Struct AppHandler 

pub struct AppHandler<A, Z = AllowAllAuthorizer> { /* private fields */ }

Adapts the engine pipeline to the transport’s IngressHandler contract, authenticating each request with the configured Authenticator and, after authentication, authorizing it with the configured Authorizer (default AllowAllAuthorizer, no second policy layer until one is supplied).

Implementations

impl<A: Authenticator> AppHandler<A, AllowAllAuthorizer>

pub fn new(pipeline: AppPipeline, authenticator: A) -> Self

Wraps a pipeline and an authenticator (no request logging by default, and the allow-all authorizer until Self::with_authorizer supplies one).

impl<A: Authenticator, Z: Authorizer> AppHandler<A, Z>

pub fn with_authorizer<Z2: Authorizer>( self, authorizer: Z2, ) -> AppHandler<A, Z2>

Sets the post-authentication Authorizer (builder style). Replaces the default allow-all policy; the principal is already resolved, so the authorizer decides only whether that principal may perform the action.

pub fn with_forward_policy(self, policy: ForwardPolicy) -> Self

Sets the client-to-upstream header forwarding policy (builder style). Default pass-all (sidecar trust). Restrict it to keep specific headers (e.g. authorization) off the cluster, or disable forwarding entirely.

pub fn with_capture(self, capture: Box<dyn Capture>) -> Self

Sets the full-fidelity traffic capture (builder style). Off by default. Compose redaction with capture::RedactingCapture; the stream carries bodies and values, so treat it as privileged.

pub fn with_debug_endpoints(self, enabled: bool) -> Self

Sets whether the pre-auth /debug/explain and /debug/breakglass surfaces are served (builder style). Default true; set false in production so operational metadata is not exposed unauthenticated.

pub fn with_require_tls_for_mutation(self, require: bool) -> Self

Sets whether body-mutating requests are refused over cleartext (NFR-S1). Builder style; default true (enforce). Pass false only on a trusted network where the operator accepts mutating over cleartext.

pub fn pipeline(&self) -> &AppPipeline

The pipeline this handler serves, a read-only accessor for introspection (e.g. the perf harness reading upstream pool_stats after a load run).

pub fn with_request_log(self, request_log: Box<dyn RequestLog>) -> Self

Sets the structured per-request logger (builder style). Default: no logs.

pub fn with_directive_admin( self, store: Arc<InMemoryDirectiveStore>, token: String, clock: Arc<dyn Clock>, ) -> Self

Enables the POST /admin/directives channel (builder style): publishes a fleet directive set into store when the request carries the bearer token. Without this, the endpoint reports not_enabled.

Trait Implementations

impl<A, Z> Debug for AppHandler<A, Z>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<A: Authenticator, Z: Authorizer> IngressHandler for AppHandler<A, Z>

async fn handle(&self, req: IngressRequest) -> IngressResponse

Handles one request. The returned future must be Send so connections can be served on the multi-threaded runtime.

fn forward_plan(&self, path: &str, logical_index: &str) -> bool

Whether this request is a verbatim passthrough that should be forwarded with a streamed body (ADR-014 stage 2), decided from the head alone so the transport can avoid buffering. Returns false by default (every request is buffered and handled by handle). Verbatim passthrough forwards every method, so the decision is path/index-only.

async fn handle_forward( &self, req: IngressRequest, body: Incoming, ) -> StreamingResponse

Handles a streamed verbatim forward: body is the downstream request body piped straight to the upstream, and the returned StreamingResponse’s body is the upstream response piped straight back, neither buffered. Called only when forward_plan returned true; req carries the parsed head (its body field is empty, the body is the body argument). The default returns 500, so a handler that opts in via forward_plan must implement it.

fn wants_search_stream( &self, endpoint: EndpointKind, query: Option<&str>, ) -> bool

Whether this _search should have its response streamed back through the hit transform (ADR-014, final stage) rather than buffered: decided from the endpoint + query (e.g. a scroll-opening search keeps the buffered path). The request body is still buffered first (it is small); only the response streams. false by default.

async fn handle_search_stream(&self, req: IngressRequest) -> StreamingResponse

Handles a streamed-response _search: req carries the (buffered) query body; the returned StreamingResponse’s body is the upstream hits envelope piped back through the hit transform without buffering. Called only when wants_search_stream returned true. Default 500.

fn wants_bulk_stream( &self, endpoint: EndpointKind, headers: &[(String, String)], ) -> bool

Whether this _bulk request should be stream-demuxed (ADR-014 stage 4) rather than buffered: decided from the endpoint + headers (e.g. the write mode) alone, so the transport can avoid buffering the whole batch. false by default.

async fn handle_bulk_stream( &self, req: IngressRequest, body: Incoming, ) -> IngressResponse

Handles a stream-demuxed _bulk: body is the NDJSON batch, framed and dispatched op by op without buffering the whole thing. Called only when wants_bulk_stream returned true. Default 500.