Plugin HTTP Routes and Authorization
Enterprise 3.3.0+. Only mappings expose routes. globalName never implicitly creates /Mapping/name, and native functions never create HTTP endpoints. Configured routes join the existing server execution handler, authentication/license middleware and verbose evaluation contract.
| Request | Behavior |
|---|---|
POST /root or /root/part/other | Execute a root mapping or ordinary mapping alias. |
PUT /root/part/other | Execute with a nonempty subroute. |
GET /root, PUT /root, DELETE /root | No execution or automatic source endpoint; 404. |
POST /Mapping/name or /Mapping/name/part | Execute the explicitly exposed mapping. |
PUT /Mapping/name/part | Execute with a nonempty subroute. |
GET /Mapping/name | Retrieve explicit read-only FUME source, under existing auth/license guards. |
PUT or DELETE /Mapping/name | 405; no mutation or provider fall-through. |
GET /Mapping/name/part | No execution; 404. |
An ordinary root alias resolves the current user mapping, retaining normal user scope; a plugin root uses its registered scope. Aliases do not copy source or create a callable alias function. Startup validates target existence; a subsequently deleted target returns 404.
Requests and invocation data
With the example deployment, these execute the same ordinary mapping and preserve subroute metadata:
'{"name":"Ada"}' | curl.exe http://localhost:42420/customer-transform -H 'Content-Type: application/json' --data-binary '@-'
'{"name":"Ada"}' | curl.exe -X PUT http://localhost:42420/customer-transform/review/urgent -H 'Content-Type: application/json' --data-binary '@-'
Both return {"customer":"Ada"}. A mapping can read sanitized $fumeHttpInvocation data: mappingId, uppercase method, subroute string segments, their joined subpath, query values and an allowlisted headers object. No Express request/response, authorization header, cookie, socket or service handle is passed into evaluator or worker bindings. Protected invocation metadata cannot be replaced by call bindings. Input is the request body, not a generated HTTP envelope. Use ?verbose=true for the existing evaluation report.
Actual-path authorization
Authorization evaluates the incoming public method/path, not the target's private mapping ID. An alias does not inherit /Mapping/target permissions. Add permissions for each exposed root and each permitted method. The existing policy model has no wildcard-path rule support: list every concrete subroute needed by clients, or keep a fixed endpoint and put operation selectors in the body. A policy for /customer-transform does not automatically authorize /customer-transform/review/urgent.
Existing licensing protects configured execution and explicit source retrieval. Authentication-disabled deployments do not gain a separate plugin auth layer; authentication-enabled deployments do not gain a bypass. Read-only artifacts are not a substitute for request authorization.
The running server's /api-docs/swagger.json adds configured root/Mapping paths and POST/PUT subroute operations with generic schemas. It does not infer an application schema from FUME source or function signatures. The Enterprise OpenAPI guide remains the contract entry point; deployment-specific clients should inspect their own running instance.