codetether_agent/browser/request/
net.rs

1//! Network request types for browser-resident HTTP replay and inspection.
2//!
3//! - [`NetworkLogRequest`] reads entries captured by the in-page `fetch`/
4//!   `XMLHttpRequest` wrappers installed in `install_page_hooks`. The agent
5//!   uses this to discover the exact headers (notably `Authorization:
6//!   Bearer …`) the page sent.
7//! - [`FetchRequest`] replays an HTTP request from inside the active tab
8//!   via `page.evaluate(fetch(…))`. Because the request runs in the page's
9//!   own JS context, cookies, TLS fingerprint, and Origin all match what a
10//!   real user click would produce.
11
12use serde::Serialize;
13use std::collections::HashMap;
14
15#[derive(Debug, Clone, Serialize)]
16pub struct NetworkLogRequest {
17    pub limit: Option<usize>,
18    pub url_contains: Option<String>,
19    pub method: Option<String>,
20}
21
22#[derive(Debug, Clone, Serialize)]
23pub struct FetchRequest {
24    pub method: String,
25    pub url: String,
26    pub headers: Option<HashMap<String, String>>,
27    pub body: Option<String>,
28    /// `omit` | `same-origin` | `include` — default `include` so cookies
29    /// and HttpOnly session tokens travel with the request.
30    pub credentials: Option<String>,
31}
32
33/// Replay an HTTP request through the page's own axios instance.
34///
35/// Unlike [`FetchRequest`], this reuses every interceptor the app has
36/// installed (auth header injection, CSRF tokens, baseURL rewrites,
37/// request IDs), which is often the only way to reproduce a request that
38/// `fetch` rejects with "Failed to fetch" due to CORS / preflight /
39/// service-worker routing differences.
40///
41/// `axios_path` lets the caller override the discovery lookup (e.g.
42/// `"window.__APP__.api"` or `"window.axios"`); when `None`, the handler
43/// auto-discovers the first object on `window` that looks like an axios
44/// instance (has `.defaults.baseURL` or `.defaults.headers.common`).
45#[derive(Debug, Clone, Serialize)]
46pub struct AxiosRequest {
47    pub method: String,
48    pub url: String,
49    pub headers: Option<HashMap<String, String>>,
50    pub body: Option<serde_json::Value>,
51    pub axios_path: Option<String>,
52}
53
54/// Diagnostic snapshot of the page's HTTP plumbing.
55///
56/// Returns a JSON blob describing service workers, discovered axios
57/// instances (with their `baseURL` and a sample of common headers),
58/// recently-seen request initiators, and document CSP. Useful when
59/// `fetch` replay fails with a transport-layer error and the agent
60/// needs to decide whether to fall back to axios, hook the app's save
61/// function, or call the worker directly.
62#[derive(Debug, Clone, Serialize, Default)]
63pub struct DiagnoseRequest {}
64
65/// Replay an HTTP request through a raw `XMLHttpRequest` inside the page.
66///
67/// Use this when [`FetchRequest`] returns "Failed to fetch" but
68/// `network_log` shows the app's own successful request had `kind: xhr`.
69/// The XHR transport differs from `fetch` in several ways that matter for
70/// WAF / CORS / service-worker routing:
71///
72/// - XHR does not send `Sec-Fetch-Mode: cors` / `Sec-Fetch-Dest: empty`
73///   headers the same way, which some edge rules use to block tool replays.
74/// - XHR inherits the document's full cookie jar and Origin by default;
75///   there is no `credentials: 'omit'` equivalent.
76/// - Service workers often pass XHR through untouched while intercepting
77///   `fetch`, so a SW-rewriting auth header won't affect this path.
78/// - Simple XHRs (GET/POST with allowlisted headers) skip CORS preflight
79///   on the same rules as the original page script.
80///
81/// Request body is sent verbatim; set `Content-Type` explicitly in
82/// `headers` when sending JSON.
83#[derive(Debug, Clone, Serialize)]
84pub struct XhrRequest {
85    pub method: String,
86    pub url: String,
87    pub headers: Option<HashMap<String, String>>,
88    pub body: Option<String>,
89    /// When true (default), sets `xhr.withCredentials = true` so cookies
90    /// and `Authorization` travel cross-origin. Set false to mimic a
91    /// public-asset request.
92    pub with_credentials: Option<bool>,
93}
94
codetether_agent/browser/request/net.rs

codetether_agent/browser/request/
net.rs
