proxy

type ADOGrant struct {
	Organization string
	Capabilities []adoscope.Capability
}

type ADOGrantConfig struct {
	Organization string                `json:"organization"`
	Capabilities []adoscope.Capability `json:"capabilities"`
	Hosts        []string              `json:"hosts"`
}

type ADOGrantSource interface {
	ADOGrantFor(host string) (ADOGrant, bool)
}

type Config struct {
	// RunID is the governed run this sidecar serves.
	RunID uuid.UUID `json:"run_id"`
	// ControlPlaneURL is the base URL of wardynd's internal TLS listener (e.g.
	// "https://wardynd:8443"). http:// is refused unless the host is loopback
	// (hoptls.CheckURL).
	ControlPlaneURL string `json:"control_plane_url"`
	// ControlPlaneCAPEM is wardynd's internal CA (internal/hoptls), the ONLY
	// root this sidecar trusts for control-plane calls. Required with an
	// https ControlPlaneURL.
	ControlPlaneCAPEM string `json:"control_plane_ca_pem,omitempty"`
	// RunToken authenticates internal calls (Authorization: Bearer <token>).
	RunToken string `json:"run_token"`
	// Policy is the compiled egress allowlist / method rules / first-use flag.
	Policy types.RunPolicySpec `json:"policy"`
	// Injection rules drive proxy-side credential injection (plain HTTP only).
	// Each rule carries the grant_id the secret is minted from at startup.
	Injection []InjectionConfig `json:"injection,omitempty"`
	// Listen is the proxy listen address (default ":3128").
	Listen string `json:"listen,omitempty"`
	// DecisionBufferSize caps the async decision-log buffer (default 1024).
	DecisionBufferSize int `json:"decision_buffer_size,omitempty"`
	// MITMCACertPEM / MITMCAKeyPEM are the OPTIONAL TLS-MITM certificate authority
	// (PEM). When both are set AND content inspection is enabled, the proxy
	// TLS-terminates opaque CONNECT tunnels to known LLM hosts (Anthropic/OpenAI)
	// to inspect the subscription-OAuth path. The CA PRIVATE KEY stays in proxy
	// memory only; the sandbox trusts only the CA's public cert (delivered to its
	// trust store by the driver). Empty => opaque passthrough (no MITM).
	MITMCACertPEM string `json:"mitm_ca_cert_pem,omitempty"`
	MITMCAKeyPEM  string `json:"mitm_ca_key_pem,omitempty"`
	// MITMHosts are OPERATOR-CONFIGURED corp artifact hosts (exact hostnames) this
	// proxy is permitted to TLS-MITM in addition to the built-in LLM hosts, so a
	// corporate registry token can be injected on the wire. See isMITMHost's trust
	// boundary: this is a tight per-host operator allowlist compiled at dispatch
	// from the site-config artifact overrides — NOT attacker-reachable (the sandbox
	// cannot set it), NEVER a wildcard, and only meaningful with a paired injection
	// rule that supplies the operator's OWN token. Empty => LLM hosts only.
	MITMHosts []string `json:"mitm_hosts,omitempty"`
	// GitGrants is the git-broker per-repo allowlist: canonical "<org>/<repo>" ->
	// the github_token grant id to mint from, backing the /wardyn/gh/ route so the
	// sandbox reaches only its granted repos (never all of github.com) and the token
	// stays proxy-side. Compiled at dispatch from the run's github grants. Empty =>
	// the git-broker route always 403s (no repo brokered).
	GitGrants map[string]uuid.UUID `json:"git_grants,omitempty"`
	// PATGrants is the git_pat broker's per-HOST allowlist: canonical lower-case
	// host -> the git_pat grant id to mint from, backing the /wardyn/git/ route.
	//
	// It is the non-GitHub half of the same idea as GitGrants, and it exists to
	// close an asymmetry rather than to add a feature: a github_token never
	// enters the sandbox, while a git_pat for GitLab or Azure DevOps was handed
	// to the in-sandbox credential helper and was therefore resident for the
	// life of the run. The grant kind's own doc calls that "the OPPOSITE of
	// api_key", because git-over-HTTPS is an opaque CONNECT tunnel the proxy
	// cannot inject Basic-auth into.
	//
	// This route removes the tunnel: agent-run rewrites those hosts to a
	// PLAIN-HTTP broker path, so the proxy terminates the request, mints
	// server-side and injects the credential itself. The PAT never reaches the
	// sandbox.
	//
	// Per-HOST rather than per-repo, deliberately: unlike a GitHub App
	// installation token, a PAT carries whatever scope the operator issued it
	// with and Wardyn cannot narrow it — so a per-repo key here would imply a
	// confinement the credential does not have. Empty => the route always 403s.
	PATGrants map[string]PATGrant `json:"pat_grants,omitempty"`
	// ADOGrants is the run's per-person Azure DevOps grant, which drives the
	// REST gate (ado_gate.go, ado_grants.go). Empty == the gate is off.
	ADOGrants []ADOGrantConfig `json:"ado_grants,omitempty"`
	// MITMLLM reports whether TLS-MITM of the BUILT-IN LLM hosts (Anthropic/OpenAI)
	// is actually intended for this run — i.e. subscription credential injection OR
	// intercept_tls content inspection. Dispatch also mints the per-run CA for
	// artifact token injection (MITMHosts), so "a CA exists" no longer implies "LLM
