Crate structured_proxy 

Universal gRPC→REST transcoding proxy.

Config-driven: same binary, different YAML = different product proxy. Works with ANY gRPC service via proto descriptors as config.

Usage

structured-proxy --config sid-proxy.yaml
structured-proxy --config sflow-proxy.yaml

JWT verification

The bearer-token check sits behind hooks::TokenVerifier. A build gets one of two:

• the built-in verifier (keys from auth.jwt), whose crypto backend is picked by a feature: rust_crypto (default, pure Rust) or aws_lc_rs (opt-in, constant-time / FIPS-capable, links aws-lc via C FFI). Both may be compiled in at once — Cargo features are additive, so a dependency graph with two dependents asking for different backends unifies into exactly that build. aws_lc_rs then wins: it is constant-time and free of the rsa advisory rust_crypto carries. ProxyServer::from_config settles that choice for the process; a process where another crate may reach jsonwebtoken before any server exists calls install_default_crypto_provider from main instead.
• an injected one, supplied by the embedder through ProxyServer::with_token_verifier. Since Cargo unifies features across a whole dependency graph, a backend feature cannot be chosen per binary — injection is how a consumer that needs a different one gets it without deciding for everyone else who links this crate. Such a build takes default-features = false and links no JWT crypto at all.

Re-exports

pub use auth::crypto::install_default_crypto_provider;

Modules

auth

JWT authentication and route-level authorization.

config

YAML-based proxy configuration.

hooks

Framework-agnostic extension points for embedding the proxy.

oidc

OpenID Connect discovery surface.

openapi

OpenAPI 3.0 spec generation from proto descriptors.

shield

Shield: request rate limiting.

transcode

REST→gRPC transcoding layer.

Structs

ProxyServer

Universal proxy server.

ProxyState

Shared state for all proxy handlers.