Documentation
¶
Overview ¶
Package https is the HTTPS protocol-family facet. It owns the HTTPS CEL environment (method / path / query / headers / body / body_json, exposed as fields on the `http` variable), the matcher that walks an HTTP-shaped match.Request, and the per-family report fields the dashboard renders for an HTTPS request.
HTTPS leaves match.Request.Meta nil — every variable the matcher reads comes from the request snapshot the gateway already populates (Method, URL, Headers, Body). PrepareRequest is therefore a no-op.
Index ¶
- type Facet
- func (Facet) CELContrib() facet.CELContrib
- func (Facet) EndpointFamilies() []string
- func (Facet) HITLQueryLabel() string
- func (Facet) HostIsResource() bool
- func (Facet) Name() string
- func (f Facet) NewMatcher(condition string) (match.Matcher, error)
- func (Facet) PrepareRequest(*match.Request)
- func (Facet) Report(req *match.Request) map[string]any
- func (Facet) ReportFields() []facet.ReportFieldSpec
- func (Facet) Transport() string
- type Fields
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Facet ¶
type Facet struct{}
Facet is the HTTPS facet Runtime. Singleton; held by the registry for the lifetime of the process.
func (Facet) CELContrib ¶
func (Facet) CELContrib() facet.CELContrib
CELContrib declares the HTTPS facet's CEL contribution: the `http` variable backed by Fields, the activation builder that snapshots a request into one, and the path lists CompileCondition needs.
lowercasedPaths: http.method's activation value is normalized to lowercase, so CompileCondition pre-lowercases the literal in `http .method == "POST"` at rule-load time. Other HTTPS fields stay case-sensitive (paths, headers, body bytes are operator-controlled).
truncatablePaths: http.body and http.body_json come from the buffer the gateway capped at maxHTTPMatchBody (main.go). On a request whose body overflowed, both paths are marked CEL-unknown; a condition whose outcome depends on the capped bytes evaluates Unevaluable and the dispatcher synthesizes a deny. Fields whose value is body-independent (method, path, query, headers) are intentionally absent — `http.method == "GET"` still fires on its own predicate even when the body was capped. Because the k8s family composes the http facet alongside its own, a k8s_rule that references http.body also fail-closes on truncation; the truncatable-fields registry follows from the composition with no per-family plumbing.
func (Facet) EndpointFamilies ¶
EndpointFamilies enumerates endpoint families a rule of this facet may attach to.
func (Facet) HITLQueryLabel ¶
HITLQueryLabel is the dashboard / Slack label for an HTTPS request.
func (Facet) HostIsResource ¶
HostIsResource reports that an HTTPS request's Host is already a meaningful resource label (api.anthropic.com, etc.).
func (Facet) NewMatcher ¶
NewMatcher compiles a CEL condition into a Matcher. Delegates to the package-level composer so every facet the http family composes layers in (only the http facet itself today — the http family doesn't compose any other facet).
func (Facet) PrepareRequest ¶
PrepareRequest is a no-op for HTTPS — the matcher reads directly from the request snapshot the gateway already populates.
func (Facet) Report ¶
Report extracts the HTTPS report fields from a request. Status isn't known until the response writes; the gateway fills it in after Report runs.
func (Facet) ReportFields ¶
func (Facet) ReportFields() []facet.ReportFieldSpec
ReportFields declares the per-family columns the HTTPS facet emits onto an event for logging and dashboard rendering.
type Fields ¶
type Fields struct {
Method string `cel:"method"`
Path string `cel:"path"`
Query map[string][]string `cel:"query"`
Headers map[string][]string `cel:"headers"`
Body string `cel:"body"`
BodyJSON *structpb.Value `cel:"body_json"`
}
Fields is the CEL-facing view of an HTTPS request. Exposed as the `http` variable in rule conditions (`http.method`, `http.path`, `http.body_json`, etc.). The facet name matches the CEL variable (`http`); the endpoint plugin keeps the HCL label `https` since that names the wire (TLS).
BodyJSON is *structpb.Value rather than `any` because cel-go's NativeTypes converter drops interface-typed struct fields silently; google.protobuf.Value gives the field the dyn-shape the operator expects when writing `http.body_json.archived == true` style predicates.
Source Files