Add a built-in Redis adapter and integration tests

- Added a built-in Redis adapter for state management, allowing version tracking with hash-based storage and TTL support.
- Updated configuration schema to include Redis-specific fields such as host, port, and database.
- Modified existing state store logic to support passing configuration to adapter methods.
- Added unit and integration tests for Redis adapter functionality and lifecycle behavior.

Author: erayack

.busted

@@ -3,5 +3,20 @@ return {
     verbose = true,
     coverage = false,
     output = "gtest",
+    pattern = "_spec.lua$",
+    ["exclude-pattern"] = "integration",
+  },
+  unit = {
+    verbose = true,
+    coverage = false,
+    output = "gtest",
+    pattern = "_spec.lua$",
+    ["exclude-pattern"] = "integration",
+  },
+  integration = {
+    verbose = true,
+    coverage = false,
+    output = "gtest",
+    pattern = "integration.*_spec.lua$",
   },
 }

.pongo/pongo-setup.sh

@@ -0,0 +1,12 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+cd /kong-plugin || { echo "Failure to enter /kong-plugin"; exit 1; }
+
+while IFS= read -r -d '' rockspec; do
+  luarocks install --only-deps "$rockspec"
+done < <(find /kong-plugin -maxdepth 1 -type f -name '*.rockspec' -print0)
+
+latest_rockspec=$(ls -1 /kong-plugin/kong-plugin-version-gate-*.rockspec | sort -V | tail -1)
+luarocks remove --force kong-plugin-version-gate >/dev/null 2>&1 || true
+luarocks make "$latest_rockspec"

.pongo/pongorc

@@ -1,2 +1,3 @@
 --postgres
 --no-cassandra
+--redis

README.md

@@ -42,6 +42,7 @@ Subject key resolution:
 State store options:
 - shared dict (`state_store_dict_name`, default `version_gate_state`)
 - optional adapter module (`state_store_adapter_module`)
+- built-in Redis adapter module (`kong.plugins.version-gate.state_store_redis`)
 
 ## Config (Common)
 
@@ -78,8 +79,49 @@ config:
   state_store_dict_name: version_gate_state
   state_store_ttl_sec: 30
   # state_store_adapter_module: my.custom.state_store_adapter
+  # state_store_adapter_module: kong.plugins.version-gate.state_store_redis
+  # state_store_redis_host: redis.default.svc.cluster.local
+  # state_store_redis_port: 6379
+  # state_store_redis_password: ""
+  # state_store_redis_database: 0
+  # state_store_redis_timeout_ms: 100
+  # state_store_redis_keepalive_ms: 60000
+  # state_store_redis_pool_size: 100
+  # state_store_redis_prefix: version-gate:state
 ```
 
+## Redis State Store Adapter
+
+Enable Redis-backed state with:
+
+```yaml
+config:
+  state_store_adapter_module: kong.plugins.version-gate.state_store_redis
+  state_store_redis_host: redis.default.svc.cluster.local
+```
+
+Resolution precedence is `plugin config > env var > built-in default`.
+
+Supported environment variables:
+- `KONG_REDIS_HOST`
+- `KONG_REDIS_PORT`
+- `KONG_REDIS_PASSWORD`
+- `KONG_REDIS_DATABASE`
+- `KONG_REDIS_TIMEOUT_MS`
+- `KONG_REDIS_KEEPALIVE_MS`
+- `KONG_REDIS_POOL_SIZE`
+- `KONG_REDIS_PREFIX`
+- `KONG_REDIS_TTL_SEC`
+
+Redis key shape:
+- key: `<state_store_redis_prefix>:<subject_key>`
+- fields: `version`, `ts_ms` (via hash operations)
+- ttl: `state_store_ttl_sec`
+
+Failure behavior:
+- Redis failures are fail-open for availability.
+- If Redis read/write fails, `state_store.lua` falls back to shared dict when configured.
+
 ## Example (Declarative Config)
 
 ```yaml
@@ -111,9 +153,9 @@ services:
 ## Install
 
 1. Install from LuaRocks (recommended):
-   `luarocks install kong-plugin-version-gate 0.1.0-2`
+   `luarocks install kong-plugin-version-gate 0.1.0-3`
 2. Optional (build from local source instead):
-   `luarocks make kong-plugin-version-gate-0.1.0-2.rockspec`
+   `luarocks make kong-plugin-version-gate-0.1.0-3.rockspec`
 3. If using shared-dict state store, define an Nginx shared dict (for example `lua_shared_dict version_gate_state 10m;`).
 4. Enable plugin:
    set `KONG_PLUGINS=bundled,version-gate`
@@ -149,7 +191,7 @@ curl -sS http://localhost:8001/plugins/enabled | grep -i version-gate
 
