pub fn refuse_insecure_transport(id: &str, url: &str) -> Result<(), HostError>Expand description
Refuse a plaintext transport to a non-loopback provider before any bytes
leave the host (SPEC.md §4.2, C7): an http:// (not https://) URL
whose host is not loopback would carry the query payload — and any bearer
credential — across the network in cleartext. A loopback http:// target is
allowed (the bytes never leave the machine); every https:// target is
allowed. Called before the client is built or DNS is resolved, so a refusal
short-circuits with zero network activity.
§Why this is public
Host::add_http already calls it, so C7 holds
whether or not a caller does. It is exported for the case a host wants to
classify a URL before attempting the connection — typically to report a
plaintext endpoint as the configuration error it is, rather than as a
connection failure or a non-conformant provider.
The alternative is that every host re-derives “which hosts are loopback”
locally, and C7 ends up with one implementation per host, free to disagree
about [::1], 127.0.0.2, or the casing of LOCALHOST. A normative rule
with N implementations is N rules. This is the one.
use contextgraph_host::{HostError, refuse_insecure_transport};
// Plaintext to a remote peer: refused, with the peer named.
let refusal = refuse_insecure_transport("acme", "http://cgp.example.com/q");
assert!(matches!(refusal, Err(HostError::InsecureTransport { .. })));
// Loopback plaintext and TLS are both fine.
assert!(refuse_insecure_transport("local", "http://127.0.0.1:8080/q").is_ok());
assert!(refuse_insecure_transport("acme", "https://cgp.example.com/q").is_ok());