feat: server foundation (phase 1 core) — state, auth, healthz/decoy, gateway dispatch, HttpAdapter
Tasks completed: server-core-types, server-auth, server-healthz-decoy, gateway-dispatch, server-adapter (5 of 17). - src/server/state.rs: DecoyConfig + RouterState (alkcall type paths, 6-endpoint reserved-path docs) - src/server/auth.rs: bearer middleware + ResolvedIdentity extractor (10 tests: missing/malformed/basic/failed-resolution matrix) - src/server/healthz.rs + decoy.rs: raw healthz; nginx-style 404, static site (path-traversal guarded), redirect decoys - src/gateway/dispatch.rs: GatewayDispatch invoke/invoke_streaming (internal:false, forwarded_for:None, bounded deadline) + src/gateway/error.rs: CallError→HTTP status mapping (HTTP_<status> passthrough, retryable→Retry-After) - src/server/adapter.rs: HttpAdapter ProtocolHandler — accept_bi → BiStream → TokioIo → hyper auto builder (h2 CONNECT enabled); integration tests over DuplexStream (request/response cycle, healthz, decoy 404) Verified: cargo test (46 lib tests), clippy -D warnings, fmt, test --all-features.
This commit is contained in:
@@ -0,0 +1,289 @@
|
||||
//! Shared dispatch spine for the `to_openapi` / `to_mcp` gateway
|
||||
//! projections.
|
||||
//!
|
||||
//! Thin concrete struct (not a trait — the alknet research ruled out a
|
||||
//! trait with an associated output type). Holds `Arc<OperationRegistry>`
|
||||
//! and `Arc<dyn IdentityProvider>` and exposes a `resolve_bearer()` and
|
||||
//! `invoke()` method pair returning the neutral `ResponseEnvelope`. Each
|
||||
//! gateway maps the envelope to its own wire shape (`to_openapi` → HTTP
|
||||
//! `Response`, `to_mcp` → `CallToolResult`).
|
||||
//!
|
||||
//! # Security invariants
|
||||
//!
|
||||
//! - `internal: false` — ACL runs against the caller's `identity`, not a
|
||||
//! handler's composition authority (alkcall ADR-017).
|
||||
//! - `forwarded_for: None` — wire-ingress only.
|
||||
//!
|
||||
//! The root `OperationContext` is constructed identically for both
|
||||
//! gateways, making them provably identical on the security axis (auth,
|
||||
//! authority, ACL); they diverge only on wire-framing.
|
||||
|
||||
use std::collections::HashMap;
|
||||
use std::sync::Arc;
|
||||
use std::time::{Duration, Instant};
|
||||
|
||||
use alkcall::core::auth::{AuthToken, Identity, IdentityProvider};
|
||||
use alkcall::core::types::Capabilities;
|
||||
use alkcall::protocol::wire::ResponseEnvelope;
|
||||
use alkcall::registry::context::{AbortPolicy, OperationContext, ScopedPeerEnv};
|
||||
use alkcall::registry::env::LocalOperationEnv;
|
||||
use alkcall::registry::registration::OperationRegistry;
|
||||
use futures::stream::BoxStream;
|
||||
use serde_json::Value;
|
||||
|
||||
const DEFAULT_TIMEOUT: Duration = Duration::from_secs(30);
|
||||
|
||||
pub struct GatewayDispatch {
|
||||
registry: Arc<OperationRegistry>,
|
||||
identity_provider: Arc<dyn IdentityProvider>,
|
||||
}
|
||||
|
||||
impl GatewayDispatch {
|
||||
pub fn new(
|
||||
registry: Arc<OperationRegistry>,
|
||||
identity_provider: Arc<dyn IdentityProvider>,
|
||||
) -> Self {
|
||||
Self {
|
||||
registry,
|
||||
identity_provider,
|
||||
}
|
||||
}
|
||||
|
||||
pub fn registry(&self) -> &Arc<OperationRegistry> {
|
||||
&self.registry
|
||||
}
|
||||
|
||||
pub fn identity_provider(&self) -> &Arc<dyn IdentityProvider> {
|
||||
&self.identity_provider
|
||||
}
|
||||
|
||||
pub fn resolve_bearer(&self, token: &AuthToken) -> Option<Identity> {
|
||||
self.identity_provider.resolve_from_token(token)
|
||||
}
|
||||
|
||||
pub async fn invoke(
|
||||
&self,
|
||||
identity: Option<Identity>,
|
||||
op: &str,
|
||||
input: Value,
|
||||
) -> ResponseEnvelope {
|
||||
let operation_name = strip_leading_slash(op).to_string();
|
||||
let request_id = uuid::Uuid::new_v4().to_string();
|
||||
let context = self.build_root_context(&request_id, &operation_name, identity);
|
||||
self.registry.invoke(&operation_name, input, context).await
|
||||
}
|
||||
|
||||
pub fn invoke_streaming(
|
||||
&self,
|
||||
identity: Option<Identity>,
|
||||
op: &str,
|
||||
input: Value,
|
||||
) -> BoxStream<'static, ResponseEnvelope> {
|
||||
let operation_name = strip_leading_slash(op).to_string();
|
||||
let request_id = uuid::Uuid::new_v4().to_string();
|
||||
let context = self.build_root_context_streaming(&request_id, &operation_name, identity);
|
||||
self.registry
|
||||
.invoke_streaming(&operation_name, input, context)
|
||||
}
|
||||
|
||||
fn build_root_context(
|
||||
&self,
|
||||
request_id: &str,
|
||||
operation_name: &str,
|
||||
identity: Option<Identity>,
|
||||
) -> OperationContext {
|
||||
self.build_root_context_inner(request_id, operation_name, identity, true)
|
||||
}
|
||||
|
||||
fn build_root_context_streaming(
|
||||
&self,
|
||||
request_id: &str,
|
||||
operation_name: &str,
|
||||
identity: Option<Identity>,
|
||||
) -> OperationContext {
|
||||
self.build_root_context_inner(request_id, operation_name, identity, false)
|
||||
}
|
||||
|
||||
fn build_root_context_inner(
|
||||
&self,
|
||||
request_id: &str,
|
||||
operation_name: &str,
|
||||
identity: Option<Identity>,
|
||||
bounded: bool,
|
||||
) -> OperationContext {
|
||||
let registration = self.registry.registration(operation_name);
|
||||
let (composition_authority, capabilities, scoped_env) = match registration {
|
||||
Some(r) => (
|
||||
r.composition_authority.clone(),
|
||||
r.capabilities.clone(),
|
||||
r.scoped_env.clone().unwrap_or_else(ScopedPeerEnv::empty),
|
||||
),
|
||||
None => (None, Capabilities::new(), ScopedPeerEnv::empty()),
|
||||
};
|
||||
|
||||
let env: Arc<dyn alkcall::registry::env::OperationEnv + Send + Sync> =
|
||||
Arc::new(LocalOperationEnv::new(Arc::clone(&self.registry)));
|
||||
|
||||
OperationContext {
|
||||
request_id: request_id.to_string(),
|
||||
parent_request_id: None,
|
||||
identity,
|
||||
handler_identity: composition_authority,
|
||||
forwarded_for: None,
|
||||
capabilities,
|
||||
metadata: HashMap::new(),
|
||||
deadline: bounded.then(|| Instant::now() + DEFAULT_TIMEOUT),
|
||||
scoped_env,
|
||||
env,
|
||||
abort_policy: AbortPolicy::default(),
|
||||
internal: false,
|
||||
ownership: None,
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
fn strip_leading_slash(operation_id: &str) -> &str {
|
||||
operation_id.strip_prefix('/').unwrap_or(operation_id)
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::*;
|
||||
use alkcall::registry::registration::{
|
||||
make_handler, make_streaming_handler, HandlerKind, HandlerRegistration, OperationProvenance,
|
||||
};
|
||||
use alkcall::registry::spec::{AccessControl, OperationSpec, OperationType, Visibility};
