ihawu-core

ihawu-core is the engine: a small, serialization-neutral library that decides how each @IhawuResource field is masked, behind a backend-agnostic SPI. It carries no web-framework or serialization dependency of its own — a backend plugs the engine into a real serializer, and every adapter (the Spring Boot starter, the Ktor plugin) is a thin layer on top. Since 0.3.0 it is a Kotlin Multiplatform module (JVM + JS).

implementation("org.ihawu:ihawu-core:0.4.1")

You rarely add core on its own — you add a backend, which pulls core transitively.

What’s in it

• @IhawuResource — marks a type for masking and names the resource key policies resolve against.
• ResourcePolicyResolver — the SPI Ihawu calls to get the field policies for a caller and resource. Bring your own (database, OPA, …), or use the provided RoleBasedResourcePolicyResolver for static role-based rules, optionally wrapped in CachingResourcePolicyResolver.
• FieldPolicy + MaskingStrategy — a resolved decision per field: HIDE (omit a nullable field) or REDACT (a placeholder for a String, JSON null for a nullable non-String).
• MaskingEngine — the serialization-neutral SPI a backend calls per field for the masking decision. The Jackson and kotlinx backends both implement against it, with no core changes.

Choosing a backend

Core decides what to mask; a backend applies it as a type serializes. Add one:

• ihawu-jackson — masking on a Jackson ObjectMapper (register IhawuModule). The JVM path most Spring apps want; the Spring Boot starter wires it for you, and the Core Walkthrough does it by hand.
• ihawu-kotlinx — masking on kotlinx.serialization, multiplatform (JVM + JS). The backend behind the Ktor plugin, and how non-JVM targets mask.

Whichever backend, if no caller (IhawuPrincipal) is attached Ihawu fails closed and serializes an empty object rather than leaking. The masking model — resources, policies, strategies, and the fail-closed / fail-open split — is covered in How Ihawu Works.

Multiplatform

As of 0.3.0 the enforcement point sits behind the serialization-neutral MaskingEngine, so ihawu-core compiles to JVM and JS. Jackson (JVM-only) lives in ihawu-jackson; kotlinx.serialization masking lives in ihawu-kotlinx and runs on every core target — the same engine, proven identical on JVM and JS. Polymorphic @IhawuResource hierarchies — sealed and OPEN (abstract/interface) — mask on the kotlinx backend too, discriminator preserved; OPEN subtypes must be registered on the encoding Json’s SerializersModule.

Reference

Full API on the Dokka reference for ihawu-core.