ave_bridge/http/
mod.rs

1use std::path::PathBuf;
2
3use serde::{Deserialize, Serialize};
4
5#[derive(Debug, Clone, Deserialize, Serialize)]
6#[serde(default)]
7pub struct HttpConfig {
8    pub http_address: String,
9    pub https_address: Option<String>,
10    pub https_cert_path: Option<PathBuf>,
11    pub https_private_key_path: Option<PathBuf>,
12    pub enable_doc: bool,
13    pub proxy: ProxyConfig,
14    pub cors: CorsConfig,
15    /// Self-signed certificate configuration for automatic TLS
16    pub self_signed_cert: SelfSignedCertConfig,
17}
18
19#[derive(Debug, Clone, Deserialize, Serialize)]
20#[serde(default)]
21pub struct ProxyConfig {
22    /// Trusted proxy CIDRs or IPs allowed to provide forwarded client IP headers.
23    pub trusted_proxies: Vec<String>,
24    /// Trust X-Forwarded-For when the direct peer is a trusted proxy.
25    pub trust_x_forwarded_for: bool,
26    /// Trust X-Real-IP when the direct peer is a trusted proxy.
27    pub trust_x_real_ip: bool,
28}
29
30#[derive(Debug, Clone, Deserialize, Serialize)]
31#[serde(default)]
32pub struct SelfSignedCertConfig {
33    /// Enable automatic self-signed certificate generation.
34    /// When enabled, uses https_cert_path and https_private_key_path for output.
35    pub enabled: bool,
36    /// Common Name for the certificate (e.g., "localhost", "ave.local")
37    pub common_name: String,
38    /// Subject Alternative Names (additional hostnames/IPs)
39    pub san: Vec<String>,
40    /// Certificate validity in days
41    pub validity_days: u32,
42    /// Days before expiration to trigger renewal
43    pub renew_before_days: u32,
44    /// Check interval in seconds for certificate expiration
45    pub check_interval_secs: u64,
46}
47
48impl Default for SelfSignedCertConfig {
49    fn default() -> Self {
50        Self {
51            enabled: false,
52            common_name: "localhost".to_string(),
53            san: vec!["127.0.0.1".to_string(), "::1".to_string()],
54            validity_days: 365,
55            renew_before_days: 30,
56            check_interval_secs: 3600, // Check every hour
57        }
58    }
59}
60
61#[derive(Debug, Clone, Deserialize, Serialize)]
62#[serde(default)]
63pub struct CorsConfig {
64    /// Enable CORS middleware
65    pub enabled: bool,
66    /// Allow all origins (*). If false, use `allowed_origins` list
67    /// SECURITY WARNING: Setting this to true (default) allows ANY website to make requests
68    /// This is a CVSS 6.5 vulnerability if you plan to access the API from browsers
69    /// For production with web frontend, set to false and specify `allowed_origins`
70    pub allow_any_origin: bool,
71    /// List of allowed origins (only used if `allow_any_origin` is false)
72    /// Example: ["https://app.example.com", "https://dashboard.example.com"]
73    pub allowed_origins: Vec<String>,
74    /// Allow credentials (cookies, authorization headers) in CORS requests
75    /// SECURITY: Should be false if `allow_any_origin` is true
76    pub allow_credentials: bool,
77}
78
79impl Default for HttpConfig {
80    fn default() -> Self {
81        Self {
82            http_address: "0.0.0.0:3000".to_string(),
83            https_address: Default::default(),
84            https_cert_path: Default::default(),
85            https_private_key_path: Default::default(),
86            enable_doc: Default::default(),
87            proxy: ProxyConfig::default(),
88            cors: CorsConfig::default(),
89            self_signed_cert: SelfSignedCertConfig::default(),
90        }
91    }
92}
93
94impl Default for ProxyConfig {
95    fn default() -> Self {
96        Self {
97            trusted_proxies: Vec::new(),
98            trust_x_forwarded_for: true,
99            trust_x_real_ip: true,
100        }
101    }
102}
103
104impl Default for CorsConfig {
105    fn default() -> Self {
106        Self {
107            enabled: true,
108            allow_any_origin: true,
109            allowed_origins: vec![],
110            allow_credentials: false,
111        }
112    }
113}
ave_bridge/http/mod.rs

ave_bridge/http/
mod.rs
