Module middleware 

Tower middleware helpers: timeouts, concurrency limits, body limits, authentication, tenant scoping, and tracing spans.

Each helper returns a single tower layer (or middleware function) that the server module composes into the axum router. Keeping the helpers thin makes them easy to reuse in integration tests and benchmarks where a custom stack is desired.

Structs

AuthConfig

Snapshot of authentication configuration loaded from the process environment at server start. Cloned cheaply into each request.

CorsConfig

Cross-origin policy snapshot loaded from the process environment.

KernelPublishTokens

Allowlist of bearer tokens permitted to call POST /kernels.

TenantConfig

Snapshot of tenant-header policy loaded from the process environment.

TrustedHosts

Parsed Host allowlist used by host_validate.

Constants

DEFAULT_CONCURRENCY_LIMIT

Default process-wide cap on in-flight requests. Retained for callers that want a single number; production deployments should prefer the per-route caps below.

DEFAULT_REQUEST_TIMEOUT

Default per-request timeout used by crate::server::build_router.

ENV_ALLOW_DEV_MODE

Environment variable that explicitly opts the gateway into dev mode (auth disabled, every request passes through with AuthContext::dev).

ENV_API_TOKENS

Environment variable carrying a comma-separated allowlist of bearer tokens accepted by bearer_auth. Empty / unset = dev mode pass-through (but only when ENV_ALLOW_DEV_MODE explicitly opts in — see below).

ENV_CORS_ALLOWED_ORIGINS

Environment variable carrying a comma-separated allowlist of origins permitted for cross-origin requests. Empty / unset = reject all cross-origin requests.

ENV_KERNEL_PUBLISH_TOKENS

Environment variable carrying a comma-separated allowlist of bearer tokens that are additionally permitted to call POST /kernels (the kernel-publish scope — see KernelPublishTokens).

ENV_REQUIRE_TENANT

Environment variable that, when set to 1, makes the X-TensorWasm-Tenant header mandatory. Otherwise its absence defaults to tenant 0.

ENV_TRUSTED_HOSTS

Environment variable that, when set, restricts the set of Host header values the server will accept. Comma-separated list of authority strings (e.g. api.example.com,api2.example.com:8443). Unset = accept any Host, which is the previous behaviour but is unsafe behind a layered proxy that may pass arbitrary Host values through.

HEADER_TENANT

Name of the header used to scope a request to a tenant.

INVOKE_CONCURRENCY_LIMIT

Concurrent /invoke ceiling. Tighter than the default because invokes hold a Wasmtime instance lock across call_async.

MAX_AUTH_HEADER_BYTES

Maximum byte length permitted for an inbound Authorization header value before bearer_auth will even attempt to parse it.

MAX_PATH_LEN

Maximum byte length that a request path is allowed to occupy in a tracing span attribute (see sanitize_path). Anything longer is truncated with a … suffix to keep operator log lines bounded and to deny a hostile client a cheap way to balloon every log record that touches their request.

MAX_REQUEST_BODY_BYTES

Maximum allowed inbound request body size, in bytes. 64 MiB.

PROBE_CONCURRENCY_LIMIT

Per-route concurrency caps (api S-26). A single global semaphore lets a probe storm starve /invoke; per-route caps isolate the budgets.

READ_CONCURRENCY_LIMIT

Concurrent read-route ceiling (GETs that are not probes).

WRITE_CONCURRENCY_LIMIT

Concurrent write-route ceiling (POST/PUT/DELETE excluding invoke).

Functions

bearer_auth

Bearer-token authentication middleware.

body_limit_layer

Build the global request-body size cap (64 MiB by default).

concurrency_limit_layer

Build a process-wide concurrency limit layer that allows at most max in-flight requests.

cors_layer

Build the CORS layer for the gateway router.

extract_tenant

Parse the X-TensorWasm-Tenant header into a TenantId, applying the configured policy.

host_validate

Middleware: reject requests whose Host header (or HTTP/2 :authority pseudo-header) is not in the configured allowlist.

normalize_method

Normalise an HTTP method name for use as a tracing span attribute.

sanitize_path

Render a request path as a bounded, log-safe string for use as a tracing span attribute.

tenant_scope

Middleware that resolves the tenant from X-TensorWasm-Tenant and stores it in the request’s axum::http::Extensions for handlers to pick up via Extension<TenantId>. On parse failure / required-but-missing, emits the standard error envelope and short-circuits the chain.

timeout_layer

Build a per-request timeout layer.

trace_layer

Build the default HTTP tracing layer.

trace_layer_with_propagation

Returns a TraceLayer that, in addition to the per-request span, reads the W3C traceparent header from the incoming request and uses it as the parent context for the resulting span.