Module event_handler 

Event handler configuration system

This module defines how events are handled - either by LLM, script, or static responses.

Static handler event interpolation

A EventHandlerType::Static handler emits its configured actions without calling the LLM. To let those actions echo values from the event that triggered them — correlation ids such as a DNS query_id, a DHCP/BOOTP xid, an SNMP request-id, a STUN transaction id — action JSON may contain references of the form:

{{event.<field>}}          e.g. {{event.query_id}}
{{event.<a>.<b>}}          e.g. {{event.headers.host}}
{{event.<list>.<index>}}   e.g. {{event.questions.0.name}}
{{event}}                  the whole event payload

Substitution is performed by interpolate_actions immediately before the actions are executed. Three rules define it:

1. Whole-string reference preserves type. A JSON string whose entire value is one reference is replaced by the referenced JSON value itself, so "query_id": "{{event.query_id}}" yields a number, not "4660". Objects, arrays, booleans and null survive equally.
2. Embedded reference interpolates text. "reply to {{event.domain}}" produces a string; non-string values are rendered in their JSON form (null, true, 42, {"a":1}).
3. Everything else is byte-identical. Only {{ … }} groups whose contents are event or begin with event. are touched. Any other braces — Handlebars snippets in a served template, {{ msg }} in a Vue page, { in a JSON body or a regex — pass through unchanged, so handlers written before this feature keep working.

An unresolvable reference is a hard error naming the reference and listing the fields the event actually carries; it is never silently rendered as null or the empty string, because a static handler with a typo’d field name must not appear to work.

Why not Handlebars

Handlebars is already a dependency (src/llm/template_engine.rs) and lends the familiar {{…}} spelling, but it is the wrong engine for this path: it renders to a String, so rule 1 would require re-parsing the output and would turn the string "007" into the number 7; it HTML-escapes {{…}} by default, corrupting JSON and URL payloads unless every reference uses the triple-stash; and it claims the whole {{…}} namespace, so a handler that serves a Handlebars/Vue template, or that contains {{#if}}/{{!--/{{> text, would be rewritten or rejected. The resolver below is ~150 lines, borrows only the spelling, and leaves every non-event reference alone.

Structs

EventHandler

Event handler configuration - maps event patterns to handlers

EventHandlerConfig

Configuration for all event handlers

InterpolationError

A {{event.…}} reference in a static handler action could not be resolved.

Enums

ErrorKind

What EventHandlerType::validate rejected.

EventHandlerType

Handler type for an event

EventPattern

Pattern for matching events

Constants

DEFAULT_MANUAL_TIMEOUT_SECS

How long a manual handler waits for the operator by default.

MAX_INTERPOLATION_BYTES

Maximum resources for one static action expansion (including all actions).

MAX_INTERPOLATION_DEPTH

MAX_INTERPOLATION_NODES

Functions

contains_event_reference

Iterative inspection is also safe for programmatically constructed JSON.

interpolate_actions

Expand all actions under one shared byte/node budget.

interpolate_value

Substitute every {{event.…}} reference in a JSON value tree.

validate_event_references

Check every reference in a value tree for syntactic validity, without an event.