|
||||
use futures::StreamExt;
|
||||
use std::sync::Mutex as StdMutex;
|
||||
|
||||
struct StaticIdentityProvider {
|
||||
tokens: StdMutex<HashMap<String, Identity>>,
|
||||
}
|
||||
|
||||
impl StaticIdentityProvider {
|
||||
fn new() -> Self {
|
||||
Self {
|
||||
tokens: StdMutex::new(HashMap::new()),
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
impl IdentityProvider for StaticIdentityProvider {
|
||||
fn resolve_from_fingerprint(&self, _fp: &str) -> Option<Identity> {
|
||||
None
|
||||
}
|
||||
fn resolve_from_token(&self, token: &AuthToken) -> Option<Identity> {
|
||||
let token_str = String::from_utf8_lossy(&token.raw);
|
||||
self.tokens.lock().unwrap().get(token_str.as_ref()).cloned()
|
||||
}
|
||||
}
|
||||
|
||||
fn spec(name: &str, visibility: Visibility, op_type: OperationType) -> OperationSpec {
|
||||
OperationSpec::new(
|
||||
name,
|
||||
op_type,
|
||||
visibility,
|
||||
serde_json::json!({}),
|
||||
serde_json::json!({}),
|
||||
vec![],
|
||||
AccessControl::default(),
|
||||
None,
|
||||
)
|
||||
}
|
||||
|
||||
fn echo_registry() -> Arc<OperationRegistry> {
|
||||
let mut registry = OperationRegistry::new();
|
||||
registry
|
||||
.register(HandlerRegistration::new(
|
||||
spec("echo/run", Visibility::External, OperationType::Query),
|
||||
HandlerKind::Once(make_handler(|input, ctx| async move {
|
||||
ResponseEnvelope::ok(ctx.request_id, input)
|
||||
})),
|
||||
OperationProvenance::Local,
|
||||
None,
|
||||
None,
|
||||
Capabilities::new(),
|
||||
))
|
||||
.unwrap();
|
||||
Arc::new(registry)
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn invoke_external_op_round_trips() {
|
||||
let dispatch =
|
||||
GatewayDispatch::new(echo_registry(), Arc::new(StaticIdentityProvider::new()));
|
||||
let envelope = dispatch
|
||||
.invoke(None, "/echo/run", serde_json::json!({ "x": 1 }))
|
||||
.await;
|
||||
assert!(envelope.result.is_ok(), "expected ok, got {envelope:?}");
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn invoke_unknown_op_returns_not_found() {
|
||||
let dispatch =
|
||||
GatewayDispatch::new(echo_registry(), Arc::new(StaticIdentityProvider::new()));
|
||||
let envelope = dispatch
|
||||
.invoke(None, "/missing/op", serde_json::json!({}))
|
||||
.await;
|
||||
match envelope.result {
|
||||
Err(error) => assert_eq!(error.code, "NOT_FOUND"),
|
||||
Ok(v) => panic!("expected error, got {v:?}"),
|
||||
}
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn invoke_internal_op_returns_not_found() {
|
||||
let mut registry = OperationRegistry::new();
|
||||
registry
|
||||
.register(HandlerRegistration::new(
|
||||
spec("internal/op", Visibility::Internal, OperationType::Query),
|
||||
HandlerKind::Once(make_handler(|_input, ctx| async move {
|
||||
ResponseEnvelope::ok(ctx.request_id, serde_json::json!({}))
|
||||
})),
|
||||
OperationProvenance::Local,
|
||||
None,
|
||||
None,
|
||||
Capabilities::new(),
|
||||
))
|
||||
.unwrap();
|
||||
let dispatch =
|
||||
GatewayDispatch::new(Arc::new(registry), Arc::new(StaticIdentityProvider::new()));
|
||||
let envelope = dispatch
|
||||
.invoke(None, "/internal/op", serde_json::json!({}))
|
||||
.await;
|
||||
match envelope.result {
|
||||
Err(error) => assert_eq!(error.code, "NOT_FOUND"),
|
||||
Ok(v) => panic!("expected error, got {v:?}"),
|
||||
}
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn streaming_sub_op_streams_envelopes() {
|
||||
let mut registry = OperationRegistry::new();
|
||||
registry
|
||||
.register(HandlerRegistration::new(
|
||||
spec("tick/stream", Visibility::External, OperationType::Sub),
|
||||
HandlerKind::Stream(make_streaming_handler(|input, ctx| {
|
||||
let count = input.get("count").and_then(|v| v.as_u64()).unwrap_or(2);
|
||||
let request_id = ctx.request_id.clone();
|
||||
futures::stream::iter(0..count).map(move |i| {
|
||||
ResponseEnvelope::ok(request_id.clone(), serde_json::json!({ "tick": i }))
|
||||
})
|
||||
})),
|
||||
OperationProvenance::Local,
|
||||
None,
|
||||
None,
|
||||
Capabilities::new(),
|
||||
))
|
||||
.unwrap();
|
||||
let dispatch =
|
||||
GatewayDispatch::new(Arc::new(registry), Arc::new(StaticIdentityProvider::new()));
|
||||
let mut stream =
|
||||
dispatch.invoke_streaming(None, "/tick/stream", serde_json::json!({ "count": 3 }));
|
||||
let mut ticks = Vec::new();
|
||||
while let Some(envelope) = stream.next().await {
|
||||
ticks.push(envelope);
|
||||
}
|
||||
assert_eq!(ticks.len(), 3);
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,204 @@
|
||||
//! CallError → HTTP status/response mapping ([ADR-023]).
|
||||
//!
|
||||
//! Protocol-level vs operation-level code distinction: protocol codes
|
||||
//! (`NOT_FOUND`, `FORBIDDEN`, `INVALID_INPUT`, `TIMEOUT`, `INTERNAL`)
|
||||
//! map to fixed statuses; operation-level codes imported from external
|
||||
//! HTTP APIs are prefixed `HTTP_<status>` and map to their declared
|
||||
//! status.
|
||||
//!
|
||||
//! [ADR-023]: crate::docs
|
||||
|
||||
use alkcall::core::auth::Identity;
|
||||
use alkcall::protocol::wire::CallError;
|
||||
use axum::http::{header, HeaderValue, StatusCode};
|
||||
use axum::response::{IntoResponse, Json, Response};
|
||||
use serde_json::Value;
|
||||
|
||||
const PROTOCOL_CODE_NOT_FOUND: &str = "NOT_FOUND";
|
||||
const PROTOCOL_CODE_FORBIDDEN: &str = "FORBIDDEN";
|
||||
const PROTOCOL_CODE_INVALID_INPUT: &str = "INVALID_INPUT";
|
||||
const PROTOCOL_CODE_TIMEOUT: &str = "TIMEOUT";
|
||||
const PROTOCOL_CODE_INTERNAL: &str = "INTERNAL";
|
||||
|
||||
const HTTP_PREFIX: &str = "HTTP_";
|
||||
|
||||
const STATUS_NOT_FOUND: u16 = 404;
|
||||
const STATUS_UNAUTHORIZED: u16 = 401;
|
||||
const STATUS_FORBIDDEN: u16 = 403;
|
||||
const STATUS_UNPROCESSABLE: u16 = 422;
|
||||
const STATUS_TIMEOUT: u16 = 504;
|
||||
const STATUS_INTERNAL: u16 = 500;
|
||||
|
||||
const RETRY_AFTER_STATUSES: &[u16] = &[429, 503];
|
||||
|
||||
pub fn call_error_to_http_status(error: &CallError) -> u16 {
|
||||
call_error_to_http_status_with_identity(error, None)
|
||||
}
|
||||
|
||||
pub fn call_error_to_http_status_with_identity(
|
||||
error: &CallError,
|
||||
identity: Option<&Identity>,
|
||||
) -> u16 {
|
||||
match error.code.as_str() {
|
||||
PROTOCOL_CODE_NOT_FOUND => STATUS_NOT_FOUND,
|
||||
PROTOCOL_CODE_FORBIDDEN => {
|
||||
if identity.is_some() {
|
||||
STATUS_FORBIDDEN
|
||||
} else {
|
||||
STATUS_UNAUTHORIZED
|
||||
}
|
||||
}
|
||||
PROTOCOL_CODE_INVALID_INPUT => STATUS_UNPROCESSABLE,
|
||||
PROTOCOL_CODE_TIMEOUT => STATUS_TIMEOUT,
|
||||
PROTOCOL_CODE_INTERNAL => STATUS_INTERNAL,
|
||||
code if code.starts_with(HTTP_PREFIX) => code[HTTP_PREFIX.len()..]