	// MITM was wanted"; without this flag an artifact-only run would TLS-terminate a
	// direct CONNECT to Anthropic/OpenAI it was never asked to. Empty/false => the
	// LLM hosts stay opaque passthrough even when a CA is present for artifact hosts.
	MITMLLM bool `json:"mitm_llm,omitempty"`
	// UpstreamProxyURL is the OPTIONAL corporate parent/upstream proxy that this
	// sidecar chains its egress through (http[s]://[user:pass@]host[:port]). In a
	// locked-down corporate network the sandbox host has NO direct internet route
	// — the org's HTTP CONNECT proxy is the only way out (and is frequently a
	// PRIVATE address). When set, forward-egress dials are issued as
	// CONNECT <real-host> to this proxy; control-plane calls to wardynd never
	// traverse it. Any embedded credential is held proxy-memory-only (like
	// RunToken) and masked from all decision-log/stdout output. Empty => direct
	// dial (backward-compatible).
	//
	// SOURCE vs TRANSPORT: the only source is the persisted site-config
	// (upstream_proxy_secret_ref, admin-authored via PUT /api/v1/site-config).
	// It is resolved per dispatch by resolveRunUpstreamProxy
	// (internal/api/runs_dispatch.go) through resolveUpstreamProxyURL (which
	// lives in internal/api/runs_bedrock.go), audited as
	// run.upstream_proxy.resolve on resolve success/failure, and merely
	// TRANSPORTED here by the run's ProxyConfig (WARDYN_PROXY_CONFIG_JSON,
	// internal/runner/docker/driver.go).
	UpstreamProxyURL string `json:"upstream_proxy_url,omitempty"`
	// UpstreamProxyNoProxy is the upstream's BYPASS list
	// (SiteConfig.UpstreamProxyNoProxy, forwarded verbatim): host/domain
	// suffixes and CIDRs this sidecar dials DIRECTLY instead of CONNECTing
	// through UpstreamProxyURL. It is the operator-hop equivalent of the
	// NO_PROXY the sandbox already honours internally. This sidecar vets the
	// name on the upstream branch too (egressTarget): an endpoint that resolves
	// into blocked space is denied HERE (builtin:private-ip), and one that does
	// not is handed to a corporate forward proxy that will not CONNECT to an
	// internal address; either way the bypass is what moves the dial local.
	//
	// It is a ROUTING list only: a bypassed dial falls through to the same
	// unconditional private/reserved-IP guard an unproxied dial does, so it
	// never makes a private address reachable on its own (InternalHosts above
	// is the one lift, and the two compose), and it grants no policy allow.
	// Control-plane authored, same trust boundary as TrustedCAPEM/
	// InternalHosts — the sandbox cannot set it. Empty (the default) => every
	// forward dial chains through the upstream, byte-identical to today.
	UpstreamProxyNoProxy []string `json:"upstream_proxy_no_proxy,omitempty"`
	// TrustedCAPEM is the OPERATOR's corporate CA bundle (WARDYN_TRUSTED_CA_FILE,
	// wardynd's Config.TrustedCAPEM), forwarded verbatim per run so THIS
	// sidecar's forward/egress transport additionally trusts a corporate
	// TLS-inspecting middlebox on the path to the real upstream. Never the
	// control-plane transport, which trusts ControlPlaneCAPEM alone. Control-plane
	// authored, same trust boundary as MITMCACertPEM/MITMCAKeyPEM above — the
	// sandbox cannot set it. Empty (the default) => system roots only,
	// byte-identical to today.
	TrustedCAPEM string `json:"trusted_ca_pem,omitempty"`
	// InternalHosts are the operator-declared internal hostnames
	// (SiteConfig.InternalHosts, forwarded verbatim) eligible for the
	// private-IP-guard lift in Proxy.vetHost — an admin-declared exception for a
	// specific in-cluster/CGNAT service name, never attacker-reachable (the
	// sandbox cannot set this). Empty (the default) => no lift, byte-identical
	// to today.
	InternalHosts []types.InternalHost `json:"internal_hosts,omitempty"`
	// LLMUpstreams maps a public vendor host ("api.anthropic.com" /
	// "api.openai.com") to an operator-configured internal gateway base URL
	// (api.Config.LLMGateways, forwarded verbatim; WARDYN_ANTHROPIC_BASE_URL /
	// WARDYN_OPENAI_BASE_URL) that the /wardyn/llm/* brokered routes dial
	// instead of the vendor host. Control-plane-authored, same trust boundary
	// as TrustedCAPEM/InternalHosts above — the sandbox cannot set this. Empty
	// (the default) => every brokered LLM route dials the vendor host,
	// byte-identical to today.
	LLMUpstreams map[string]string `json:"llm_upstreams,omitempty"`
	// LLMUnavailableDetail is what the brokered-LLM 404 says about WHY no
	// credential is behind this run's LLM route, composed by the control plane at
	// dispatch (internal/api's llmUnavailableDetail) because only it knows the
	// deployment's model-provider posture — the sidecar knows only that no
	// injection rule matched. Control-plane-authored, same trust boundary as
	// LLMUpstreams above; the sandbox cannot set it. Empty (the default) => the
	// route's own generic detail, plus the below-policy clause either way
	// (proxyLLMRequest).
	LLMUnavailableDetail string `json:"llm_unavailable_detail,omitempty"`
}

