Module proxy 

The two-header proxy auth and the mint schedule, on tokio’s clock in production.

Structs

ProxyAuth

Mints, caches, and refreshes the proxy token for one MicroVM and one port.

ProxyToken

The minted token, as the control plane returns it: a map of header name to value.

TokioClock

The production clock: tokio’s monotonic clock and the system’s wall clock.

Constants

DEFAULT_AGENT_PORT

Compatibility alias for the shared daemon listener default.

DEFAULT_REFRESH_AFTER

When to re-mint: half MAX_TOKEN_LIFETIME. See the module docs for why not fifty-nine minutes.

MAX_TOKEN_LIFETIME

The ceiling the service enforces on a proxy token’s life. Not a choice.

PROXY_AUTH_HEADER

The header carrying the minted JWE. One of the two keys read out of the authToken map.

PROXY_PORT_HEADER

The header naming which of the token’s allowed ports this request targets.

WS_AUTH_SUBPROTOCOL_PREFIX

The prefix the JWE rides behind in a WebSocket handshake.

WS_PORT_SUBPROTOCOL_PREFIX

The prefix the target port rides behind in a WebSocket handshake.

WS_SUBPROTOCOL

The base subprotocol every MicroVM WebSocket handshake offers first.

Traits

Clock

The clock a refresh boundary is measured on. It’s the crate’s one Clock, and the production one is tokio’s (TokioClock, in microvms-edges): a token timed on std::time::Instant would never re-mint inside a simulation. Time, injectable so a wait or a refresh boundary is a test rather than a wait.

TokenMinter

Mints a proxy token. One method, so a test needs no AWS.