|
||||
.parse::<u16>()
|
||||
.unwrap_or(STATUS_INTERNAL),
|
||||
_ => STATUS_INTERNAL,
|
||||
}
|
||||
}
|
||||
|
||||
pub fn call_error_to_http_response(error: &CallError) -> Response {
|
||||
let status_code = call_error_to_http_status(error);
|
||||
let status = status_code_from_u16(status_code);
|
||||
let body = serde_json::to_value(error).unwrap_or(Value::Null);
|
||||
|
||||
let retry_after = retry_after_value(error, status_code);
|
||||
|
||||
if let Some(retry_after) = retry_after {
|
||||
let header_value =
|
||||
HeaderValue::from_str(&retry_after).unwrap_or_else(|_| HeaderValue::from_static("0"));
|
||||
(status, [(header::RETRY_AFTER, header_value)], Json(body)).into_response()
|
||||
} else {
|
||||
(status, Json(body)).into_response()
|
||||
}
|
||||
}
|
||||
|
||||
fn status_code_from_u16(code: u16) -> StatusCode {
|
||||
StatusCode::from_u16(code).unwrap_or(StatusCode::INTERNAL_SERVER_ERROR)
|
||||
}
|
||||
|
||||
fn retry_after_value(error: &CallError, status_code: u16) -> Option<String> {
|
||||
if !error.retryable || !RETRY_AFTER_STATUSES.contains(&status_code) {
|
||||
return None;
|
||||
}
|
||||
error
|
||||
.details
|
||||
.as_ref()
|
||||
.and_then(|details| details.get("retry_after"))
|
||||
.and_then(Value::as_str)
|
||||
.map(|s| s.to_string())
|
||||
.or_else(|| {
|
||||
error
|
||||
.details
|
||||
.as_ref()
|
||||
.and_then(|details| details.get("retry_after"))
|
||||
.and_then(Value::as_u64)
|
||||
.map(|n| n.to_string())
|
||||
})
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::*;
|
||||
use std::collections::HashMap;
|
||||
|
||||
fn identity() -> Identity {
|
||||
Identity {
|
||||
id: "caller".to_string(),
|
||||
scopes: vec!["read".to_string()],
|
||||
resources: HashMap::new(),
|
||||
}
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn not_found_maps_to_404() {
|
||||
let error = CallError::not_found("fs/missing");
|
||||
assert_eq!(call_error_to_http_status(&error), 404);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn invalid_input_maps_to_422() {
|
||||
let error = CallError::invalid_input("bad input");
|
||||
assert_eq!(call_error_to_http_status(&error), 422);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn timeout_maps_to_504() {
|
||||
let error = CallError::timeout("timed out");
|
||||
assert_eq!(call_error_to_http_status(&error), 504);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn internal_maps_to_500() {
|
||||
let error = CallError::internal("boom");
|
||||
assert_eq!(call_error_to_http_status(&error), 500);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn forbidden_with_none_identity_maps_to_401() {
|
||||
let error = CallError::forbidden("auth required");
|
||||
assert_eq!(call_error_to_http_status_with_identity(&error, None), 401);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn forbidden_with_some_identity_maps_to_403() {
|
||||
let error = CallError::forbidden("insufficient scopes");
|
||||
let id = identity();
|
||||
assert_eq!(
|
||||
call_error_to_http_status_with_identity(&error, Some(&id)),
|
||||
403
|
||||
);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn http_prefixed_code_maps_to_declared_status() {
|
||||
let error = CallError::new("HTTP_404", "not found", false);
|
||||
assert_eq!(call_error_to_http_status(&error), 404);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn http_prefixed_code_with_unparseable_status_maps_to_500() {
|
||||
let error = CallError::new("HTTP_", "malformed", false);
|
||||
assert_eq!(call_error_to_http_status(&error), 500);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn unknown_domain_code_maps_to_500() {
|
||||
let error = CallError::new("DOMAIN_SPECIFIC", "domain error", false);
|
||||
assert_eq!(call_error_to_http_status(&error), 500);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn retryable_503_with_retry_after_details_sets_header() {
|
||||
let error = CallError::new("HTTP_503", "overloaded", true)
|
||||
.with_details(serde_json::json!({ "retry_after": "30" }));
|
||||
let resp = call_error_to_http_response(&error);
|
||||
assert_eq!(resp.status(), 503);
|
||||
let retry_after = resp
|
||||
.headers()
|
||||
.get(header::RETRY_AFTER)
|
||||
.map(|v| v.to_str().unwrap().to_string());
|
||||
assert_eq!(retry_after.as_deref(), Some("30"));
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn non_retryable_503_does_not_set_retry_after() {
|
||||
let error = CallError::new("HTTP_503", "overloaded", false)
|
||||
.with_details(serde_json::json!({ "retry_after": "30" }));
|
||||
let resp = call_error_to_http_response(&error);
|
||||
assert_eq!(resp.status(), 503);
|
||||
assert!(resp.headers().get(header::RETRY_AFTER).is_none());
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn error_body_serializes_the_call_error() {
|
||||
let error = CallError::not_found("fs/missing");
|
||||
let resp = call_error_to_http_response(&error);
|
||||
let bytes = futures::executor::block_on(axum::body::to_bytes(resp.into_body(), usize::MAX))
|
||||
.unwrap();
|
||||
let body: Value = serde_json::from_slice(&bytes).unwrap();
|
||||
assert_eq!(body["code"], "NOT_FOUND");
|
||||
assert_eq!(body["message"], "operation not found: fs/missing");
|
||||
}
|
||||
}
|
||||
@@ -1 +1,4 @@
|
||||
pub mod dispatch;
|
||||
pub mod error;
|
||||
|
||||
pub use dispatch::GatewayDispatch;
|
||||
|
||||
@@ -7,3 +7,5 @@ pub mod client;
|
||||
pub mod gateway;
|
||||
pub mod server;
|
||||
pub mod websocket;
|
||||
|
||||
pub use server::{decoy_fallback, healthz, DecoyConfig};
|
||||
|
||||
@@ -0,0 +1,361 @@
|
||||
//! `HttpAdapter` — `ProtocolHandler` for `h2`/`http/1.1` (axum over a
|
||||
//! `BiStream`).
|
||||
//!
|
||||
//! Wires the axum `Router` (gateway endpoints + `/healthz` +
|
||||
//! `/openapi.json` + MCP + custom routes + decoy fallback) and drives
|
||||
//! hyper's HTTP/1.1 or HTTP/2 connection driver over a single
|
||||
//! bidirectional stream yielded by `Connection::accept_bi()`. The WS
|
||||
//! upgrade route lands with the websocket subsystem; until then the
|
||||
//! router reserves `/alk/channels` for it.
|
||||
|
||||
use std::sync::Arc;
|
||||
|
||||
use alkcall::core::auth::AuthContext;
|
||||
use alkcall::core::types::{Connection, HandlerError, StreamError};
|
||||
use alkcall::registry::registration::OperationRegistry;
|
||||
use async_trait::async_trait;
|
||||
use axum::routing::get;
|
||||
use axum::Router;
|
||||
use hyper_util::rt::{TokioExecutor, TokioIo};
|
||||
use hyper_util::server::conn::auto::Builder as HyperBuilder;
|
||||
use hyper_util::service::TowerToHyperService;
|
||||
use tracing::error;
|
||||
|
||||
use super::auth::bearer_auth_middleware;
|
||||
use super::decoy::decoy_fallback;
|
||||
use super::healthz::healthz;
|
||||
use super::state::{DecoyConfig, RouterState};
|
||||
|
||||
pub const ALPN_HTTP1: &[u8] = b"http/1.1";
|
||||
pub const ALPN_H2: &[u8] = b"h2";
|
||||
|
||||
/// The WS upgrade path (ADR-067). Reserved in the default surface; the
|
||||
/// handler is wired by the websocket subsystem task.
|
||||
pub const WS_UPGRADE_PATH: &str = "/alk/channels";
|
||||
|
||||
/// Reserved default-surface paths (ADR-046 collision rule). Custom
|
||||
/// routes must not collide with these; the default surface wins.
