2aparser/plugin.go
  • authbridge/authlib/plugins/configschema_test.go
  • authbridge/authlib/plugins/contextguru/plugin.go
  • authbridge/authlib/plugins/cpex/plugin.go
  • authbridge/authlib/plugins/directions_test.go
  • authbridge/authlib/plugins/ibac/plugin.go
  • authbridge/authlib/plugins/inferenceparser/plugin.go
  • authbridge/authlib/plugins/jwtvalidation/plugin.go
  • authbridge/authlib/plugins/litellm_budgettrack/plugin.go
  • authbridge/authlib/plugins/mcpparser/plugin.go
  • authbridge/authlib/plugins/opa/plugin.go
  • authbridge/authlib/plugins/registry.go
  • authbridge/authlib/plugins/sessionbudget/plugin.go
  • authbridge/authlib/plugins/sparc/plugin.go
  • authbridge/authlib/plugins/staticinject/plugin.go
  • authbridge/authlib/plugins/tokenbroker/plugin.go
  • authbridge/authlib/plugins/tokenexchange/plugin.go
  • authbridge/authlib/plugins/warn.go
  • authbridge/authlib/sessionapi/catalog_adapter.go
  • authbridge/authlib/sessionapi/server.go
  • authbridge/cmd/abctl/README.md
  • authbridge/cmd/abctl/apiclient/client.go
  • authbridge/cmd/abctl/apiclient/client_test.go
  • authbridge/cmd/abctl/edit/templates.go
  • authbridge/cmd/abctl/edit/templates_test.go
  • authbridge/cmd/abctl/edit/validate.go
  • authbridge/cmd/abctl/edit/validate_test.go
  • authbridge/cmd/abctl/tui/catalog_pane.go
  • authbridge/cmd/abctl/tui/edit_overlay.go
  • authbridge/cmd/authbridge-cpex/main.go
  • authbridge/cmd/authbridge-envoy/main.go
  • authbridge/cmd/authbridge-proxy/catalog_test.go
  • authbridge/cmd/authbridge-proxy/main.go
  • authbridge/docs/plugin-catalog.md

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.


📝 Walkthrough

Walkthrough

Plugins now declare supported pipeline directions and configuration schemas. Session APIs and abctl expose this metadata. Runtime builds log placement warnings, while abctl reports direction mismatches as advisories.

Changes

Pipeline capability and schema contracts

Layer / File(s) Summary
Capability contracts and plugin declarations
authbridge/authlib/pipeline/*, authbridge/authlib/plugins/*
Plugin capabilities normalize and evaluate directions. Floating-point schema fields use number. Registered plugins declare directions, and configurable plugins expose schemas.
Catalog and pipeline metadata wiring
authbridge/authlib/plugins/registry.go, authbridge/authlib/sessionapi/*, authbridge/cmd/abctl/apiclient/*, authbridge/cmd/abctl/tui/catalog_pane.go
Catalog cloning preserves direction isolation. APIs and clients exchange optional directions metadata.
Runtime direction warnings
authbridge/authlib/plugins/warn.go, authbridge/cmd/authbridge-*/main.go, authbridge/cmd/authbridge-proxy/*
Pipeline builds warn when a configured plugin does not declare support for its chain. The warning is advisory and does not block building.
abctl templates and validation advisories
authbridge/cmd/abctl/edit/*, authbridge/cmd/abctl/tui/edit_overlay.go, authbridge/cmd/abctl/README.md, authbridge/docs/plugin-catalog.md, authbridge/CLAUDE.md
Templates show declared chains and numeric placeholders. Validation separates errors from direction warnings, and the TUI renders separate banners and prompts.

Estimated code review effort: 4 (Complex) | ~45 minutes

Merge Risk: ⚪ Minimal · up to ce9af

The PR adds machine-readable plugin directions and configuration schemas while preserving existing execution behavior; no actionable merge-blocking risk remains beyond normal checks and review.

Suggested reviewers: ibrahim2595, huang195

Sequence Diagram(s)

sequenceDiagram
  participant abctl
  participant SessionAPI
  participant PluginCatalog
  participant PipelineValidator
  participant PipelineBuild
  abctl->>SessionAPI: request plugin and pipeline metadata
  SessionAPI->>PluginCatalog: read normalized directions and schemas
  SessionAPI-->>abctl: return directions and field schemas
  abctl->>PipelineValidator: validate configured chain
  PipelineValidator-->>abctl: return errors and direction advisories
  PipelineBuild->>PluginCatalog: read plugin capabilities
  PipelineBuild-->>PipelineBuild: log mismatches without blocking build
Loading
🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly summarizes the two primary changes: declaring plugin pipeline directions and completing ConfigSchema coverage.
Docstring Coverage ✅ Passed Docstring coverage is 81.13% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 53 functions across 36 files. (3 skipped: 3…
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Full details: Docstring Coverage

Explanation

Docstring coverage is 81.13% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 53 functions across 36 files. (3 skipped: 3 unsupported.)

✨ Finishing Touches 💡 1
⚔️ Resolve merge conflicts 💡
  • Resolve merge conflict in branch plugin-directions-and-configschema
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Warning

Some tools did not complete. Review the errors below.

🔧 golangci-lint (2.13.2)

level=error msg="[linters_context] typechecking error: build constraints exclude all Go files in /authbridge/cmd/authbridge-cpex"


Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

Status: New/ToDo

Development

Successfully merging this pull request may close these issues.

2 participants