Struct DigestingBody 

pub struct DigestingBody<B> { /* private fields */ }

Request body that enforces an HMAC-signed body digest while STREAMING (DW-036): every data frame is folded into an incremental SHA-256 — nothing is buffered, so a signed body of any size costs O(1) memory beyond the frame in flight — and the final digest is compared (constant-time, subtle) against the digest the verified signature bound at authn time (Identity::body_digest, security::authn). A mismatch surfaces as SignatureBodyError::DigestMismatch, aborting the upstream send WITH the last frame withheld on declared-length bodies (the digest is final the moment the declared byte count is hashed) or at the terminating frame on unknown-length bodies: the tampered request never completes upstream and the proxy answers 401.

The hashed read is therefore exactly the forwarded read — and when the route caps bodies (max_body_bytes, DW-027), this wrapper sits INSIDE the route’s LimitedBody, so the cap still rejects oversized bodies first. Unsigned requests construct the wrapper with None (one uniform type on the proxy path): the None form is a strict passthrough — no hashing, and is_end_stream/size_hint delegate untouched. The Some form reports is_end_stream: false so the consumer always polls to the terminating frame (the last resort of the digest check — an end-stream short-circuit would skip verification for empty and chunked bodies; declared-length bodies additionally check at saturation, see exact_hint). The one shape the forwarding encoder never polls is a declared size of EXACTLY zero — hyper writes Content-Length: 0 straight from the size hint and drops the stream without a single poll_frame — so new decides that case eagerly and the proxy consults DigestingBody::eager_digest_mismatch before forwarding: an empty signed body is verified against its signed digest like any other.

Implementations

impl<B> DigestingBody<B>

where B: Body<Data = Bytes>,

pub fn new(inner: B, expected: Option<[u8; 32]>) -> Self

expected is the SIGNED digest (decoded from the presented X-Dwara-Body-Sha256 header) — public material, already verified as MAC-covered at authn time. None wraps without enforcing (see the struct docs).

pub fn eager_digest_mismatch(&self) -> bool

The digest verdict new could already decide without seeing a frame (the wrapped body declared exact size 0, the one shape the forwarding encoder never polls). The proxy MUST consult this before forwarding an enforced body: a mismatch on a zero-length body has no poll to surface through, so this is its only signal — the same decision the streaming path enforces in poll_frame.

Trait Implementations

impl<B> Body for DigestingBody<B>

where B: Body<Data = Bytes>, B::Error: Into<Box<dyn Error + Send + Sync>>,

type Data = Bytes

Values yielded by the Body.

type Error = SignatureBodyError

The error type this Body might generate.

fn poll_frame( self: Pin<&mut Self>, cx: &mut Context<'_>, ) -> Poll<Option<Result<Frame<Bytes>, SignatureBodyError>>>

Attempt to pull out the next frame of this stream.

fn size_hint(&self) -> SizeHint

A hint that returns the bounds on the remaining length of the stream.

fn is_end_stream(&self) -> bool

A hint that may return true when the end of stream has been reached.

impl<B> Debug for DigestingBody<B>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.