|
||||
pub const RESERVED_PATHS: &[&str] = &[
|
||||
"/search",
|
||||
"/schema",
|
||||
"/call",
|
||||
"/batch",
|
||||
"/subscribe",
|
||||
"/publish",
|
||||
"/healthz",
|
||||
"/openapi.json",
|
||||
"/mcp",
|
||||
WS_UPGRADE_PATH,
|
||||
];
|
||||
|
||||
pub struct HttpAdapter {
|
||||
identity_provider: Arc<dyn alkcall::core::auth::IdentityProvider>,
|
||||
registry: Arc<OperationRegistry>,
|
||||
decoy: DecoyConfig,
|
||||
extra_routes: Option<Router>,
|
||||
alpn: &'static [u8],
|
||||
router: Router,
|
||||
}
|
||||
|
||||
impl HttpAdapter {
|
||||
pub fn new(
|
||||
identity_provider: Arc<dyn alkcall::core::auth::IdentityProvider>,
|
||||
registry: Arc<OperationRegistry>,
|
||||
) -> Self {
|
||||
Self::for_alpn(identity_provider, registry, ALPN_HTTP1)
|
||||
}
|
||||
|
||||
pub fn h2(
|
||||
identity_provider: Arc<dyn alkcall::core::auth::IdentityProvider>,
|
||||
registry: Arc<OperationRegistry>,
|
||||
) -> Self {
|
||||
Self::for_alpn(identity_provider, registry, ALPN_H2)
|
||||
}
|
||||
|
||||
fn for_alpn(
|
||||
identity_provider: Arc<dyn alkcall::core::auth::IdentityProvider>,
|
||||
registry: Arc<OperationRegistry>,
|
||||
alpn: &'static [u8],
|
||||
) -> Self {
|
||||
let decoy = DecoyConfig::default();
|
||||
let state = RouterState {
|
||||
registry: Arc::clone(®istry),
|
||||
identity_provider: Arc::clone(&identity_provider),
|
||||
decoy: decoy.clone(),
|
||||
};
|
||||
let router = build_router(state, None);
|
||||
Self {
|
||||
identity_provider,
|
||||
registry,
|
||||
decoy,
|
||||
extra_routes: None,
|
||||
alpn,
|
||||
router,
|
||||
}
|
||||
}
|
||||
|
||||
pub fn with_decoy(mut self, decoy: DecoyConfig) -> Self {
|
||||
self.decoy = decoy.clone();
|
||||
let state = RouterState {
|
||||
registry: Arc::clone(&self.registry),
|
||||
identity_provider: Arc::clone(&self.identity_provider),
|
||||
decoy,
|
||||
};
|
||||
self.router = build_router(state, self.extra_routes.take());
|
||||
self
|
||||
}
|
||||
|
||||
pub fn with_extra_routes(mut self, routes: Router) -> Self {
|
||||
let state = RouterState {
|
||||
registry: Arc::clone(&self.registry),
|
||||
identity_provider: Arc::clone(&self.identity_provider),
|
||||
decoy: self.decoy.clone(),
|
||||
};
|
||||
self.router = build_router(state, Some(routes.clone()));
|
||||
self.extra_routes = Some(routes);
|
||||
self
|
||||
}
|
||||
|
||||
pub fn decoy(&self) -> &DecoyConfig {
|
||||
&self.decoy
|
||||
}
|
||||
|
||||
pub fn alpn(&self) -> &'static [u8] {
|
||||
self.alpn
|
||||
}
|
||||
|
||||
pub fn router(&self) -> &Router {
|
||||
&self.router
|
||||
}
|
||||
}
|
||||
|
||||
fn build_router(state: RouterState, extra_routes: Option<Router>) -> Router {
|
||||
let auth_state = Arc::clone(&state.identity_provider);
|
||||
|
||||
let default: Router<RouterState> = Router::new()
|
||||
.route("/healthz", get(healthz))
|
||||
.route_layer(from_fn_with_state(
|
||||
auth_state.clone(),
|
||||
bearer_auth_middleware,
|
||||
))
|
||||
.fallback(decoy_fallback);
|
||||
|
||||
let with_extras = match extra_routes {
|
||||
Some(extra) => {
|
||||
let extra: Router<RouterState> = extra.with_state(());
|
||||
default.merge(extra)
|
||||
}
|
||||
None => default,
|
||||
};
|
||||
|
||||
with_extras.with_state(state)
|
||||
}
|
||||
|
||||
use axum::middleware::from_fn_with_state;
|
||||
|
||||
#[async_trait]
|
||||
impl alkcall::core::types::ProtocolHandler for HttpAdapter {
|
||||
fn alpn(&self) -> &'static [u8] {
|
||||
self.alpn
|
||||
}
|
||||
|
||||
async fn handle(&self, connection: Connection, auth: &AuthContext) -> Result<(), HandlerError> {
|
||||
if let Some(identity) = auth.identity.clone() {
|
||||
let _ = connection.set_identity(identity);
|
||||
}
|
||||
|
||||
let stream = connection
|
||||
.accept_bi()
|
||||
.await
|
||||
.map_err(stream_error_to_handler)?;
|
||||
self.serve_io(stream).await
|
||||
}
|
||||
}
|
||||
|
||||
impl HttpAdapter {
|
||||
async fn serve_io<I>(&self, io: I) -> Result<(), HandlerError>
|
||||
where
|
||||
I: tokio::io::AsyncRead + tokio::io::AsyncWrite + Send + Unpin + 'static,
|
||||
{
|
||||
let io = TokioIo::new(io);
|
||||
let service = TowerToHyperService::new(self.router.clone());
|
||||
|
||||
#[cfg_attr(not(feature = "h2"), allow(unused_mut))]
|
||||
let mut builder = HyperBuilder::new(TokioExecutor::new());
|
||||
#[cfg(feature = "h2")]
|
||||
{
|
||||
builder.http2().enable_connect_protocol();
|
||||
}
|
||||
|
||||
let conn = builder.serve_connection_with_upgrades(io, service);
|
||||
tokio::pin!(conn);
|
||||
|
||||
let result = (&mut conn).await;
|
||||
if let Err(e) = result {
|
||||
error!("http adapter: connection closed with error: {e}");
|
||||
}
|
||||
Ok(())
|
||||
}
|
||||
}
|
||||
|
||||
fn stream_error_to_handler(e: StreamError) -> HandlerError {
|
||||
HandlerError::from(e)
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::*;
|
||||
use alkcall::core::auth::IdentityProvider;
|
||||
use alkcall::core::types::ProtocolHandler;
|
||||
use tokio::io::{AsyncReadExt, AsyncWriteExt};
|
||||
|
||||
struct NoopProvider;
|
||||
impl IdentityProvider for NoopProvider {
|
||||
fn resolve_from_fingerprint(&self, _: &str) -> Option<alkcall::core::auth::Identity> {
|
||||
None
|
||||
}
|
||||
fn resolve_from_token(
|
||||
&self,
|
||||
_: &alkcall::core::auth::AuthToken,
|
||||
) -> Option<alkcall::core::auth::Identity> {
|
||||
None
|
||||
}
|
||||
}
|
||||
|
||||
fn empty_registry() -> Arc<OperationRegistry> {
|
||||
Arc::new(OperationRegistry::new())
|
||||
}
|
||||
|
||||
fn provider() -> Arc<dyn IdentityProvider> {
|
||||
Arc::new(NoopProvider)
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn alpn_returns_http1_for_default_new() {
|
||||
let adapter = HttpAdapter::new(provider(), empty_registry());
|
||||
assert_eq!(adapter.alpn(), ALPN_HTTP1);
|
||||
assert_eq!(adapter.alpn(), b"http/1.1");
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn alpn_returns_h2_for_h2_constructor() {
|
||||
let adapter = HttpAdapter::h2(provider(), empty_registry());
|
||||
assert_eq!(adapter.alpn(), ALPN_H2);
|
||||
assert_eq!(adapter.alpn(), b"h2");
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn decoy_config_default_is_not_found() {
|
||||
assert!(matches!(DecoyConfig::default(), DecoyConfig::NotFound));
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn with_decoy_updates_decoy() {
|
||||
let adapter = HttpAdapter::new(provider(), empty_registry());
|
||||
let adapter = adapter.with_decoy(DecoyConfig::Redirect {
|
||||
to: "https://example.com".to_string(),
|
||||
});
|
||||
assert!(matches!(adapter.decoy(), DecoyConfig::Redirect { .. }));
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn full_http_request_response_cycle_over_duplex() {
|
||||
let extra = Router::new().route("/v1/ping", get(|| async { "pong" }));
|
||||
let adapter = HttpAdapter::new(provider(), empty_registry()).with_extra_routes(extra);
|
||||
|
||||
let (client, server) = tokio::io::duplex(64 * 1024);
|
||||
let conn = Connection::from_bidi(server, b"http/1.1".to_vec(), None);
|
||||
let auth = AuthContext::anonymous(b"http/1.1");
|
||||
|
||||
let server_task =
|
||||
tokio::spawn(async move { ProtocolHandler::handle(&adapter, conn, &auth).await });
|
||||
|
||||
let mut client = client;
|
||||
client
|
||||
.write_all(b"GET /v1/ping HTTP/1.1\r\nHost: localhost\r\nConnection: close\r\n\r\n")
|
||||
.await
|
||||
.unwrap();
|
||||
|
||||
let mut response = Vec::new();
|
||||
let _ = tokio::time::timeout(
|
||||
std::time::Duration::from_secs(5),
|
||||
client.read_to_end(&mut response),
|
||||
)
|
||||
.await
|
||||
.expect("read timed out")
|
||||
.unwrap();
|
||||
|
||||
let text = String::from_utf8_lossy(&response);
|
||||
assert!(text.starts_with("HTTP/1.1 200 OK"), "got: {text}");
|
||||
assert!(text.contains("pong"), "got: {text}");
|
||||
|
||||
let _ = server_task.await;
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn healthz_served_by_the_adapter_over_duplex() {
|
||||
let adapter = HttpAdapter::new(provider(), empty_registry());
|
||||
let (client, server) = tokio::io::duplex(64 * 1024);
|
||||
let conn = Connection::from_bidi(server, b"http/1.1".to_vec(), None);
|
||||
let auth = AuthContext::anonymous(b"http/1.1");
|
||||
let server_task = tokio::spawn(async move {
|
||||
let _ = ProtocolHandler::handle(&adapter, conn, &auth).await;
|
||||
});
|
||||
|
||||
let mut client = client;
|
||||
client
|
||||
.write_all(b"GET /healthz HTTP/1.1\r\nHost: localhost\r\nConnection: close\r\n\r\n")
|
||||
.await
|
||||
.unwrap();
|
||||
|
||||
let mut response = Vec::new();
|
||||
let _ = tokio::time::timeout(
|
||||
std::time::Duration::from_secs(5),
|
||||
client.read_to_end(&mut response),
|
||||
)
|
||||
.await
|
||||
.expect("read timed out")
|
||||
.unwrap();
|
||||
|
||||
let text = String::from_utf8_lossy(&response);
|
||||
assert!(text.starts_with("HTTP/1.1 200 OK"), "got: {text}");
|
||||
assert!(text.contains("ok"), "got: {text}");
|
||||
|
||||
let _ = server_task.await;
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn unknown_path_serves_decoy_404_over_duplex() {
|
||||
let adapter = HttpAdapter::new(provider(), empty_registry());
|
||||
let (client, server) = tokio::io::duplex(64 * 1024);
|
||||
let conn = Connection::from_bidi(server, b"http/1.1".to_vec(), None);
|
||||
let auth = AuthContext::anonymous(b"http/1.1");
|
||||
let server_task = tokio::spawn(async move {
|
||||
let _ = ProtocolHandler::handle(&adapter, conn, &auth).await;
|
||||
});
|
||||
|
||||
let mut client = client;
|
||||
client
|
||||
.write_all(b"GET /nowhere HTTP/1.1\r\nHost: localhost\r\nConnection: close\r\n\r\n")
|
||||
.await
|
||||
.unwrap();
|
||||
|
||||
let mut response = Vec::new();
|
||||
let _ = tokio::time::timeout(
|
||||
std::time::Duration::from_secs(5),
|
||||
client.read_to_end(&mut response),
|
||||
)
|
||||
.await
|
||||
.expect("read timed out")
|
||||
.unwrap();
|
||||
|
||||
let text = String::from_utf8_lossy(&response);
|
||||
assert!(text.starts_with("HTTP/1.1 404 Not Found"), "got: {text}");
|
||||
assert!(
|
||||
text.contains("nginx"),
|
||||
"decoy should look like nginx: {text}"
|
||||
);
|
||||
|
||||
let _ = server_task.await;
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,305 @@
|
||||
//! Shared Bearer auth axum middleware ([ADR-004]).
