systemprompt-api 0.55.0

Axum-based HTTP server and API gateway for systemprompt.io AI governance infrastructure. Exposes governed agents, MCP, A2A, and admin endpoints with rate limiting and RBAC.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36

//! Cookie-authenticated mutations require a matching origin; bearer-only
//! machine clients use the existing authenticated admin transport.
//!
//! Copyright (c) systemprompt.io — Business Source License 1.1.
//! See <https://systemprompt.io> for licensing details.

use axum::extract::{Request, State};
use axum::http::{StatusCode, header};
use axum::middleware::Next;
use axum::response::{IntoResponse, Response};
use systemprompt_runtime::AppContext;

pub async fn protect(State(ctx): State<AppContext>, request: Request, next: Next) -> Response {
    if !request.method().is_safe() && request.headers().contains_key(header::COOKIE) {
        let expected = url::Url::parse(&ctx.config().api_external_url)
            .ok()
            .map(|url| url.origin().ascii_serialization());
        let actual = request
            .headers()
            .get(header::ORIGIN)
            .and_then(|value| value.to_str().ok());
        if expected.as_deref().is_none() || actual != expected.as_deref() {
            return (
                StatusCode::FORBIDDEN,
                "Same-origin browser request required",
            )
                .into_response();
        }
    }
    let mut response = next.run(request).await;
    response.headers_mut().insert(
        header::CACHE_CONTROL,
        http::HeaderValue::from_static("no-store"),
    );
    response
}