egressproxy

type ApplyOutcome struct {
	Skipped      bool // rule matched the host but not this request's path/method
	HeadersSet   int
	Substituted  int
	SubstitutedK []string // placeholder-bearing header names, for debug logging
}

type Decision struct {
	Allow bool
	Match MatchType
}

type InjectHeader struct {
	Name string `json:"name"`
	// Value is the final header value; templates were expanded by the operator.
	Value string `json:"value"`
	// Mode is "Override" (default) or "IfAbsent".
	Mode string `json:"mode,omitempty"`
}

type InjectRule struct {
	// Host is an exact hostname, lowercase. Wildcards are rejected upstream.
	Host string `json:"host"`

	// Ports the rule covers. Empty means the defaults, 80 and 443.
	Ports []int `json:"ports,omitempty"`

	// Headers to inject.
	Headers []InjectHeader `json:"headers,omitempty"`

	// SubstitutePlaceholders lists the placeholders that may be swapped for
	// their real value on this host.
	SubstitutePlaceholders []string `json:"substitutePlaceholders,omitempty"`

	// PathPrefixes / Methods narrow the rule. Empty means no narrowing.
	PathPrefixes []string `json:"pathPrefixes,omitempty"`
	Methods      []string `json:"methods,omitempty"`
}

type MatchType string

type Policy struct {
	// SandboxID records which sandbox this policy was pushed for. Informational
	// (surfaced in logs/metrics); the proxy enforces whatever is present.
	SandboxID string `json:"sandboxId,omitempty"`

	// Enforce gates the whole filter. When false the policy is treated as
	// fail-closed (deny all). The control plane sets it true only after a
	// concrete ruleset has been resolved for a claimed sandbox.
	Enforce bool `json:"enforce"`

	// DisableEgress blocks all outbound traffic regardless of the allow lists
	// (DNS is still permitted so name resolution does not hang). Equivalent to
	// an empty allowlist.
	DisableEgress bool `json:"disableEgress,omitempty"`

	// AllowedDomains permits egress to matching hostnames (exact, "*", or
	// "*.example.com"). Domains only ever allow; there is no domain deny.
	AllowedDomains []string `json:"allowedDomains,omitempty"`

	// AllowedCIDRs / DeniedCIDRs are IP/CIDR allow/deny for traffic without a
	// usable hostname (non-80/443 TCP, or bare-IP connections).
	AllowedCIDRs []string `json:"allowedCIDRs,omitempty"`
	DeniedCIDRs  []string `json:"deniedCIDRs,omitempty"`

	// AllowPrivateNetworks disables the built-in anti-SSRF deny of private /
	// link-local / cloud-metadata ranges. Default false (baseline stays on).
	AllowPrivateNetworks bool `json:"allowPrivateNetworks,omitempty"`
}

type Proxy struct {
	// contains filtered or unexported fields
}

type RedirectConfig struct {
	ProxyUID  int // sidecar runs as this uid; its own egress is exempted (no loop)
	HTTPPort  int
	TLSPort   int
	OtherPort int
}

type Secrets struct {
	// SandboxID records which sandbox this config was pushed for. Informational.
	SandboxID string `json:"sandboxId,omitempty"`

	// CACertPEM / CAKeyPEM are the per-sandbox CA used to mint leaf
	// certificates for the hosts being intercepted. Absent means TLS
	// interception is impossible and only plaintext :80 rules can apply.
	CACertPEM string `json:"caCertPem,omitempty"`
	CAKeyPEM  string `json:"caKeyPem,omitempty"`

	// Rules is the per-host injection table.
	Rules []InjectRule `json:"rules,omitempty"`

	// Substitutions maps a placeholder handed to the sandbox to the real
	// credential. A placeholder is only ever swapped on a host whose rule
	// lists it, so the real value cannot be steered to another destination.
	Substitutions map[string]string `json:"substitutions,omitempty"`
}

type ServeConfig struct {
	PolicyPath  string
	SecretsPath string
	HTTPPort    int
	TLSPort     int
	OtherPort   int
	Logger      *slog.Logger
}