decryptprofile

type Profile struct {
	ID   string `json:"id"`
	Name string `json:"name"`

	// InspectHTTP2: nil = inherit (strip → HTTP/1.1, today's default); true =
	// native HTTP/2 inspection; false = force strip/HTTP-1.1.
	InspectHTTP2 *bool `json:"inspectHttp2,omitempty"`

	// CertVerification of the upstream (origin) cert on the inspect leg:
	// "" inherit (rule's TLSSkipVerify) | "strict" (verify, block untrusted/expired)
	// | "permissive" (verify, allow+log — DEFERRED enforcement) | "skip".
	CertVerification string `json:"certVerification,omitempty"`

	// OnUnsupported posture when the origin TLS can't be inspected (version/cipher
	// below floor): "" inherit | "fail-close" (drop — today's behavior) | "fail-open"
	// (raw-relay bypass — DEFERRED, superseded by OnInspectError for fail-open).
	OnUnsupported string `json:"onUnsupported,omitempty"`

	// OnInspectError is the adaptive decryption-exclusion / fail-open posture when
	// an inspected tunnel CANNOT be established because the host is incompatible
	// with inspection (origin demands a client cert we can't present, or the TLS
	// parameters are unsupported, or a pinned client rejects our forged leaf):
	// "" inherit (fail-close, today's behavior) | "fail-close" (502/drop) |
	// "fail-open" (record the host in the auto-exclusion cache after a
	// confirm-count of distinct clients, rescue the current session where it has
	// not yet committed to the client, and bypass subsequent sessions to the host
	// until the entry expires). It deliberately does NOT fire on an untrusted/
	// expired origin cert — that stays a block. See internal/autoexclude.
	OnInspectError string `json:"onInspectError,omitempty"`

	// MinTLSVersion / MaxTLSVersion floor and cap on the inspect handshakes:
	// "" inherit | "1.2" | "1.3".
	MinTLSVersion string `json:"minTlsVersion,omitempty"`
	MaxTLSVersion string `json:"maxTlsVersion,omitempty"`

	// StallTimeoutSecs per-stream inactivity bound; 0 = engine default, else
	// clamped to [MinStallSecs, MaxStallSecs].
	StallTimeoutSecs int `json:"stallTimeoutSecs,omitempty"`

	CreatedAt string `json:"created_at,omitempty"`
	UpdatedAt string `json:"updated_at,omitempty"`
}

type Store struct {
	// contains filtered or unexported fields
}