proxy

type Decision struct {
	// Mock, if set, is written to the client instead of contacting the origin.
	Mock *http.Response
	// Block: "" (none), "reset" (drop the connection), "timeout" (hang until
	// the client gives up or Deadline passes).
	Block string
	// Deadline bounds a "timeout" block.
	Deadline time.Duration
}

type DecryptMode string

type DecryptPolicy struct {
	Mode  DecryptMode
	Only  []string
	Never []string
}

type Device struct {
	IP        string
	Name      string // derived from the first User-Agent seen, e.g. "iPhone · iOS 17.5"
	UserAgent string
	FirstSeen time.Time
	LastSeen  time.Time
	Requests  int // proxied requests and tunnels
	Decrypted int // TLS handshakes with pano's certificate that succeeded
	Rejected  int // handshakes the client refused (certificate not trusted yet, or pinning)
}

type Hooks interface {
	Request(ctx context.Context, f *flow.Flow, r *http.Request) Decision
	Response(ctx context.Context, f *flow.Flow, r *http.Request, resp *http.Response) Decision
}

type Options struct {
	Addr        string      // listen address, e.g. 127.0.0.1:9091
	TLS         *tls.Config // MITM server config (from ca.Authority.TLSConfig)
	Sink        Sink
	Hooks       Hooks             // optional
	Transport   http.RoundTripper // optional; NewTransport(UpstreamTLS) if nil
	UpstreamTLS *tls.Config       // optional client TLS config for origins (tests, custom roots)
	MaxBody     int64             // per-body capture cap; 0 = 4 MiB
	MaxInflight int64             // total in-flight capture budget; 0 = 256 MiB
	MaxConns    int               // concurrent tunnels; 0 = 10000
	Decrypt     DecryptPolicy     // which tunnels are TLS-terminated; zero value = mode all, no lists
	CaptureWS   bool
	Session     func() string // current session id
	IDs         *flow.IDGen
	Logger      *slog.Logger
	CAPEM       []byte // served at /_pano/ca.pem on the proxy port
	DisableH2   bool
	// Local, if set, serves requests addressed to pano itself: a plain
	// request on a proxy port, an absolute-URI request for one of pano's own
	// addresses, and anything for MagicHost over http or https. It replaces
	// the built-in one-page site (which only offers the CA).
	Local http.Handler
}

type RejectedHost struct {
	Host  string
	Count int
	First time.Time
	Last  time.Time
	Error string
}

type Server struct {
	// contains filtered or unexported fields
}

type Sink interface {
	// Started is called once request headers are known.
	Started(f *flow.Flow)
	// Updated is called when response headers are known or state changes.
	Updated(f *flow.Flow)
	// Done is called once with the final snapshot.
	Done(f *flow.Flow)
	// Blob stores body bytes and returns their content hash.
	Blob(b []byte) string
	// WS is called per captured WebSocket message.
	WS(m *flow.WSMessage)
}