Struct PushSender 

pub struct PushSender { /* private fields */ }

Delivers notifications, under the controls in the module docs.

Implementations

impl PushSender

pub const DEFAULT_TIMEOUT: Duration

The spec recommends 10–30 seconds; a webhook that needs longer is doing work it should not be doing on our thread.

pub fn new(policy: PushPolicy) -> Self

pub fn for_operator_destinations(destinations: &[Destination]) -> Self

A sender for destinations the deployment configured.

Takes no PushPolicy, because a host allowlist answers may this caller name this host? and there is no caller: the URL comes from the deployment’s own configuration, written by whoever would have written the allowlist. HTTPS and the public-address check are lifted for the same reason — an in-cluster collector on plaintext HTTP at a private address is the ordinary shape here, and it is the only shape the inward-facing case has.

This is not an off switch for push. It cannot deliver to a caller-registered webhook at all: Outbox owns the rows this serves, the A2A worker owns the others, and the two id namespaces do not overlap.

Why it takes the destinations

For the signing keys of whichever of them called Destination::signed_with, which live here and not in the stored registration: a caller’s bearer token has to be persisted because the request that carried it is over, while an operator’s signing key is this deployment’s own configuration, read at every start — persisting it would put a forge-anything key in a row per run per destination and freeze rotation at admission. Taking them as an argument rather than offering a .signing(..) setter is the difference between a control you can forget and one you cannot: a destination configured to be signed whose sender was built without it would deliver unsigned, and nothing downstream could notice, because a receiver’s own refusal is the only place a missing signature shows up. Pass Outbox::destinations, which is the list that was actually registered.

pub const fn allow_plaintext_loopback(self) -> Self

Permit http:// to a webhook on this machine. testkit only.

The A2A conformance kit’s webhook receiver is an http://localhost:PORT server, because a kit cannot mint a public TLS endpoint for a run on a laptop. Both of this crate’s address controls refuse that, correctly — and the consequence was that the kit’s ten push MUSTs could not run at all, so the one surface where an untrusted party names an address this plane connects to had no outside-authority evidence behind it. Ten unrunnable rows is a worse answer than one named exception.

What this does not lift is the part that is the actual control: the operator’s host grant still has to name the host, the task-level authorization still runs, the cursor still advances only on 2xx, and every non-loopback destination is judged exactly as before — a plaintext URL to a public host stays refused with the flag set, which is the half that keeps this from being an off switch.

It cannot exist in a production build: the field is cfg(testkit), and testkit is documented as never belonging in one.

pub const fn timeout(self, d: Duration) -> Self

pub const fn policy(&self) -> &PushPolicy

The grant this sender enforces, so a registration can be checked against the same policy that will later be checked at delivery.

Trait Implementations

impl Clone for PushSender

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for PushSender

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl PushTransport for PushSender

fn validate(&self, config: &PushConfig) -> Result<(), PushError>

fn deliver<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, config: &'life1 PushConfig, message: &'life2 PushMessage, at: u64, ) -> Pin<Box<dyn Future<Output = Result<Delivered, PushError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait,

POST one message.