lean_ctx/core/
http_client.rs

1use std::time::Duration;
2
3/// Shared TLS config for every ureq client so OS/enterprise root CAs are honored
4/// (#643). ureq's default `RootCerts::WebPki` ignores the system store, so requests
5/// fail with `UnknownIssuer` behind TLS-intercepting corporate proxies. Inject this
6/// into a `ureq::config::Config::builder().tls_config(platform_tls_config())` at each
7/// call site — ureq's builder scope typestate is private, so a shared *builder*
8/// cannot be returned from a function; the shared piece is this `TlsConfig`.
9pub fn platform_tls_config() -> ureq::tls::TlsConfig {
10    ureq::tls::TlsConfig::builder()
11        .root_certs(ureq::tls::RootCerts::PlatformVerifier)
12        .build()
13}
14
15/// Builds a ureq agent from an already-assembled config (kept as a thin, nameable
16/// wrapper so call sites read uniformly alongside `platform_tls_config`).
17pub fn ureq_agent(config: ureq::config::Config) -> ureq::Agent {
18    ureq::Agent::new_with_config(config)
19}
20
21/// Agent that honors platform roots and bounds only the connection-setup phases
22/// (DNS/connect/first-byte) — a large but progressing download stays uncapped.
23pub fn ureq_agent_with_timeouts(
24    timeout_resolve: Option<Duration>,
25    timeout_connect: Option<Duration>,
26    timeout_recv_response: Option<Duration>,
27) -> ureq::Agent {
28    ureq::config::Config::builder()
29        .tls_config(platform_tls_config())
30        .timeout_resolve(timeout_resolve)
31        .timeout_connect(timeout_connect)
32        .timeout_recv_response(timeout_recv_response)
33        .build()
34        .into()
35}
lean_ctx/core/http_client.rs

lean_ctx/core/
http_client.rs
