Module https_enforcement

Expand description

The HTTPS enforcement pipeline stage for tower stacks.

One tower::Layer answering the reference engine’s https_enforcement check (guard_core/core/checks/implementations/https_enforcement.py) before a request reaches the inner service.

The decision core is guard_core_engine::https_enforcement; this stage wires it into the family’s tower seams:

route require_https wins over the global enforce_https arm
plain HTTP under a requirement:  301 redirect to the https URL
                                 (the reference create_https_redirect)
passive mode:                    pass through (log-only in the reference)

The reference answers the redirect through its response factory and the response modifier, and never fires the block hook for this check (https_enforcement is in ON_BLOCK_EXCLUDED_CHECK_NAMES) - the stage mirrors the exclusion by construction (it carries no hook) and renders the plain 301 + Location shape.

§Example

use guard_core_rs::https_enforcement::{HttpsEnforcementStage, HttpsEnforcementStageConfig};

let stage = HttpsEnforcementStage::builder(HttpsEnforcementStageConfig::default())
    .enforce_https(true)
    .build()
    .expect("valid proxy list");

// Plain HTTP under a global enforcement: a 301 to the https URL.
let answer = stage
    .decide("/", "http", None, None, "https://host.example/")
    .expect("redirected");
assert_eq!(answer.status, 301);
assert_eq!(answer.location, "https://host.example/");

// HTTPS passes.
assert!(stage.decide("/", "https", None, None, "").is_none());

Structs§

HttpsEnforcementStage: The HTTPS enforcement stage.
HttpsEnforcementStageBuilder: Builder for HttpsEnforcementStage.
HttpsEnforcementStageConfig: The stage configuration (SecurityConfig.enforce_https, .trust_x_forwarded_proto, .passive_mode).
HttpsEnforcementStageLayer: The tower::Layer carrying HttpsEnforcementStage.
HttpsEnforcementStageService: The stage as a tower::Service around the inner service it wrapped.
HttpsRedirectAnswer: The stage’s answer: the reference’s create_https_redirect shape (a 301 to the scheme-upgraded URL).

Constants§

HTTPS_ENFORCEMENT_CHECK_NAME: The check’s stable name (check_name).
HTTPS_REDIRECT_STATUS: The redirect status the reference’s create_https_redirect answers with (create_redirect_response(https_url, 301)).

Type Aliases§

RouteHttpsResolver: How the stage learns a path’s require_https (the reference reads it from request.state.route_config). None means no route config: the global arm decides. Some(false) opts the route out.