|
||||
//!
|
||||
//! Resolves the `Authorization: Bearer` header via
|
||||
//! `IdentityProvider::resolve_from_token()` and stashes the resolved
|
||||
//! `Option<Identity>` in request extensions. Shared by the HTTP gateway
|
||||
//! endpoints and the `to_mcp` service.
|
||||
//!
|
||||
//! Resolution semantics:
|
||||
//! - No `Authorization` header → `None` (request proceeds; the route
|
||||
//! handler / `AccessControl` decides whether to reject).
|
||||
//! - Malformed `Authorization` header (not `Bearer <token>`) → `None`
|
||||
//! (treated as no-token, not an error — Bearer-only is the auth
|
||||
//! mechanism).
|
||||
//! - Token present but resolution fails → `None` (treat as
|
||||
//! unauthenticated, matching the call protocol's per-request identity
|
||||
//! resolution behavior).
|
||||
//!
|
||||
//! This middleware resolves identity and stashes it; it does NOT enforce
|
||||
//! `AccessControl` (the route handlers / `GatewayDispatch::invoke()` do)
|
||||
//! or map `CallError` codes to HTTP status (the error mapping does).
|
||||
//!
|
||||
//! [ADR-004]: crate::docs
|
||||
|
||||
use std::convert::Infallible;
|
||||
use std::sync::Arc;
|
||||
|
||||
use alkcall::core::auth::{AuthToken, Identity, IdentityProvider};
|
||||
use axum::extract::{FromRequestParts, Request, State};
|
||||
use axum::http::header::AUTHORIZATION;
|
||||
use axum::middleware::Next;
|
||||
use axum::response::Response;
|
||||
use http::request::Parts;
|
||||
|
||||
/// Axum middleware that resolves the `Authorization: Bearer` header via
|
||||
/// `IdentityProvider::resolve_from_token()` and stashes the resolved
|
||||
/// `Option<Identity>` in request extensions.
|
||||
///
|
||||
/// The state is `Arc<dyn IdentityProvider>` so the middleware can be applied
|
||||
/// via `middleware::from_fn_with_state(idp.clone(), bearer_auth_middleware)`
|
||||
/// around both HTTP routes and a nested service.
|
||||
pub async fn bearer_auth_middleware(
|
||||
State(identity_provider): State<Arc<dyn IdentityProvider>>,
|
||||
mut request: Request,
|
||||
next: Next,
|
||||
) -> Response {
|
||||
let identity = extract_bearer_identity(&request, identity_provider.as_ref());
|
||||
request.extensions_mut().insert(identity);
|
||||
next.run(request).await
|
||||
}
|
||||
|
||||
/// Extract the `Authorization: Bearer <token>` header and resolve it to
|
||||
/// an `Option<Identity>`. Returns `None` if no token is present (the
|
||||
/// request proceeds unauthenticated; the route handler / `AccessControl`
|
||||
/// decides whether to reject). Returns `None` if the token is present
|
||||
/// but resolution fails (treat as unauthenticated, not as an error —
|
||||
/// matches the call protocol's per-request identity resolution behavior).
|
||||
pub fn extract_bearer_identity(
|
||||
request: &Request,
|
||||
identity_provider: &dyn IdentityProvider,
|
||||
) -> Option<Identity> {
|
||||
let header = request.headers().get(AUTHORIZATION)?;
|
||||
let token_str = header.to_str().ok()?.strip_prefix("Bearer ")?;
|
||||
let token = AuthToken {
|
||||
raw: token_str.as_bytes().to_vec(),
|
||||
};
|
||||
identity_provider.resolve_from_token(&token)
|
||||
}
|
||||
|
||||
/// Axum extractor: the resolved bearer identity (or `None` if
|
||||
/// unauthenticated). Read from request extensions (stashed by
|
||||
/// `bearer_auth_middleware`).
