Crate chio_envoy_ext_authz 

Chio adapter for Envoy’s ext_authz gRPC filter.

This crate implements envoy.service.auth.v3.Authorization/Check as a thin shim that translates each Envoy CheckRequest into an Chio translate::ToolCallRequest, hands it to an EnvoyKernel implementation, and maps the returned translate::Verdict onto a compliant CheckResponse.

The crate deliberately keeps its dependency surface small so the adapter can be linked into any Envoy-fronted service without pulling in the rest of the Chio substrate. The EnvoyKernel trait exists precisely so real deployments can plug chio-kernel (or chio-http-core’s HttpAuthority) into this service without this crate depending on them. A doc example is sketched below.

Example wiring

use chio_envoy_ext_authz::{
    proto::envoy::service::auth::v3::authorization_server::AuthorizationServer,
    translate::{ToolCallRequest, Verdict},
    ChioExtAuthzService, EnvoyKernel, KernelError,
};
use async_trait::async_trait;

struct MyKernel;

#[async_trait]
impl EnvoyKernel for MyKernel {
    async fn evaluate(
        &self,
        request: ToolCallRequest,
    ) -> Result<Verdict, KernelError> {
        // Delegate to chio-kernel / HttpAuthority / custom policy here.
        Ok(Verdict::Allow)
    }
}

#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
    let svc = ChioExtAuthzService::new(MyKernel);
    tonic::transport::Server::builder()
        .add_service(AuthorizationServer::new(svc))
        .serve("0.0.0.0:9091".parse()?)
        .await?;
    Ok(())
}

Re-exports

pub use error::KernelError;

pub use error::TranslateError;

pub use service::ChioExtAuthzService;

pub use service::EnvoyKernel;

pub use translate::check_request_to_tool_call;

pub use translate::AuthMethod;

pub use translate::CallerIdentity;

pub use translate::HttpMethod;

pub use translate::ToolCallRequest;

pub use translate::Verdict;

pub use translate::ENVOY_SERVER_ID;

Modules

error

Error types for the Chio ext_authz adapter.

proto

Generated protobuf bindings for the vendored Envoy ext_authz v3 service.

service

gRPC service implementation for Envoy’s envoy.service.auth.v3.Authorization interface. Each Check RPC is translated into an Chio crate::translate::ToolCallRequest, routed through the EnvoyKernel abstraction, and the returned Verdict is mapped back onto an Envoy CheckResponse.

translate

Translation layer between Envoy’s CheckRequest and the Chio-flavoured ToolCallRequest consumed by the crate::EnvoyKernel trait.