Struct LoadedRoute 

pub struct LoadedRoute {
    pub upstream: String,
    pub upstream_host_port: Option<String>,
    pub endpoint_rules: CompiledEndpointRules,
    pub tls_connector: Option<TlsConnector>,
    pub requires_intercept: bool,
    pub requires_managed_credential: bool,
    pub managed_auth_mechanism: Option<NetworkAuditAuthMechanism>,
    pub managed_injection_mode: Option<NetworkAuditInjectionMode>,
}

Route-level configuration loaded at proxy startup.

Contains everything needed to forward and filter a request for a route, but no credential material. Credential injection is handled separately by CredentialStore.

Fields

upstream: String

Upstream URL (e.g., “https://api.openai.com”)

upstream_host_port: Option<String>

Pre-normalised host:port extracted from upstream at load time. Used for O(1) lookups in is_route_upstream() without per-request URL parsing. None if the upstream URL cannot be parsed.

endpoint_rules: CompiledEndpointRules

Pre-compiled L7 endpoint rules for method+path filtering. When non-empty, only matching requests are allowed (default-deny). When empty, all method+path combinations are permitted.

tls_connector: Option<TlsConnector>

Per-route TLS connector with custom CA trust, if configured. Built once at startup from the route’s tls_ca certificate file. When None, the shared default connector (webpki roots only) is used.

requires_intercept: bool

true if this route requires L7 visibility — i.e. it declares credential_key, oauth2, or non-empty endpoint_rules and would not function as a transparent CONNECT tunnel. Computed once at load time so the CONNECT dispatch path doesn’t have to re-derive it on every request.

requires_managed_credential: bool

true if this route was configured to use a managed credential source (credential_key or oauth2). Unlike requires_intercept, this specifically captures whether the proxy must supply upstream authentication itself rather than accept agent-provided credentials.

managed_auth_mechanism: Option<NetworkAuditAuthMechanism>

Audit auth mechanism implied by the managed credential configuration. Kept even if credential material failed to load so fail-closed denial events can describe what auth shape the route expected.

managed_injection_mode: Option<NetworkAuditInjectionMode>

Audit injection mode implied by the managed credential configuration.

Implementations

impl LoadedRoute

pub fn missing_managed_credential( &self, has_static_credential: bool, has_oauth2: bool, ) -> bool

Whether this route is configured to require a proxy-managed credential but the credential material is currently unavailable.

Trait Implementations

impl Debug for LoadedRoute

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.