 ## Registration Readiness Checklist
 
-- Rockspec dependency range and plugin modules are correct (`kong-plugin-version-gate-0.1.0-1.rockspec`).
+- Rockspec dependency range and plugin modules are correct (`kong-plugin-version-gate-0.1.0-3.rockspec`).
 - Plugin name is aligned everywhere: `version-gate` (`schema.name`, config, and `KONG_PLUGINS`).
 - Integration tests pass against pinned Kong:  
   `KONG_VERSION=3.8.0 /Users/erayack/.kong-pongo/pongo.sh run -- -v -o gtest ./spec/version-gate/10-integration_spec.lua`
@@ -211,15 +253,29 @@ curl -i "http://localhost:8000/version-gate-demo/response-headers?x-actual-versi
 
 ## Testing (Pongo)
 
-Pin Kong to a known compatible version (`3.8.0`) when running Pongo:
+Test suite separation:
+
+- Local `busted` (default or `--run unit`) runs unit specs only.
+- Integration specs are separate and require Pongo/Kong runtime.
+
+Unit (local):
+
+```bash
+busted
+# or
+busted --run unit
+```
+
+Integration (Pongo), pinned to known compatible version (`3.8.0`):
 
 ```bash
-KONG_VERSION=3.8.0 pongo up
-KONG_VERSION=3.8.0 pongo run
+PONGO_BIN="${PONGO_BIN:-$HOME/.kong-pongo/pongo.sh}"
+KONG_VERSION=3.8.0 "$PONGO_BIN" run -- --run integration
 ```
 
 Override the pin when needed:
 
 ```bash
-KONG_VERSION=3.9.1 pongo run
+PONGO_BIN="${PONGO_BIN:-$HOME/.kong-pongo/pongo.sh}"
+KONG_VERSION=3.9.1 "$PONGO_BIN" run -- --run integration
 ```

kong-plugin-version-gate-0.1.0-2.rockspec

@@ -31,6 +31,7 @@ build = {
     ["kong.plugins.version-gate.observability"] = "kong/plugins/version-gate/observability.lua",
     ["kong.plugins.version-gate.policy"] = "kong/plugins/version-gate/policy.lua",
     ["kong.plugins.version-gate.state_store"] = "kong/plugins/version-gate/state_store.lua",
+    ["kong.plugins.version-gate.state_store_redis"] = "kong/plugins/version-gate/state_store_redis.lua",
     ["kong.plugins.version-gate.version_extractor"] = "kong/plugins/version-gate/version_extractor.lua",
   },
 }

kong-plugin-version-gate-0.1.0-3.rockspec

@@ -0,0 +1,37 @@
+package = "kong-plugin-version-gate"
+version = "0.1.0-3"
+
+source = {
+  url = "git://github.com/erayack/version-gate-kong",
+  tag = "v0.1.0-3",
+}
+
+description = {
+  summary = "Kong plugin that enforces monotonic version consistency between request and response headers.",
+  detailed = "version-gate compares an expected version header on the request with an actual version header on the upstream response, detects invariant violations, and enforces configurable actions (log, warn, or reject) to guarantee monotonic-read consistency at the API gateway layer.",
+  homepage = "https://github.com/erayack/version-gate-kong",
+  license = "Apache 2.0",
+}
+
+dependencies = {
+  "kong >= 3.4, < 4.0",
+}
+
+build = {
+  type = "builtin",
+  modules = {
+    ["kong.plugins.version-gate.handler"] = "kong/plugins/version-gate/handler.lua",
+    ["kong.plugins.version-gate.schema"] = "kong/plugins/version-gate/schema.lua",
+    ["kong.plugins.version-gate.daos"] = "kong/plugins/version-gate/daos.lua",
+    ["kong.plugins.version-gate.constants"] = "kong/plugins/version-gate/constants.lua",
+    ["kong.plugins.version-gate.ctx"] = "kong/plugins/version-gate/ctx.lua",
+    ["kong.plugins.version-gate.decision_engine"] = "kong/plugins/version-gate/decision_engine.lua",
+    ["kong.plugins.version-gate.enforcement"] = "kong/plugins/version-gate/enforcement.lua",
+    ["kong.plugins.version-gate.invariant"] = "kong/plugins/version-gate/invariant.lua",
+    ["kong.plugins.version-gate.observability"] = "kong/plugins/version-gate/observability.lua",
+    ["kong.plugins.version-gate.policy"] = "kong/plugins/version-gate/policy.lua",
+    ["kong.plugins.version-gate.state_store"] = "kong/plugins/version-gate/state_store.lua",
+    ["kong.plugins.version-gate.state_store_redis"] = "kong/plugins/version-gate/state_store_redis.lua",
+    ["kong.plugins.version-gate.version_extractor"] = "kong/plugins/version-gate/version_extractor.lua",
+  },
+}

