pub struct HttpClient { /* private fields */ }Expand description
Sealed HTTP client wrapper.
The internal reqwest::Client is deliberately private: callers have no
way to obtain &reqwest::Client from an HttpClient (no Deref, no
AsRef, no inner_client()), so they physically cannot invoke
client.get(url).send() and bypass the allowlist. Every send goes
through HttpClient::request (or one of the method-specific helpers),
which re-parses url and re-checks it against REPOSIX_ALLOWED_ORIGINS.
Implementations§
Source§impl HttpClient
impl HttpClient
Sourcepub async fn request<U: IntoUrl>(
&self,
method: Method,
url: U,
) -> Result<Response>
pub async fn request<U: IntoUrl>( &self, method: Method, url: U, ) -> Result<Response>
Send a method request to url, re-checking url against the
allowlist before any I/O.
This is the hook callers MUST use after observing a 3xx: re-feed the
Location URL through HttpClient::request so the allowlist
recheck rejects redirect targets that escape the allowlist (SG-01
defence in depth).
§Errors
Returns Error::InvalidOrigin if url fails to parse or its origin
does not match any allowlist entry. Returns Error::Other if
REPOSIX_ALLOWED_ORIGINS is set but un-parseable. Returns
Error::Http for transport-level failures from reqwest.
Sourcepub async fn request_with_headers<U: IntoUrl>(
&self,
method: Method,
url: U,
headers: &[(&str, &str)],
) -> Result<Response>
pub async fn request_with_headers<U: IntoUrl>( &self, method: Method, url: U, headers: &[(&str, &str)], ) -> Result<Response>
Send a method request to url with extra headers attached in order,
re-checking url against the allowlist before any I/O.
The allowlist gate fires BEFORE any header is attached and BEFORE any
socket work; a non-allowlisted origin returns Error::InvalidOrigin
without leaking header data to the network layer. Headers are attached
in order; duplicates are allowed and preserved (reqwest does not
dedupe).
This is the hook callers MUST use after observing a 3xx: re-feed the
Location URL through HttpClient::request_with_headers (or the
zero-header HttpClient::request wrapper) so the allowlist recheck
rejects redirect targets that escape the allowlist (SG-01 defence in
depth).
§Errors
Returns Error::InvalidOrigin if url fails to parse or its origin
does not match any allowlist entry. Returns Error::Other if
REPOSIX_ALLOWED_ORIGINS is set but un-parseable. Returns
Error::Http for transport-level failures from reqwest.
Sourcepub async fn request_with_headers_and_body<U, B>(
&self,
method: Method,
url: U,
headers: &[(&str, &str)],
body: Option<B>,
) -> Result<Response>
pub async fn request_with_headers_and_body<U, B>( &self, method: Method, url: U, headers: &[(&str, &str)], body: Option<B>, ) -> Result<Response>
Send a method request with both headers AND an optional request
body, re-checking url against the allowlist before any I/O.
Callers pass None (inferred via None::<&[u8]> or None::<Vec<u8>>)
for verbs that never carry bodies (GET, DELETE). Some(body)
attaches the bytes and Content-Length automatically via reqwest.
The allowlist gate fires BEFORE body serialization, so a non-
allowlisted origin never leaks body bytes to the network layer.
§Errors
Same conditions as HttpClient::request_with_headers.
Trait Implementations§
Source§impl Clone for HttpClient
impl Clone for HttpClient
Source§fn clone(&self) -> HttpClient
fn clone(&self) -> HttpClient
1.0.0 · Source§fn clone_from(&mut self, source: &Self)
fn clone_from(&mut self, source: &Self)
source. Read more