type IPGuardResult struct {
	// IP is the single vetted address to dial (no further DNS resolution).
	IP net.IP
	// Denied is true when no usable, policy-safe address exists.
	Denied bool
	// Reason explains a denial (for the decision log rule_source).
	Reason string

	// Lifted is true when an address that isBlockedIP would otherwise deny was
	// admitted only because the caller's lift predicate (vetHostLift) accepted
	// it — i.e. an operator-declared internal host (SiteConfig.InternalHosts).
	// Never true for VetHost (which always calls vetHostLift with a nil lift).
	Lifted bool
	// Unresolved distinguishes a denial that means "this proxy could not learn
	// the addresses at all" (local DNS failed, or answered with nothing) from
	// one that means "an address is blocked". egressTarget's corp-upstream
	// branch reads it to EXCUSE the case: under an operator upstream the sandbox
	// host frequently CANNOT resolve external names, which is the whole reason
	// that branch exists, so a resolve failure there must not become a denial —
	// while a name that DOES resolve into blocked space must be, which it was
	// not before. egressTarget's direct-dial branch reads it to ATTRIBUTE the
	// case (errHostUnresolved -> builtin:resolve-failed): there it still denies,
	// but it is a DNS fault and not the address-range guard, and the two have
	// opposite fixes. Every other caller treats Denied as Denied.
	Unresolved bool
	// contains filtered or unexported fields
}

type InjectionConfig struct {
	egress.InjectionRule
	// GrantID identifies the credential_grant to mint the secret value from
	// at startup via POST /api/v1/internal/credentials/mint.
	GrantID uuid.UUID `json:"grant_id"`
}

