Struct IdentityHook 

pub struct IdentityHook;

Identity-resolve hook.

Payload (IdentityPayload) — unified input + accumulator. The host populates the input fields (raw_token, source, headers, …) once at request entry and never touches them again; handlers populate the output fields (subject, client, caller_workload, delegation, raw_credentials, rejected, …) on clones of the running payload. Input fields are private and read through accessors — handlers cannot mutate them even on a clone, so the wire-layer input is canonical across the whole chain.

Result (PluginResult<IdentityPayload>) — the executor’s standard envelope. modified_payload carries the updated payload. continue_processing = false halts the pipeline (set when the handler decides to reject).

Threading. Sequential-phase semantics already thread handler N’s modified_payload into handler N+1’s input, so the chain’s natural behavior is “each handler sees the prior handler’s contributions in the running payload.” No bespoke resolve_identity method on PluginManager — the standard invoke_named::<IdentityHook>(...) does the right thing.

Handler signature:

impl HookHandler<IdentityHook> for MyResolver {
    async fn handle(
        &self,
        payload: &IdentityPayload,
        _extensions: &Extensions,
        _ctx: &mut PluginContext,
    ) -> PluginResult<IdentityPayload> {
        // Validate the raw token, build the SubjectExtension.
        let claims = self.validate(payload.raw_token()).await?;
        let mut updated = payload.clone();
        updated.subject = Some(claims.into_subject());
        PluginResult::modify_payload(updated)
    }
}

Handlers that want to layer onto prior state without manually preserving every untouched field reach for IdentityPayload::merge.

Registration: manager.register_handler::<IdentityHook, _>(plugin, config) against the hook name "identity.resolve". Multiple handlers may register; the framework runs them in priority order and the Sequential-phase chain accumulates their contributions into the running payload.

Trait Implementations

impl HookTypeDef for IdentityHook

const NAME: &'static str = "identity.resolve"

Hook name — used as the registry key and in config YAML.

type Payload = IdentityPayload

The typed payload that handlers receive. Must implement PluginPayload (Clone + Send + Sync + ’static).

type Result = PluginResult<IdentityPayload>

The typed result that handlers return.