|
||||
#[derive(Clone, Debug)]
|
||||
pub struct ResolvedIdentity(pub Option<Identity>);
|
||||
|
||||
impl<S> FromRequestParts<S> for ResolvedIdentity
|
||||
where
|
||||
S: Send + Sync,
|
||||
{
|
||||
type Rejection = Infallible;
|
||||
|
||||
async fn from_request_parts(parts: &mut Parts, _state: &S) -> Result<Self, Self::Rejection> {
|
||||
let identity = parts
|
||||
.extensions
|
||||
.get::<Option<Identity>>()
|
||||
.cloned()
|
||||
.flatten();
|
||||
Ok(ResolvedIdentity(identity))
|
||||
}
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::*;
|
||||
use axum::body::Body;
|
||||
use axum::http::{Request as AxumRequest, StatusCode};
|
||||
use axum::middleware::from_fn_with_state;
|
||||
use axum::routing::get;
|
||||
use axum::Router;
|
||||
use std::collections::HashMap;
|
||||
use tower::ServiceExt;
|
||||
|
||||
fn sample_identity() -> Identity {
|
||||
Identity {
|
||||
id: "worker-a".to_string(),
|
||||
scopes: vec!["relay:connect".to_string()],
|
||||
resources: HashMap::new(),
|
||||
}
|
||||
}
|
||||
|
||||
struct StaticProvider {
|
||||
identity: Option<Identity>,
|
||||
}
|
||||
|
||||
impl IdentityProvider for StaticProvider {
|
||||
fn resolve_from_fingerprint(&self, _: &str) -> Option<Identity> {
|
||||
None
|
||||
}
|
||||
fn resolve_from_token(&self, _: &AuthToken) -> Option<Identity> {
|
||||
self.identity.clone()
|
||||
}
|
||||
}
|
||||
|
||||
fn provider(identity: Option<Identity>) -> Arc<dyn IdentityProvider> {
|
||||
Arc::new(StaticProvider { identity })
|
||||
}
|
||||
|
||||
fn request_with_authorization(value: Option<&str>) -> Request {
|
||||
let mut builder = AxumRequest::builder();
|
||||
if let Some(v) = value {
|
||||
builder = builder.header(AUTHORIZATION, v);
|
||||
}
|
||||
builder.body(Body::empty()).unwrap()
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn extract_returns_some_for_valid_bearer_when_provider_resolves() {
|
||||
let idp = provider(Some(sample_identity()));
|
||||
let req = request_with_authorization(Some("Bearer alk_testsecret"));
|
||||
let identity = extract_bearer_identity(&req, idp.as_ref());
|
||||
assert!(identity.is_some());
|
||||
assert_eq!(identity.unwrap().id, "worker-a");
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn extract_returns_none_for_missing_authorization_header() {
|
||||
let idp = provider(Some(sample_identity()));
|
||||
let req = request_with_authorization(None);
|
||||
let identity = extract_bearer_identity(&req, idp.as_ref());
|
||||
assert!(identity.is_none());
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn extract_returns_none_for_malformed_authorization_header() {
|
||||
let idp = provider(Some(sample_identity()));
|
||||
let req = request_with_authorization(Some("not-a-bearer-scheme"));
|
||||
let identity = extract_bearer_identity(&req, idp.as_ref());
|
||||
assert!(identity.is_none());
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn extract_returns_none_for_basic_auth_bearer_only() {
|
||||
let idp = provider(Some(sample_identity()));
|
||||
let req = request_with_authorization(Some("Basic dXNlcjpwYXNz"));
|
||||
let identity = extract_bearer_identity(&req, idp.as_ref());
|
||||
assert!(identity.is_none());
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn extract_returns_none_when_token_present_but_resolution_fails() {
|
||||
let idp = provider(None);
|
||||
let req = request_with_authorization(Some("Bearer alk_unknown"));
|
||||
let identity = extract_bearer_identity(&req, idp.as_ref());
|
||||
assert!(identity.is_none());
|
||||
}
|
||||
|
||||
async fn run_middleware(idp: Arc<dyn IdentityProvider>, request: Request) -> Response {
|
||||
let app: Router<()> = Router::new()
|
||||
.route(
|
||||
"/",
|
||||
get(|req: Request| async move {
|
||||
let identity = req
|
||||
.extensions()
|
||||
.get::<Option<Identity>>()
|
||||
.cloned()
|
||||
.flatten();
|
||||
if let Some(id) = identity {
|
||||
(StatusCode::OK, id.id)
|
||||
} else {
|
||||
(StatusCode::OK, "none".to_string())
|
||||
}
|
||||
}),
|
||||
)
|
||||
.layer(from_fn_with_state(idp, bearer_auth_middleware));
|
||||
|
||||
app.oneshot(request).await.unwrap()
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn middleware_stashes_some_identity_for_valid_bearer() {
|
||||
let idp = provider(Some(sample_identity()));
|
||||
let req = request_with_authorization(Some("Bearer alk_testsecret"));
|
||||
let response = run_middleware(idp, req).await;
|
||||
assert_eq!(response.status(), StatusCode::OK);
|
||||
let bytes = axum::body::to_bytes(response.into_body(), usize::MAX)
|
||||
.await
|
||||
.unwrap();
|
||||
assert_eq!(&bytes[..], b"worker-a");
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn middleware_stashes_none_when_no_authorization_header() {
|
||||
let idp = provider(Some(sample_identity()));
|
||||
let req = request_with_authorization(None);
|
||||
let response = run_middleware(idp, req).await;
|
||||
assert_eq!(response.status(), StatusCode::OK);
|
||||
let bytes = axum::body::to_bytes(response.into_body(), usize::MAX)
|
||||
.await
|
||||
.unwrap();
|
||||
assert_eq!(&bytes[..], b"none");
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn middleware_stashes_none_for_malformed_authorization() {
|
||||
let idp = provider(Some(sample_identity()));
|
||||
let req = request_with_authorization(Some("garbage"));
|
||||
let response = run_middleware(idp, req).await;
|
||||
assert_eq!(response.status(), StatusCode::OK);
|
||||
let bytes = axum::body::to_bytes(response.into_body(), usize::MAX)
|
||||
.await
|
||||
.unwrap();
|
||||
assert_eq!(&bytes[..], b"none");
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn middleware_stashes_none_for_basic_auth() {
|
||||
let idp = provider(Some(sample_identity()));
|
||||
let req = request_with_authorization(Some("Basic dXNlcjpwYXNz"));
|
||||
let response = run_middleware(idp, req).await;
|
||||
assert_eq!(response.status(), StatusCode::OK);
|
||||
let bytes = axum::body::to_bytes(response.into_body(), usize::MAX)
|
||||
.await
|
||||
.unwrap();
|
||||
assert_eq!(&bytes[..], b"none");
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn middleware_stashes_none_when_resolution_fails() {
|
||||
let idp = provider(None);
|
||||
let req = request_with_authorization(Some("Bearer alk_unknown"));
|
||||
let response = run_middleware(idp, req).await;
|
||||
assert_eq!(response.status(), StatusCode::OK);
|
||||
let bytes = axum::body::to_bytes(response.into_body(), usize::MAX)
|
||||
.await
|
||||
.unwrap();
|
||||
assert_eq!(&bytes[..], b"none");
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn resolved_identity_extractor_retrieves_stashed_some() {
|
||||
let idp = provider(Some(sample_identity()));
|
||||
let app: Router<()> = Router::new()
|
||||
.route(
|
||||
"/",
|
||||
get(|ResolvedIdentity(identity): ResolvedIdentity| async move {
|
||||
match identity {
|
||||
Some(id) => (StatusCode::OK, id.id),
|
||||
None => (StatusCode::OK, "none".to_string()),
|
||||
}
|
||||
}),
|
||||
)
|
||||
.layer(from_fn_with_state(idp, bearer_auth_middleware));
|
||||
|
||||
let req = request_with_authorization(Some("Bearer alk_testsecret"));
|
||||
let response = app.oneshot(req).await.unwrap();
|
||||
assert_eq!(response.status(), StatusCode::OK);
|
||||
let bytes = axum::body::to_bytes(response.into_body(), usize::MAX)
|
||||
.await
|
||||
.unwrap();
|
||||
assert_eq!(&bytes[..], b"worker-a");
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn resolved_identity_extractor_retrieves_stashed_none() {
|
||||
let idp = provider(Some(sample_identity()));
|
||||
let app: Router<()> = Router::new()
|
||||
.route(
|
||||
"/",
|
||||
get(|ResolvedIdentity(identity): ResolvedIdentity| async move {
|
||||
match identity {
|
||||
Some(id) => (StatusCode::OK, id.id),
|
||||
None => (StatusCode::OK, "none".to_string()),
|
||||
}
|
||||
}),
|
||||
)
|
||||
.layer(from_fn_with_state(idp, bearer_auth_middleware));
|
||||
|
||||
let req = request_with_authorization(None);
|
||||
let response = app.oneshot(req).await.unwrap();
|
||||
assert_eq!(response.status(), StatusCode::OK);
|
||||
let bytes = axum::body::to_bytes(response.into_body(), usize::MAX)
|
||||
.await
|
||||
.unwrap();
|
||||
assert_eq!(&bytes[..], b"none");
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,290 @@
|
||||
//! Stealth decoy fallback for unknown paths ([ADR-010], [ADR-036]).
|
||||
//!
|
||||
//! For paths not matched by the default surface (the 6 gateway
|
||||
//! endpoints, `/healthz`, `/openapi.json`, the MCP route, the WS
|
||||
//! upgrade) nor by a custom route ([ADR-046]), the HTTP handler serves
|
||||
//! a configurable decoy ([`DecoyConfig`]): a fake nginx-style 404 (the
|
||||
//! default), a static site served from a directory, or a redirect. The
|
||||
//! decoy must not leak alk presence — no alk-specific headers, no alk
|
||||
//! error format.
|
||||
//!
