proxy

type AllowRule struct {
	Host  string
	Ports []int
}

type AuditSink interface {
	RecordEgress(ctx context.Context, e EgressEvent) error
}

type BrokerClient struct {
	// TokenReader, when non-nil, overrides the inner client's TokenReader
	// on every ValidateEgress / SubstituteAuth call. NewBrokerClient
	// initialises this field and the inner client's TokenReader to the
	// same closure (re-reads tokenPath on every call), so production paths
	// see no behavioural change. Tests can mutate this field after
	// construction to inject inline byte slices; the override is
	// propagated on the next ValidateEgress / SubstituteAuth call.
	// Setting this field back to nil after construction is a no-op — it
	// does not reset the inner client's TokenReader to the default; to
	// "reset", re-call NewBrokerClient.
	TokenReader brokerclient.TokenReader
	// contains filtered or unexported fields
}

type ClientAuditSink struct {
	Sink      auditing.Sink
	Namespace string
	RunName   string
}

type ConnLimiter struct {
	// contains filtered or unexported fields
}

type Decision struct {
	Allowed       bool
	MatchedPolicy string
	Reason        string

	// SubstituteAuth declares that the MITM path must call the broker's
	// SubstituteAuth endpoint per request and rewrite headers before
	// forwarding upstream. False means the proxy either relays bytes
	// (cooperative/transparent without substitution) or still MITMs for
	// visibility but doesn't rewrite credentials.
	SubstituteAuth bool

	// DiscoveryAllow mirrors ValidateEgressResponse.DiscoveryAllow.
	// When true, the proxy emits an egress-discovery-allow AuditEvent
	// instead of egress-allow.
	DiscoveryAllow bool
}

type DeniedCIDRSet struct {
	// contains filtered or unexported fields
}

type EgressEvent struct {
	Host          string
	Port          int
	Decision      paddockv1alpha1.AuditDecision
	MatchedPolicy string
	Reason        string
	When          time.Time
	Kind          paddockv1alpha1.AuditKind
}

type LimitedListener struct {
	// contains filtered or unexported fields
}

type MITMCertificateAuthority struct {
	// contains filtered or unexported fields
}

type NoopAuditSink struct{}

type Resolver interface {
	LookupHost(ctx context.Context, host string) ([]net.IP, error)
}

type Server struct {
	// CA is the Paddock MITM CA. Every intercepted TLS connection is
	// re-signed with a leaf forged by this CA; the agent trusts it via
	// the projected ca-bundle Secret (ADR-0013 §7.3).
	CA *MITMCertificateAuthority

	// Validator decides allow/deny per (host, port). M4 shipped a
	// StaticValidator; M7 passes a BrokerClient that calls the broker's
	// ValidateEgress endpoint so the same BrokerPolicy store the
	// admission webhook consulted decides runtime flow too.
	Validator Validator

	// Substituter, when non-nil, rewrites outbound request headers when
	// the matched egress grant declared SubstituteAuth=true. The MITM
	// path drops to a request-by-request loop so headers can be swapped
	// mid-connection (required for the AnthropicAPI x-api-key swap —
	// ADR-0015 §"AnthropicAPIProvider"). nil falls back to
	// bytes-both-ways shuttle, same as cooperative M4 behaviour.
	Substituter Substituter

	// Audit receives every denial (and, later, summarised allows). nil
	// defaults to NoopAuditSink.
	Audit AuditSink

	// UpstreamDialer is used for the upstream TLS leg. nil defaults to
	// net.Dialer{}.DialContext. Tests swap it for an in-memory dialer
	// against an httptest server.
	UpstreamDialer func(ctx context.Context, network, addr string) (net.Conn, error)

	// UpstreamTLSConfig seeds the upstream tls.Config. The proxy fills
	// in ServerName per-connection; callers set RootCAs and TLS
	// versions. nil defaults to a zero tls.Config (system roots).
	UpstreamTLSConfig *tls.Config

	// HandshakeTimeout caps each inner TLS handshake (agent-side and
	// upstream-side). Defaults to 30s.
	HandshakeTimeout time.Duration

	// IdleTimeout caps the idle-read interval on the bytes-shuttle and
	// substitute-loop paths. When no data arrives within IdleTimeout the
	// proxy closes the connection so a revoked BrokerPolicy takes effect
	// within IdleTimeout on opaque tunnels too. Defaults to
	// defaultProxyIdleTimeout (60s). Zero is treated as "use default";
	// callers wanting to disable the timeout pass a deliberately-large
	// duration. F-25 part 2.
	IdleTimeout time.Duration

	// Logger, if set, receives per-connection diagnostic lines. nil
	// disables logging (tests typically pass logr.Discard()).
	Logger logr.Logger

	// OriginalDestination, if non-nil, replaces the SO_ORIGINAL_DST
	// syscall path in HandleTransparentConn. Tests use this to inject
	// pre-determined IP/port pairs against net.Pipe() conns that aren't
	// *net.TCPConn. Production callers leave it nil; the package-level
	// originalDestination from transparent_linux.go (or the no-op stub
	// in transparent_other.go) is used.
	OriginalDestination func(net.Conn) (net.IP, int, error)

	// Resolver is the proxy's own DNS resolver, used for the F-22 dial-time
	// re-resolve in transparent mode and the post-allowlist denied-CIDR
	// filter in cooperative mode. nil defaults to NewCachingResolver(30s, 256).
	Resolver Resolver

	// DeniedCIDRs is the closed set of destination networks the proxy
	// refuses to dial regardless of validator outcome. Populated from
	// cmd/proxy/main.go --deny-cidr (controller passes RFC1918 + link-local
	// + cluster pod+service CIDRs). nil means no denied-CIDR check.
	DeniedCIDRs *DeniedCIDRSet
	// contains filtered or unexported fields
}

type StaticValidator struct {
	Allow []AllowRule
}

type Substituter interface {
	SubstituteAuth(ctx context.Context, host string, port int, headers http.Header) (brokerapi.SubstituteResult, error)
}

type Validator interface {
	ValidateEgress(ctx context.Context, host string, port int) (Decision, error)
}