Struct HttpEgressContract 

pub struct HttpEgressContract {
    pub tenant_egress_namespace: String,
    pub allowed_schemes: BTreeSet<String>,
    pub allowed_authority_set: BTreeSet<String>,
    pub deny_loopback: bool,
    pub deny_link_local: bool,
    pub deny_ipv6_ula: bool,
    pub max_redirect_chain: u8,
    pub max_response_bytes: u64,
}

Typed egress policy that must be declared before substrate HTTP egress.

Fields

tenant_egress_namespace: String

Tenant-scoped namespace used by callers to bind egress receipts and deployment policy to one authority domain.

allowed_schemes: BTreeSet<String>

Lowercase HTTP URL schemes allowed by this contract: http or https.

allowed_authority_set: BTreeSet<String>

Exact normalized URL authorities allowed by this contract.

Domain authorities are lowercase. IPv6 authorities use brackets, for example [2001:db8::10]:443.

deny_loopback: bool

Reject loopback address literals and localhost names even if an authority entry was configured.

deny_link_local: bool

Reject IPv4 and IPv6 link-local address literals.

deny_ipv6_ula: bool

Reject IPv6 unique-local address literals.

max_redirect_chain: u8

Maximum redirect hop count accepted for a request chain.

max_response_bytes: u64

Maximum response bytes accepted before the substrate must abort.

Implementations

impl HttpEgressContract

pub fn enforce_required( contract: Option<&HttpEgressContract>, target_url: &str, redirect_chain_len: u8, observed_response_bytes: Option<u64>, ) -> Result<ValidatedHttpEgressTarget, HttpEgressError>

Enforce a required contract. None is a fail-closed denial.

pub fn enforce_attempt( &self, target_url: &str, redirect_chain_len: u8, observed_response_bytes: Option<u64>, ) -> Result<ValidatedHttpEgressTarget, HttpEgressError>

Enforce target, redirect, and optional response-size bounds.

pub fn enforce_url( &self, target_url: &str, redirect_chain_len: u8, ) -> Result<ValidatedHttpEgressTarget, HttpEgressError>

Enforce target URL and redirect hop constraints.

pub fn enforce_url_with_dns( &self, target_url: &str, redirect_chain_len: u8, ) -> Result<ValidatedHttpEgressTarget, HttpEgressError>

Enforce target URL, redirect hop constraints, and DNS safety.

Literal IPs and localhost names are enforced directly. Domain names are resolved here and every resolved IP is checked against the address-class policy before the caller opens a socket.

pub fn enforce_response_bytes( &self, observed: u64, ) -> Result<(), HttpEgressError>

Enforce the response-byte ceiling after headers or streaming counters expose the observed size.

pub fn validate(&self) -> Result<(), HttpEgressError>

Validate the contract shape before use.

pub fn prepare(&self) -> Result<PreparedHttpEgressContract, HttpEgressError>

Validate this raw contract and return an immutable enforcement handle.

pub fn validate_dispatchable_with_pinned_dns( &self, ) -> Result<(), HttpEgressError>

Validate that this contract can be used by the reqwest-backed dispatcher whose resolver enforces address-class policy at connect time.

pub fn enforce_resolved_ip( &self, host: &str, address: IpAddr, ) -> Result<(), HttpEgressError>

Enforce address-class denials after a domain has resolved to an IP.

impl HttpEgressContract

pub fn permissive_for_tests(authority: &str) -> HttpEgressContract

Construct a permissive contract suitable for tests that exercise a wiremock or other local loopback HTTP server. Production code MUST NOT use this; production always builds a contract from tenant-scoped substrate config.

Loopback, link-local and IPv6 ULA denials are disabled so wiremock’s 127.0.0.1:<port> URL is accepted. Authority allow-list is wildcard per allowed_authority_set semantics: caller supplies the wiremock authority. Schemes default to http and https.

Trait Implementations

impl Clone for HttpEgressContract

fn clone(&self) -> HttpEgressContract

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for HttpEgressContract

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for HttpEgressContract

fn deserialize<__D>( __deserializer: __D, ) -> Result<HttpEgressContract, <__D as Deserializer<'de>>::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Eq for HttpEgressContract

impl PartialEq for HttpEgressContract

fn eq(&self, other: &HttpEgressContract) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for HttpEgressContract

fn serialize<__S>( &self, __serializer: __S, ) -> Result<<__S as Serializer>::Ok, <__S as Serializer>::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for HttpEgressContract