Clear hook registration API
Why it matters
When hook names are untyped strings with no validation and handler signatures are undocumented, plugin authors must read the host's source code to discover what hooks exist and what arguments their handlers receive. This blocks third-party plugin development, makes the API fragile across upgrades, and guarantees that handler signature mismatches appear only at runtime — not at compile time. ISO 25010 maintainability.modularity depends on well-defined, discoverable interfaces between components; an opaque hook API violates this structurally.
Severity rationale
Critical because an undiscoverable, untyped hook registration API prevents plugin authors from writing correct handlers without reading host internals, collapsing the boundary between plugin and host.
Remediation
Replace any untyped string-based registration with a generic method that uses a typed hook map. Compile-time enforcement of hook names and handler signatures eliminates an entire class of runtime errors for plugin authors.
interface PluginHooks {
'before:request': (ctx: RequestContext) => void | Promise<void>;
'after:response': (ctx: ResponseContext) => void | Promise<void>;
'on:error': (error: PluginError, ctx: ErrorContext) => void;
}
class HookRegistry {
on<K extends keyof PluginHooks>(hook: K, handler: PluginHooks[K]): void;
}
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the Plugin / Extension Architecture Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- iso-25010:2011 · maintainability.modularity — Modularity — discoverable, typed extension points reduce coupling between host and plugin code
Taxons
History
- 2026-04-18·v1.0.0·Initial import from plugin-extension-architecture·automated