|
||||
//! [ADR-010]: crate::docs
|
||||
//! [ADR-036]: crate::docs
|
||||
//! [ADR-046]: crate::docs
|
||||
|
||||
use std::path::{Component, Path, PathBuf};
|
||||
|
||||
use axum::body::Body;
|
||||
use axum::extract::{Request, State};
|
||||
use axum::http::{header, HeaderValue, StatusCode};
|
||||
use axum::response::Response;
|
||||
|
||||
use super::DecoyConfig;
|
||||
|
||||
pub async fn decoy_fallback(State(decoy): State<DecoyConfig>, request: Request) -> Response {
|
||||
match decoy {
|
||||
DecoyConfig::NotFound => fake_nginx_404(),
|
||||
DecoyConfig::StaticSite { root } => serve_static(&root, request).await,
|
||||
DecoyConfig::Redirect { to } => redirect(&to),
|
||||
}
|
||||
}
|
||||
|
||||
pub fn fake_nginx_404() -> Response {
|
||||
let body = nginx_404_body();
|
||||
let mut resp = Response::new(Body::from(body));
|
||||
*resp.status_mut() = StatusCode::NOT_FOUND;
|
||||
resp.headers_mut().insert(
|
||||
header::CONTENT_TYPE,
|
||||
HeaderValue::from_static("text/html; charset=utf-8"),
|
||||
);
|
||||
resp.headers_mut()
|
||||
.insert(header::SERVER, HeaderValue::from_static("nginx"));
|
||||
resp
|
||||
}
|
||||
|
||||
pub fn redirect(to: &str) -> Response {
|
||||
let mut resp = Response::new(Body::empty());
|
||||
*resp.status_mut() = StatusCode::FOUND;
|
||||
if let Ok(value) = HeaderValue::from_str(to) {
|
||||
resp.headers_mut().insert(header::LOCATION, value);
|
||||
}
|
||||
resp
|
||||
}
|
||||
|
||||
pub async fn serve_static(root: &Path, request: Request) -> Response {
|
||||
let path = request.uri().path();
|
||||
let resolved = match resolve_static_path(root, path) {
|
||||
Some(p) => p,
|
||||
None => return fake_nginx_404(),
|
||||
};
|
||||
|
||||
match tokio::fs::read(&resolved).await {
|
||||
Ok(bytes) => {
|
||||
let content_type = mime_for_path(&resolved);
|
||||
let mut resp = Response::new(Body::from(bytes));
|
||||
*resp.status_mut() = StatusCode::OK;
|
||||
resp.headers_mut()
|
||||
.insert(header::CONTENT_TYPE, HeaderValue::from_static(content_type));
|
||||
resp
|
||||
}
|
||||
Err(_) => fake_nginx_404(),
|
||||
}
|
||||
}
|
||||
|
||||
fn resolve_static_path(root: &Path, request_path: &str) -> Option<PathBuf> {
|
||||
let trimmed = request_path.trim_start_matches('/');
|
||||
let relative = if trimmed.is_empty() {
|
||||
PathBuf::from("index.html")
|
||||
} else {
|
||||
let decoded = percent_decode(trimmed);
|
||||
PathBuf::from(decoded)
|
||||
};
|
||||
|
||||
let mut safe = PathBuf::new();
|
||||
for component in relative.components() {
|
||||
match component {
|
||||
Component::Normal(part) => safe.push(part),
|
||||
Component::CurDir => {}
|
||||
Component::ParentDir | Component::RootDir | Component::Prefix(_) => return None,
|
||||
}
|
||||
}
|
||||
|
||||
if safe.as_os_str().is_empty() {
|
||||
return None;
|
||||
}
|
||||
|
||||
let full = root.join(&safe);
|
||||
if full.is_dir() {
|
||||
return Some(full.join("index.html"));
|
||||
}
|
||||
if full.is_file() {
|
||||
return Some(full);
|
||||
}
|
||||
None
|
||||
}
|
||||
|
||||
fn percent_decode(input: &str) -> String {
|
||||
let mut out = String::with_capacity(input.len());
|
||||
let bytes = input.as_bytes();
|
||||
let mut i = 0;
|
||||
while i < bytes.len() {
|
||||
let b = bytes[i];
|
||||
if b == b'%' && i + 2 < bytes.len() {
|
||||
if let (Some(h), Some(l)) = (hex_digit(bytes[i + 1]), hex_digit(bytes[i + 2])) {
|
||||
out.push(((h << 4) | l) as char);
|
||||
i += 3;
|
||||
continue;
|
||||
}
|
||||
} else if b == b'+' {
|
||||
out.push(' ');
|
||||
i += 1;
|
||||
continue;
|
||||
}
|
||||
out.push(b as char);
|
||||
i += 1;
|
||||
}
|
||||
out
|
||||
}
|
||||
|
||||
fn hex_digit(b: u8) -> Option<u8> {
|
||||
match b {
|
||||
b'0'..=b'9' => Some(b - b'0'),
|
||||
b'a'..=b'f' => Some(b - b'a' + 10),
|
||||
b'A'..=b'F' => Some(b - b'A' + 10),
|
||||
_ => None,
|
||||
}
|
||||
}
|
||||
|
||||
fn mime_for_path(path: &Path) -> &'static str {
|
||||
match path.extension().and_then(|e| e.to_str()) {
|
||||
Some("html") | Some("htm") => "text/html; charset=utf-8",
|
||||
Some("css") => "text/css; charset=utf-8",
|
||||
Some("js") => "application/javascript",
|
||||
Some("json") => "application/json",
|
||||
Some("png") => "image/png",
|
||||
Some("jpg") | Some("jpeg") => "image/jpeg",
|
||||
Some("gif") => "image/gif",
|
||||
Some("svg") => "image/svg+xml",
|
||||
Some("txt") => "text/plain; charset=utf-8",
|
||||
Some("ico") => "image/x-icon",
|
||||
Some("woff") => "font/woff",
|
||||
Some("woff2") => "font/woff2",
|
||||
_ => "application/octet-stream",
|
||||
}
|
||||
}
|
||||
|
||||
fn nginx_404_body() -> String {
|
||||
"<html>\r\n<head><title>404 Not Found</title></head>\r\n<body>\r\n<center><h1>404 Not Found</h1></center>\r\n<hr><center>nginx</center>\r\n</body>\r\n</html>\r\n".to_string()
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::*;
|
||||
use axum::body::Body;
|
||||
use axum::http::Request;
|
||||
use http_body_util::BodyExt;
|
||||
|
||||
fn decoy_router(decoy: DecoyConfig) -> axum::Router {
|
||||
axum::Router::new()
|
||||
.fallback(decoy_fallback)
|
||||
.with_state(decoy)
|
||||
}
|
||||
|
||||
async fn send(router: axum::Router, uri: &str) -> axum::response::Response {
|
||||
tower::ServiceExt::<Request<Body>>::oneshot(
|
||||
router,
|
||||
Request::builder().uri(uri).body(Body::empty()).unwrap(),
|
||||
)
|
||||
.await
|
||||
.unwrap()
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn unknown_path_with_not_found_decoy_returns_404() {
|
||||
let resp = send(decoy_router(DecoyConfig::NotFound), "/nonexistent").await;
|
||||
assert_eq!(resp.status(), StatusCode::NOT_FOUND);
|
||||
let server = resp
|
||||
.headers()
|
||||
.get(header::SERVER)
|
||||
.map(|v| v.to_str().unwrap().to_string());
|
||||
assert_eq!(server.as_deref(), Some("nginx"));
|
||||
let bytes = resp.into_body().collect().await.unwrap().to_bytes();
|
||||
let body = String::from_utf8_lossy(&bytes);
|
||||
assert!(!body.contains("alk"));
|
||||
assert!(body.contains("404 Not Found"));
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn unknown_path_with_redirect_decoy_returns_redirect() {
|
||||
let decoy = DecoyConfig::Redirect {
|
||||
to: "https://example.com".to_string(),
|
||||
};
|
||||
let resp = send(decoy_router(decoy), "/anything").await;
|
||||
assert_eq!(resp.status(), StatusCode::FOUND);
|
||||
let location = resp
|
||||
.headers()
|
||||
.get(header::LOCATION)
|
||||
.map(|v| v.to_str().unwrap().to_string());
|
||||
assert_eq!(location.as_deref(), Some("https://example.com"));
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn unknown_path_with_static_site_decoy_serves_file() {
|
||||
let dir = tempfile_dir();
|
||||
let file = dir.join("index.html");
|
||||
tokio::fs::write(&file, "<h1>hello</h1>").await.unwrap();
|
||||
|
||||
let decoy = DecoyConfig::StaticSite { root: dir.clone() };
|
||||
let resp = send(decoy_router(decoy), "/").await;
|
||||
assert_eq!(resp.status(), StatusCode::OK);
|
||||
let ctype = resp
|
||||
.headers()
|
||||
.get(header::CONTENT_TYPE)
|
||||
.map(|v| v.to_str().unwrap().to_string());
|
||||
assert!(ctype.as_deref().unwrap_or("").starts_with("text/html"));
|
||||
let bytes = resp.into_body().collect().await.unwrap().to_bytes();
|
||||
assert_eq!(&bytes[..], b"<h1>hello</h1>");
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn static_site_decoy_serves_named_file() {
|
||||
let dir = tempfile_dir();
|
||||
tokio::fs::write(dir.join("about.html"), "<p>about</p>")
|
||||
.await
|
||||
.unwrap();
|
||||
|
||||
let decoy = DecoyConfig::StaticSite { root: dir };
|
||||
let resp = send(decoy_router(decoy), "/about.html").await;
|
||||
assert_eq!(resp.status(), StatusCode::OK);
|
||||
let bytes = resp.into_body().collect().await.unwrap().to_bytes();
|
||||
assert_eq!(&bytes[..], b"<p>about</p>");
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn static_site_decoy_missing_file_returns_fake_404() {
|
||||
let dir = tempfile_dir();
|
||||
let decoy = DecoyConfig::StaticSite { root: dir };
|
||||
let resp = send(decoy_router(decoy), "/missing.txt").await;
|
||||
assert_eq!(resp.status(), StatusCode::NOT_FOUND);
|
||||
let server = resp
|
||||
.headers()
|
||||
.get(header::SERVER)
|
||||
.map(|v| v.to_str().unwrap().to_string());
|
||||
assert_eq!(server.as_deref(), Some("nginx"));
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn static_site_decoy_path_traversal_is_blocked() {
|
||||
let dir = tempfile_dir();
|
||||
tokio::fs::write(dir.join("index.html"), "ok")
|
||||
.await
|
||||
.unwrap();
|
||||
tokio::fs::write(dir.join("secret.txt"), "secret")
|
||||
.await
|
||||
.unwrap();
|
||||
|
||||
let decoy = DecoyConfig::StaticSite { root: dir };
|
||||
let resp = send(decoy_router(decoy), "/../secret.txt").await;
|
||||
assert_eq!(resp.status(), StatusCode::NOT_FOUND);
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn not_found_decoy_does_not_leak_alk_headers() {
|
||||
let resp = send(decoy_router(DecoyConfig::NotFound), "/whatever").await;
|
||||
for (name, value) in resp.headers().iter() {
|
||||
let name = name.as_str().to_lowercase();
|
||||
let value = value.to_str().unwrap_or("");
|
||||
assert!(
|
||||
!name.contains("alkhttp") && !value.contains("alkhttp"),
|
||||
"decoy leaked alkhttp: {name}={value}"
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
fn tempfile_dir() -> PathBuf {
|
||||
let dir =
|
||||
PathBuf::from("/tmp").join(format!("alkhttp-decoy-test-{}", uuid::Uuid::new_v4()));
|
||||
std::fs::create_dir_all(&dir).unwrap();
|
||||
dir
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,61 @@
|
||||
//! `GET /healthz` — the one raw HTTP route (ADR-036).
