Plugins

Mon, 01 Jan 0001 00:00:00 +0000

Gate One extensions are out-of-process services. The gateway talks to them over HTTP/JSON; it never loads a third-party authentication provider and never calls a plugin on the authentication path.

Plugin families

Family Runs in Transport Decides auth? Licence

Family	Runs in	Transport	Decides auth?	Licence
Auth adapter	IAM	HTTP/JSON	yes, in the IAM	Gate One licence
Injection / userscript / UI	Gate One	route `inject` bundle (config)	no	extension licence
Event consumer	Gate One	HTTP/JSON, signed manifest	no	extension licence

Auth adapter

IAM

HTTP/JSON

yes, in the IAM

Gate One licence

Injection / userscript / UI

Gate One

route inject bundle (config)

extension licence

Event consumer

Gate One

HTTP/JSON, signed manifest

extension licence

The injection bundle and the event consumer are extensions; auth adapters stay in the IAM and remain under the Gate One licence.

A Backend-For-Frontend is not a plugin: it is a proxied backend: route, post-auth by definition (it receives the identity DTO / X-Gate-One-Subject), and can be written in any language. Gate One never loads it. Response transforms are the gateway’s native injector chain (inject, rewriteBody, responseHeaders, rewriteRedirects, the guard); bespoke logic belongs in the backend or the edge proxy, not in a plugin.

Publish and trust a plugin

Mon, 01 Jan 0001 00:00:00 +0000

Gate One extensions are out-of-process services. They are trusted through a signed manifest and a local trust store; code is never loaded into the gateway. This page is the publisher/operator walkthrough: develop, sign, install and revoke.

Plugin families

Extension families and what is not a plugin are defined once in Plugins. For publishers, the only fully signed extension today is the event consumer; injection bundles are route configuration and auth adapters stay in the IAM under the Gate One licence.

Extending Gate One on Gate One

Plugins

Plugin families

Publish and trust a plugin

Plugin families