http-handle 0.0.5

A fast and lightweight Rust library for handling HTTP requests and responses.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97

// SPDX-License-Identifier: AGPL-3.0-only
// Copyright (c) 2023 - 2026 HTTP Handle

//! `tls` (via `enterprise` umbrella): TLS / mTLS policy primitives.
//!
//! Run: `cargo run --example tls --features enterprise`

#[cfg(feature = "enterprise")]
#[path = "support.rs"]
mod support;

#[cfg(feature = "enterprise")]
fn main() {
    use http_handle::enterprise::{
        AuthPolicy, TlsPolicy, validate_mtls_subject,
    };
    use std::path::PathBuf;

    support::header("http-handle -- tls");

    support::task_with_output(
        "Default TlsPolicy is disabled until paths are wired",
        || {
            let policy = TlsPolicy::default();
            vec![
                format!("enabled       = {}", policy.enabled),
                format!("mtls_enabled  = {}", policy.mtls_enabled),
                format!("cert_chain    = {:?}", policy.cert_chain_path),
                format!(
                    "private_key   = {:?}",
                    policy.private_key_path
                ),
            ]
        },
    );

    support::task_with_output(
        "Production-shaped TLS + mTLS policy",
        || {
            let policy = TlsPolicy {
                enabled: true,
                cert_chain_path: Some(PathBuf::from(
                    "/etc/ssl/server.crt",
                )),
                private_key_path: Some(PathBuf::from(
                    "/etc/ssl/server.key",
                )),
                mtls_enabled: true,
                client_ca_bundle_path: Some(PathBuf::from(
                    "/etc/ssl/clients.bundle",
                )),
            };
            vec![
                format!("enabled       = {}", policy.enabled),
                format!("mtls_enabled  = {}", policy.mtls_enabled),
                format!(
                    "client_ca     = {}",
                    policy
                        .client_ca_bundle_path
                        .as_ref()
                        .map(|p| p.display().to_string())
                        .unwrap_or_default()
                ),
            ]
        },
    );

    support::task_with_output(
        "validate_mtls_subject filters against an allowlist",
        || {
            let auth = AuthPolicy {
                mtls_subject_allowlist: vec![
                    "CN=svc-a,O=acme".into(),
                    "CN=svc-b,O=acme".into(),
                ],
                ..AuthPolicy::default()
            };
            let allowed =
                validate_mtls_subject(&auth, "CN=svc-a,O=acme");
            let denied =
                validate_mtls_subject(&auth, "CN=stranger,O=evil");
            vec![
                format!("CN=svc-a,O=acme    -> {allowed}"),
                format!("CN=stranger,O=evil -> {denied}"),
            ]
        },
    );

    support::summary(3);
}

#[cfg(not(feature = "enterprise"))]
fn main() {
    eprintln!(
        "Enable the 'enterprise' feature: cargo run --example tls --features enterprise"
    );
}