|
||||
//!
|
||||
//! No auth, no call protocol, no `OperationContext`. Returns `200 OK`
|
||||
//! with a plain-text body (`"ok"`). The infrastructure endpoint load
|
||||
//! balancers and orchestrators call; it must work before identity is
|
||||
//! resolvable.
|
||||
|
||||
use axum::http::{header, HeaderValue, StatusCode};
|
||||
use axum::response::IntoResponse;
|
||||
|
||||
const HEALTHZ_BODY: &str = "ok";
|
||||
|
||||
pub async fn healthz() -> impl IntoResponse {
|
||||
(
|
||||
StatusCode::OK,
|
||||
[(header::CONTENT_TYPE, HeaderValue::from_static("text/plain"))],
|
||||
HEALTHZ_BODY,
|
||||
)
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::*;
|
||||
use axum::body::Body;
|
||||
use axum::http::Request;
|
||||
use http_body_util::BodyExt;
|
||||
|
||||
async fn call_healthz(req: Request<Body>) -> axum::response::Response {
|
||||
let app = axum::Router::new().route("/healthz", axum::routing::get(healthz));
|
||||
tower::ServiceExt::<Request<Body>>::oneshot(app, req)
|
||||
.await
|
||||
.unwrap()
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn healthz_handler_returns_200_with_plain_text_ok() {
|
||||
let req = Request::builder()
|
||||
.uri("/healthz")
|
||||
.body(Body::empty())
|
||||
.unwrap();
|
||||
let resp = call_healthz(req).await;
|
||||
assert_eq!(resp.status(), StatusCode::OK);
|
||||
let ctype = resp
|
||||
.headers()
|
||||
.get(header::CONTENT_TYPE)
|
||||
.map(|v| v.to_str().unwrap().to_string());
|
||||
assert_eq!(ctype.as_deref(), Some("text/plain"));
|
||||
let bytes = resp.into_body().collect().await.unwrap().to_bytes();
|
||||
assert_eq!(&bytes[..], b"ok");
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn healthz_works_with_no_authorization_header() {
|
||||
let req = Request::builder()
|
||||
.uri("/healthz")
|
||||
.body(Body::empty())
|
||||
.unwrap();
|
||||
let resp = call_healthz(req).await;
|
||||
assert_eq!(resp.status(), StatusCode::OK);
|
||||
}
|
||||
}
|
||||
@@ -1 +1,11 @@
|
||||
pub mod adapter;
|
||||
pub mod auth;
|
||||
pub mod decoy;
|
||||
pub mod healthz;
|
||||
pub mod state;
|
||||
|
||||
pub use adapter::{HttpAdapter, RESERVED_PATHS, WS_UPGRADE_PATH};
|
||||
pub use auth::{bearer_auth_middleware, extract_bearer_identity, ResolvedIdentity};
|
||||
pub use decoy::decoy_fallback;
|
||||
pub use healthz::healthz;
|
||||
pub use state::DecoyConfig;
|
||||
|
||||
@@ -0,0 +1,88 @@
|
||||
//! Shared server state and configuration for the `HttpAdapter` router.
|
||||
|
||||
use std::path::PathBuf;
|
||||
use std::sync::Arc;
|
||||
|
||||
use alkcall::core::auth::IdentityProvider;
|
||||
use alkcall::registry::registration::OperationRegistry;
|
||||
|
||||
/// The stealth decoy surface for paths that are not registered
|
||||
/// operations and not part of the reserved default surface (the 6
|
||||
/// gateway endpoints, `/healthz`, `/openapi.json`, the MCP route, the
|
||||
/// WS upgrade path). Set by the assembly layer at `HttpAdapter`
|
||||
/// construction. The existence of the decoy path is fixed by ADR-010;
|
||||
/// the variant is a two-way-door config default.
|
||||
#[derive(Clone, Default, Debug)]
|
||||
pub enum DecoyConfig {
|
||||
/// Serve a fake `404 Not Found` (the default — a fake nginx 404).
|
||||
#[default]
|
||||
NotFound,
|
||||
/// Serve a static site from a configured directory.
|
||||
StaticSite { root: PathBuf },
|
||||
/// Redirect to a configured URL.
|
||||
Redirect { to: String },
|
||||
}
|
||||
|
||||
/// State embedded in the axum `Router`: the registry and identity
|
||||
/// provider every request handler reaches through the router state, plus
|
||||
/// the decoy config for the fallback.
|
||||
#[derive(Clone)]
|
||||
pub(crate) struct RouterState {
|
||||
pub(crate) registry: Arc<OperationRegistry>,
|
||||
pub(crate) identity_provider: Arc<dyn IdentityProvider>,
|
||||
pub(crate) decoy: DecoyConfig,
|
||||
}
|
||||
|
||||
impl axum::extract::FromRef<RouterState> for DecoyConfig {
|
||||
fn from_ref(state: &RouterState) -> Self {
|
||||
state.decoy.clone()
|
||||
}
|
||||
}
|
||||
|
||||
impl axum::extract::FromRef<RouterState> for Arc<OperationRegistry> {
|
||||
fn from_ref(state: &RouterState) -> Self {
|
||||
Arc::clone(&state.registry)
|
||||
}
|
||||
}
|
||||
|
||||
impl axum::extract::FromRef<RouterState> for Arc<dyn IdentityProvider> {
|
||||
fn from_ref(state: &RouterState) -> Self {
|
||||
Arc::clone(&state.identity_provider)
|
||||
}
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::*;
|
||||
|
||||
#[test]
|
||||
fn decoy_config_default_is_not_found() {
|
||||
assert!(matches!(DecoyConfig::default(), DecoyConfig::NotFound));
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn router_state_from_ref_extracts_decoy() {
|
||||
let state = RouterState {
|
||||
registry: Arc::new(OperationRegistry::new()),
|
||||
identity_provider: Arc::new(NoopProvider),
|
||||
decoy: DecoyConfig::Redirect {
|
||||
to: "https://example.com".to_string(),
|
||||
},
|
||||
};
|
||||
let extracted: DecoyConfig = axum::extract::FromRef::from_ref(&state);
|
||||
assert!(matches!(extracted, DecoyConfig::Redirect { .. }));
|
||||
}
|
||||
|
||||
struct NoopProvider;
|
||||
impl IdentityProvider for NoopProvider {
|
||||
fn resolve_from_fingerprint(&self, _: &str) -> Option<alkcall::core::auth::Identity> {
|
||||
None
|
||||
}
|
||||
fn resolve_from_token(
|
||||
&self,
|
||||
_: &alkcall::core::auth::AuthToken,
|
||||
) -> Option<alkcall::core::auth::Identity> {
|
||||
None
|
||||
}
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user