Struct ProxyRequest 

pub struct ProxyRequest {
    pub provider: String,
    pub method: ProxyMethod,
    pub path: String,
    pub body: Option<Value>,
    pub stream: bool,
    pub body_bytes: Option<Bytes>,
}

A typed, credential-free request the broker executes on the caller’s behalf against an OpenAI-compatible provider endpoint.

The caller names a provider and a relative path; the broker derives the destination from its pinned provider table and applies the (broker-owned) credential. Callers can never supply an absolute URL for a static-key provider, so a key can never be coaxed toward an attacker-chosen host.

Fields

provider: String

Static provider key (e.g. groq), local, or an OAuth-proxied provider. For OAuth providers an explicit account slot may be pinned as <provider>@<label> or <provider>@default; a bare provider means “the broker’s account policy”. Validated by validate; an explicit unknown slot is an error, never a fallback.

method: ProxyMethod

path: String

Relative path joined onto the pinned base URL, e.g. /chat/completions.

body: Option<Value>

JSON request body (POST only).

stream: bool

Request an SSE byte stream (proxy_stream) instead of a buffered body.

body_bytes: Option<Bytes>

Typed exact-byte handoff (request-trace spec §6.2): when present this MUST be the exact serialization of body, produced once by the caller. LocalBroker sends these very bytes upstream verbatim, so a caller-computed digest over them is a digest of the true wire body. The field never crosses the remote broker HTTP boundary (serde(skip)): a remote broker daemon re-serializes body on its side, so callers on a remote path must NOT claim exact upstream bytes. Never logged, never part of the broker wire schema.

Implementations

impl ProxyRequest

pub fn validate(&self) -> Result<(), BrokerError>

Validate provider identity and path shape. Fail closed on anything that could redirect a broker-owned credential.

pub fn post_json_exact( provider: impl Into<String>, path: impl Into<String>, body: Value, stream: bool, ) -> Result<(Self, Bytes), BrokerError>

Build a POST proxy request whose JSON body is serialized exactly once: the returned bytes::Bytes handle shares the same buffer stored in body_bytes (ref-counted clone, no copy), so a caller-side digest over it is a digest of the true wire body on the local-broker path. This is the sanctioned way to populate body_bytes — going through it makes a body/body_bytes semantic divergence unconstructible, and it never re-serializes on the release hot path.

pub fn with_account(self, account: &Account) -> Self

Pin the request to an explicit account slot (<provider>@<label> / <provider>@default), replacing any previous pin.

pub fn split_provider(&self) -> Result<(String, Option<Account>), BrokerError>

Split provider into the base provider key and the explicit account pin, validating the label. Static/local providers never carry a pin.

pub fn base_provider(&self) -> Result<String, BrokerError>

Base provider key without any account pin (after validation).

pub fn explicit_account(&self) -> Result<Option<Account>, BrokerError>

The explicit account pin, if any. None → the policy decides.

Trait Implementations

impl Clone for ProxyRequest

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ProxyRequest

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for ProxyRequest

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for ProxyRequest

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.