chio_api_protect/
lib.rs

1//! Zero-code reverse proxy that protects HTTP APIs with Chio signed receipts.
2//!
3//! `chio api protect` reads an OpenAPI spec, generates a default Chio policy,
4//! and proxies all requests to the upstream API. Every request produces a
5//! signed `HttpReceipt`. Side-effect routes (POST/PUT/PATCH/DELETE) require
6//! a capability token; safe routes (GET/HEAD/OPTIONS) pass with audit receipts.
7//!
8//! ## Sidecar control routes and production boundaries
9//!
10//! The embedded sidecar exposes SDK helper routes under `/v1/*` and
11//! `/chio/*`. Not every route performs kernel-mediated authorization:
12//!
13//! - **`POST /v1/evaluate/advisory`** signs an advisory `ChioReceipt` only.
14//!   It checks local revocation and parameter-hash consistency; it does not
15//!   validate capability scope or run the kernel guard pipeline. Successful
16//!   responses set the `chio-trust-level: advisory` header and include
17//!   `authorization: false` in the response body. Treat this route as
18//!   observability, not as an allow/deny gate.
19//! - **`POST /v1/capabilities/attenuate`** is a fail-closed control boundary.
20//!   It returns HTTP 403 because attenuation requires the parent subject signer.
21//!   Use the kernel delegation primitive or SDK-local signer helpers so that
22//!   private key remains outside the sidecar.
23//!
24//! See [`README.md`](../README.md) for the full list of routes that are
25//! not production authorization paths.
26
27#![forbid(unsafe_code)]
28
29mod error;
30mod evaluator;
31mod proxy;
32mod spec_discovery;
33
34pub use error::ProtectError;
35pub use evaluator::{EvaluationResult, RequestEvaluator, RouteEntry};
36pub use proxy::{ProtectConfig, ProtectProxy, DEFAULT_UPSTREAM_REQUEST_TIMEOUT};
37pub use spec_discovery::{discover_spec, load_spec_from_file};
chio_api_protect/lib.rs

chio_api_protect/
lib.rs