kong/plugins/version-gate/schema.lua

@@ -202,6 +202,51 @@ return {
           required = false,
           custom_validator = validate_non_empty_name,
         } },
+        { state_store_redis_host = {
+          type = "string",
+          required = false,
+          custom_validator = validate_non_empty_name,
+        } },
+        { state_store_redis_port = {
+          type = "integer",
+          required = true,
+          default = 6379,
+          between = { 1, 65535 },
+        } },
+        { state_store_redis_password = {
+          type = "string",
+          required = false,
+        } },
+        { state_store_redis_database = {
+          type = "integer",
+          required = true,
+          default = 0,
+          between = { 0, 1024 },
+        } },
+        { state_store_redis_timeout_ms = {
+          type = "integer",
+          required = true,
+          default = 100,
+          between = { 1, 60000 },
+        } },
+        { state_store_redis_keepalive_ms = {
+          type = "integer",
+          required = true,
+          default = 60000,
+          between = { 1, 3600000 },
+        } },
+        { state_store_redis_pool_size = {
+          type = "integer",
+          required = true,
+          default = 100,
+          between = { 1, 10000 },
+        } },
+        { state_store_redis_prefix = {
+          type = "string",
+          required = true,
+          default = "version-gate:state",
+          custom_validator = validate_non_empty_name,
+        } },
         { reject_status_code = {
           type = "integer",
           required = true,

kong/plugins/version-gate/state_store.lua

@@ -54,7 +54,7 @@ local function resolve_adapter(conf)
   return adapter
 end
 
-local function adapter_get(adapter, subject_key)
+local function adapter_get(adapter, subject_key, conf)
   if type(adapter) ~= "table" or type(adapter.get_last_seen) ~= "function" then
     return nil, nil
   end
@@ -71,14 +71,14 @@ local function adapter_get(adapter, subject_key)
     return version, ts_ms
   end
 
-  local ok_with_self, version_with_self, ts_with_self = pcall(adapter.get_last_seen, adapter, subject_key)
+  local ok_with_self, version_with_self, ts_with_self = pcall(adapter.get_last_seen, adapter, subject_key, conf)
   if ok_with_self then
     version_with_self, ts_with_self = normalize(version_with_self, ts_with_self)
   else
     version_with_self, ts_with_self = nil, nil
   end
 
-  local ok_without_self, version_without_self, ts_without_self = pcall(adapter.get_last_seen, subject_key)
+  local ok_without_self, version_without_self, ts_without_self = pcall(adapter.get_last_seen, subject_key, conf)
   if ok_without_self then
     version_without_self, ts_without_self = normalize(version_without_self, ts_without_self)
   else
@@ -104,17 +104,17 @@ local function adapter_get(adapter, subject_key)
   return nil, nil
 end
 
-local function adapter_set(adapter, subject_key, version, ts_ms)
+local function adapter_set(adapter, subject_key, version, ts_ms, conf)
   if type(adapter) ~= "table" or type(adapter.set_last_seen) ~= "function" then
     return false
   end
 
-  local ok, did_set = pcall(adapter.set_last_seen, subject_key, version, ts_ms)
+  local ok, did_set = pcall(adapter.set_last_seen, subject_key, version, ts_ms, conf)
   if ok then
     return did_set == true
   end
 
-  ok, did_set = pcall(adapter.set_last_seen, adapter, subject_key, version, ts_ms)
+  ok, did_set = pcall(adapter.set_last_seen, adapter, subject_key, version, ts_ms, conf)
   if not ok then
     return false
   end
@@ -166,7 +166,7 @@ function _M.get_last_seen(subject_key, conf)
   end
 
   local adapter = resolve_adapter(conf)
-  local version, ts_ms = adapter_get(adapter, subject_key)
+  local version, ts_ms = adapter_get(adapter, subject_key, conf)
   if version ~= nil or ts_ms ~= nil then
     return version, ts_ms
   end
@@ -197,7 +197,7 @@ function _M.set_last_seen(subject_key, version, ts_ms, conf)
   end
 
   local adapter = resolve_adapter(conf)
-  if adapter_set(adapter, subject_key, version, ts_ms) then
+  if adapter_set(adapter, subject_key, version, ts_ms, conf) then
     return true
   end