Built-in Functions for Groovy, JavaScript and SpEL

Membrane API Gateway offers the same built-in functions in Groovy, JavaScript and SpEL expressions. Only the way to call them differs:

Language	Call
Groovy (`groovy`, `template`)	`user()` or `fn.user()`
JavaScript (`javascript`)	`fn.user()`
SpEL (`${...}` in `setHeader`, `if`, `log`, ...)	`${user()}`

- groovy:
    src: |
      header.put('X-User', user())
      CONTINUE
- javascript:
    src: |
      header.put('X-User', fn.user());
      'undefined'
- setHeader:
    name: X-User
    value: ${user()}
    language: spel

- groovy:
    src: |
      header.put('X-User', user())
      CONTINUE
- javascript:
    src: |
      header.put('X-User', fn.user());
      'undefined'
- setHeader:
    name: X-User
    value: ${user()}
    language: spel

The variables like header, json and property are listed in Built-in Variables for Groovy, JavaScript and SpEL.

Message Content

Function	Returns	Description
`isJSON()`	`boolean`	`true` if the current message has a JSON content type
`isXML()`	`boolean`	`true` if the current message has an XML content type
`jsonPath('$.items[0].price')`	`Object`	Evaluates a JSONPath expression on the body of the message
`xpath('//id')`	`Object`	Evaluates an XPath expression on the body of the message
`xpath('id', node)`	`Object`	Evaluates an XPath expression relative to `node`
`toJSON(object)`	`String`	Serializes a value, map or list to JSON

- if:
    test: isJSON() and jsonPath('$.total') > 100
    flow:
      - setHeader:
          name: X-Priority
          value: high

- if:
    test: isJSON() and jsonPath('$.total') > 100
    flow:
      - setHeader:
          name: X-Priority
          value: high

Security

These functions read the result of an authentication plugin earlier in the flow, e.g. basicAuthentication, apiKey, jwtAuth or oauth2Resource.

Function	Returns	Description
`user()`	`String`	Name of the user authenticated by `basicAuthentication`
`scopes()`	`List<String>`	Scopes of the authenticated client
`scopes('apiKey')`	`List<String>`	Scopes from one security scheme: `apiKey`, `jwt`, `oauth2`, `http`
`hasScope('read')`	`boolean`	`true` if the client has the scope
`hasScope(['read','write'])`	`boolean`	`true` if the client has all of the scopes
`hasScope()`	`boolean`	`true` if the client has any scope
`isBearerAuthorization()`	`boolean`	`true` if the request has an `Authorization: Bearer ...` header
`isLoggedIn('login')`	`boolean`	`true` if the session of the `login` plugin with that id is valid
`getDefaultSessionLifetime('login')`	`long`	Session lifetime of the `login` plugin with that id

- if:
    test: not hasScope('admin')
    flow:
      - return:
          status: 403

- if:
    test: not hasScope('admin')
    flow:
      - return:
          status: 403

Encoding

Function	Returns	Example result	Use for
`urlEncode('a b&c')`	`String`	`a+b%26c`	Query parameter values
`pathEncode('a b/c')`	`String`	`a%20b%2Fc`	A single path segment
`base64Encode('alice:secret')`	`String`	`YWxpY2U6c2VjcmV0`	e.g. a Basic `Authorization` header

- setHeader:
    name: Authorization
    value: Basic ${base64Encode('alice:secret')}

- setHeader:
    name: Authorization
    value: Basic ${base64Encode('alice:secret')}

Other

Function	Returns	Description
`env('HOME')`	`String`	Value of an environment variable, `null` if it is not set
`weight(25.0)`	`boolean`	`true` in about 25 % of the calls, e.g. to split traffic

- if:
    test: weight(10.0)
    flow:
      - setHeader:
          name: X-Canary
          value: "true"

- if:
    test: weight(10.0)
    flow:
      - setHeader:
          name: X-Canary
          value: "true"