Pre-authentication. I added a comment to the README.md noting that. Someone could want an unauthenticated extension, doing auth here would prohibit that. Likewise, they could want to check a "role" but not "capability," or a "capability" but not "api_capability". There's no good way to do that in the plugin system, without significantly limiting its flexibility.
[ Full content available at: https://github.com/apache/trafficcontrol/pull/2513 ] This message was relayed via gitbox.apache.org for [email protected]