type Options struct {
	RunID  uuid.UUID
	Policy *Policy
	// Evaluator overrides the pluggable host/method policy-verdict engine. Nil =>
	// the builtin evaluator wrapping Policy (default; unchanged behavior).
	Evaluator egress.Evaluator
	Approval  *approvalClient
	Injector  *injector
	Sink      *decisionSink
	Resolver  resolver
	// Scanner is the optional outbound content-inspection engine (nil == off).
	Scanner *contentscan.Engine
	// CA is the optional TLS-MITM certificate authority (nil == opaque CONNECT).
	CA *certAuthority
	// MITMHosts are operator-configured corp artifact hosts eligible for TLS-MITM
	// beyond the built-in LLM hosts (exact hostnames). See Proxy.mitmHosts.
	MITMHosts []string
	// MITMLLM gates TLS-MITM of the built-in LLM hosts on actual intent. See
	// Proxy.mitmLLM.
	MITMLLM bool
	// GitGrants is the git-broker per-repo allowlist ("<org>/<repo>" -> grant id)
	// backing the /wardyn/gh/ route. See Proxy.gitGrants.
	GitGrants map[string]uuid.UUID
	// PATGrants is the git_pat broker's per-HOST allowlist backing /wardyn/git/.
	// See Config.PATGrants and pat_broker.go for why it is per-host rather than
	// per-repo.
	PATGrants map[string]PATGrant
	// ADOGrants backs the Azure DevOps REST gate (ado_gate.go). Nil == off.
	ADOGrants ADOGrantSource
	// ControlPlaneURL and RunToken back the local brokered routes. The run
	// token is injected only toward the control plane and never reaches the
	// sandbox or any LLM upstream.
	ControlPlaneURL string
	RunToken        *tokenSource
	// Upstream is the OPTIONAL corporate parent proxy (parsed form). Nil ==
	// direct dial. NewServer parses it from Config.UpstreamProxyURL; tests may
	// build one via parseUpstreamProxy.
	Upstream *upstreamProxy
	// UpstreamNoProxy is the operator's upstream BYPASS list
	// (SiteConfig.UpstreamProxyNoProxy, forwarded verbatim): host/domain
	// suffixes and CIDRs dialed DIRECTLY rather than CONNECTed through
	// Upstream. Control-plane-authored, same trust boundary as InternalHosts —
	// the sandbox cannot set it. Empty (the default) => no bypass. Ignored
	// entirely when Upstream is nil. See Proxy.noProxy / Proxy.bypassUpstream.
	UpstreamNoProxy []string
	// InternalHosts are the operator-declared internal hostnames (site-config,
	// CONTROL-PLANE-authored — the sandbox cannot set this) eligible for
	// vetHost's private-IP-guard lift. Empty == no lift (byte-identical to
	// before this field existed). See Proxy.internalHosts.
	InternalHosts []types.InternalHost
	// LocalSubnets are the proxy's own interface subnets (net.InterfaceAddrs,
	// captured once by NewServer before constructing Options). See
	// Proxy.localSubnets.
	LocalSubnets []*net.IPNet
	// ControlPlaneIPs are every address this run's wardynd resolves to,
	// resolved once by NewServer before constructing Options. See
	// Proxy.controlPlaneIPs.
	ControlPlaneIPs []net.IP
	// ExclusionUnknown reports that NewServer's startup capture of LocalSubnets
	// or ControlPlaneIPs failed, so the own-subnet/control-plane clamp must
	// refuse every lift/trust rather than silently permit them. See
	// Proxy.exclusionUnknown.
	ExclusionUnknown bool
	// LLMUpstreams maps a public vendor host to an operator-configured internal
	// gateway base URL (Config.LLMUpstreams, forwarded verbatim). Empty == every
	// brokered LLM route dials the vendor host. See Proxy.llmUpstreams.
	LLMUpstreams map[string]string
	// LLMUnavailableDetail is the control-plane's reason the brokered-LLM 404
	// gives when no credential is behind the route (Config.LLMUnavailableDetail,
	// forwarded verbatim). Empty == the generic route sentence. See llm404Detail.
	LLMUnavailableDetail string
	// Dial overrides the connection dialer (tests). Production leaves it nil
	// and a net.Dialer is used.
	Dial func(ctx context.Context, network, addr string) (net.Conn, error)
	// TLSClientConfig is the EGRESS transport's TLS config. Production sets it
	// from Config.TrustedCAPEM (system roots plus the operator's corporate CA
	// bundle — see NewServer); nil means system roots alone. Tests use it to
	// trust an httptest TLS server standing in for an HTTPS upstream.
	TLSClientConfig *tls.Config
	// ControlTLS pins the control-plane transport to wardynd's internal CA
	// (hoptls.ClientConfig). nil pins an EMPTY pool: https fails closed.
	ControlTLS *tls.Config
	Now        func() time.Time
}

type PATGrant struct {
	GrantID  uuid.UUID `json:"grant_id"`
	Username string    `json:"username,omitempty"`
}

type Policy struct {
	// contains filtered or unexported fields
}

type Proxy struct {
	// contains filtered or unexported fields
}

type Server struct {
	// contains filtered or unexported fields
}