Struct RemoteResolveConfig 

pub struct RemoteResolveConfig {
    pub enabled: bool,
    pub allowed_base_urls: Vec<AllowedBaseUrl>,
    pub timeout: Duration,
    pub max_fetches: usize,
    pub max_depth: usize,
    pub max_response_bytes: usize,
    pub concurrency: usize,
    pub bearer_tokens: HashMap<String, String>,
    pub allow_private_addresses: bool,
    pub cache_max_entries: usize,
}

Configuration for remote (trusted-server) resolve().

Defaults are off: an empty/default config never permits a fetch. Build one from the process environment with RemoteResolveConfig::from_env.

Fields

enabled: bool

Master switch (SOF_RESOLVE_REMOTE). When false, nothing is ever fetched.

allowed_base_urls: Vec<AllowedBaseUrl>

Trusted base URLs that references must match to be fetchable.

timeout: Duration

Per-request timeout (SOF_RESOLVE_TIMEOUT_MS).

max_fetches: usize

Hard cap on total fetches per run (SOF_RESOLVE_MAX_FETCHES).

max_depth: usize

Bounded prefetch rounds for chained references (SOF_RESOLVE_MAX_DEPTH).

max_response_bytes: usize

Maximum accepted response size in bytes (SOF_RESOLVE_MAX_RESPONSE_BYTES).

concurrency: usize

Maximum concurrent fetches (SOF_RESOLVE_CONCURRENCY).

bearer_tokens: HashMap<String, String>

Optional per-host bearer tokens (SOF_RESOLVE_AUTH), keyed by lowercased host. Sent only on requests to that exact (already-allowlisted) host.

allow_private_addresses: bool

Allow allowlisted hostnames to resolve to private/internal addresses — RFC1918 (10/8, 172.16/12, 192.168/16) and IPv6 ULA (fc00::/7) (SOF_RESOLVE_ALLOW_PRIVATE_ADDRESSES, default false).

Needed for internal deployments where references point at an internal load balancer / reverse proxy (e.g. Traefik) by hostname. Even when true, the always-blocked ranges (loopback, link-local incl. cloud metadata, multicast, broadcast, unspecified, CGNAT, reserved) remain refused — see is_blocked_address.

cache_max_entries: usize

Maximum entries in the cross-chunk fetched-resource cache used by the streaming path (SOF_RESOLVE_CACHE_MAX_ENTRIES). The cache (LRU, with negative caching of misses) lets a reference recurring across chunks be fetched once; bounding it keeps streaming memory bounded — evicted-then- reused references are re-fetched. Ignored by the single-Bundle path, which holds all references in one pass.

Implementations

impl RemoteResolveConfig

pub fn from_env() -> Self

Builds the configuration from the process environment.

Malformed numeric values fall back to their defaults (with a tracing warning); malformed allowlist entries are skipped individually.

pub fn from_env_with(get: impl Fn(&str) -> Option<String>) -> Self

Builds the configuration from an arbitrary environment lookup.

Exposed so the parsing logic can be unit-tested without touching the process-global environment.

pub fn bearer_for_host(&self, host: &str) -> Option<&str>

Returns the bearer token configured for host, if any (case-insensitive).

pub fn is_active(&self) -> bool

Whether remote resolution can fetch anything at all (enabled and the allowlist is non-empty). When false, Self::fetch_decision always denies.

pub fn fetch_decision(&self, reference: &str) -> FetchDecision

Decides whether reference may be fetched from a trusted server.

This is the single gate enforcing the default-deny policy. It performs no I/O and no DNS resolution.

Trait Implementations

impl Clone for RemoteResolveConfig

fn clone(&self) -> RemoteResolveConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for RemoteResolveConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for RemoteResolveConfig

fn default() -> Self

Returns the “default value” for a type.