plugin with side effects vs module

[Rob Wagner]

Hey all - looking for some advice.  I need to write either a plugin or a module to interact with Thycotic Secret Server.  In most cases, my code will simply retrieve a credential from Thycotic, so a lookup plugin makes perfect sense.  However, there are cases where a specific credential doesn't yet exist in Thycotic, so my code will tell Thycotic to generate a credential, store it in Thycotic, and then return it.  The rub here is then we have a side effect; if a credential doesn't exist, it gets created, stored, and returned.  Generally speaking, I tend to view lookup plugins as being read only, so the idea that a lookup plugin would WRITE data is counterintuitive (to me).  However, I see the passwordstore plugin also has side effects, so perhaps this isn't so bad.  But I could also write a module (delegated to the control machine) to accomplish the functionality I need, and modules certainly can have side effects.  Any opinions from the Core community on which way I should lean?  Are lookup plugin side effects really that bad, or am I overreacting?

Appreciate your thoughts.  Thanks.

Rob

[Brian Coca]

Personally i would use a module if there is the possibility of a side
effect, it is 'surprising' to a user to get one in a lookup.

-
----------
Brian Coca

[Rob Wagner]

Any thoughts on this?  I've been mulling it over and (not to dump on passwordstore) it really seems like a lookup plugin shouldn't have side effects.

Rob