Struct CredentialInjectionFilter 

pub struct CredentialInjectionFilter { /* private fields */ }

Injects per-cluster API credentials into upstream requests.

For each configured cluster, injects a header (e.g. Authorization: Bearer sk-...) and optionally strips client-provided values for that header to prevent credential forwarding.

Credentials are resolved at construction time (inline values or environment variables). The filter matches on the cluster name selected by the router filter earlier in the pipeline.

YAML configuration

filter: credential_injection
clusters:
  - name: provider-a
    header: Authorization
    env_var: PROVIDER_A_API_KEY
    header_prefix: "Bearer "
    strip_client_credential: true
  - name: internal
    header: x-api-key
    value: "internal-secret"

Example

use praxis_filter::CredentialInjectionFilter;

let yaml: serde_yaml::Value = serde_yaml::from_str(
    r#"
clusters:
  - name: backend
    header: x-api-key
    value: "secret-123"
    strip_client_credential: true
"#,
)
.unwrap();
let filter = CredentialInjectionFilter::from_config(&yaml).unwrap();
assert_eq!(filter.name(), "credential_injection");

Implementations

impl CredentialInjectionFilter

pub fn from_config(config: &Value) -> Result<Box<dyn HttpFilter>, FilterError>

Create from YAML config.

Resolves all credentials (inline or from environment variables) at construction time so that per-request processing is a simple map lookup.

use praxis_filter::CredentialInjectionFilter;

let yaml: serde_yaml::Value = serde_yaml::from_str(
    r#"
clusters:
  - name: my-cluster
    header: Authorization
    value: "token-abc"
    header_prefix: "Bearer "
"#,
)
.unwrap();
let filter = CredentialInjectionFilter::from_config(&yaml).unwrap();
assert_eq!(filter.name(), "credential_injection");

Errors

Returns FilterError if:

• clusters is empty
• Both value and env_var are set (or neither)
• An env_var is not set in the environment

Trait Implementations

impl HttpFilter for CredentialInjectionFilter

fn name(&self) -> &'static str

Unique name identifying this filter type (e.g. "router", "rate_limit").

fn on_request<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, ctx: &'life1 mut HttpFilterContext<'life2>, ) -> Pin<Box<dyn Future<Output = Result<FilterAction, FilterError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait,

Called for each incoming request, in pipeline order.

fn on_response<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, ctx: &'life1 mut HttpFilterContext<'life2>, ) -> Pin<Box<dyn Future<Output = Result<FilterAction, FilterError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait,

Called for each response, in reverse pipeline order.

fn request_body_access(&self) -> BodyAccess

Declares what access this filter needs to request bodies.

fn response_body_access(&self) -> BodyAccess

Declares what access this filter needs to response bodies.

fn request_body_mode(&self) -> BodyMode

Declares the delivery mode for request body chunks.

fn response_body_mode(&self) -> BodyMode

Declares the delivery mode for response body chunks.

fn needs_request_context(&self) -> bool

Whether this filter needs the original request context during body phases.

fn apply_insecure_options(&self, _options: &InsecureOptions)

Apply global InsecureOptions to this filter.

fn compression_config(&self) -> Option<&CompressionConfig>

Returns the compression configuration if this filter enables response compression.

fn on_request_body<'life0, 'life1, 'life2, 'life3, 'async_trait>( &'life0 self, ctx: &'life1 mut HttpFilterContext<'life2>, body: &'life3 mut Option<Bytes>, end_of_stream: bool, ) -> Pin<Box<dyn Future<Output = Result<FilterAction, FilterError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait, 'life3: 'async_trait,

Called for each chunk of request body data, in pipeline order.

fn on_response_body( &self, ctx: &mut HttpFilterContext<'_>, body: &mut Option<Bytes>, end_of_stream: bool, ) -> Result<FilterAction, FilterError>

Called for each chunk of response body data, in reverse pipeline order.