Struct FilterPolicy 

pub struct FilterPolicy { /* private fields */ }

The configured checks, the rules over them, and how the middleware turns a peer address into a client address.

Cheap to clone behind the Arc it is always held in.

Implementations

impl FilterPolicy

pub fn new( checks: Vec<(String, Arc<dyn Check>)>, rules: Vec<Rule>, default_effect: Effect, proxy: ProxyPolicy, ) -> Self

Assembles a policy, deriving each rule’s stages from its checks.

The stage intersection is computed here rather than passed in, so the one place that knows the rule is what fills it in. A rule naming a check that does not exist gets StageSet::none and therefore never runs — the builder refuses that configuration at startup, and this is only the net under it.

pub fn proxy(&self) -> &ProxyPolicy

How the middleware turns a peer address plus headers into a client IP.

pub fn default_effect(&self) -> Effect

What happens when a rule was applicable at a stage and none matched.

pub fn has_rules_at(&self, stage: Stage) -> bool

Whether any rule is evaluated at stage.

post_finalize asks about Stage::Identifiers to skip re-parsing the CSR when nothing would look at the result.

pub fn is_active(&self) -> bool

Whether the policy would decide anything at all.

pub fn checks(&self) -> Vec<CheckSummary<'_>>

Every configured check, for acme-proxy filter show and for working out which checks an evaluation short-circuited past.

pub fn rules(&self) -> Vec<RuleSummary<'_>>

Every rule, in evaluation order.

pub fn needs_eab(&self) -> bool

Whether any check asks about the requesting account’s EAB credential.

The handlers gate the two database reads that resolve one on this, so a policy with no eab check pays nothing for the field’s existence.

pub async fn evaluate_connection( &self, context: &ConnectionContext<'_>, ) -> Evaluation

Evaluates the connection stage, keeping the whole trace.

The trace is what acme-proxy filter explain renders; a request path wants FilterPolicy::check_connection, which logs the decision.

pub async fn evaluate_identifiers( &self, context: &IdentifierContext<'_>, ) -> Evaluation

Evaluates the identifier stage, keeping the whole trace.

pub async fn check_connection(&self, context: &ConnectionContext<'_>) -> Outcome

The connection stage’s answer, with the decision logged.

pub async fn check_identifiers( &self, context: &IdentifierContext<'_>, ) -> Outcome

The identifier stage’s answer, with the decision logged.

The hook is logged as newOrder or CSR rather than identifiers, because which of the two refused is the first thing an operator reading the line wants to know.

Trait Implementations

impl Debug for FilterPolicy

fn fmt(&self, formatter: &mut Formatter<'_>) -> Result

dyn Check is not Debug, so show the names and conditions — which is the only part worth reading anyway.

impl Default for FilterPolicy

fn default() -> Self

No checks and no rules: every stage has an empty applicable set, so everything is allowed. This is what a server with no [filter] section and every test that does not care about filtering uses.