pub async fn mask_response_body(
resp: Response<ProxyBody>,
compiled: &CompiledMasking,
consumer_groups: &[String],
route: &str,
consumer: Option<&str>,
rid: &str,
) -> Response<ProxyBody>Expand description
The RESPONSE field masking pass (DW-029), the decoration tail’s
first stage and the security floor of the response path. Gates, in
order — every one of them FAILS CLOSED (the inverted posture; see
the module docs): bodiless statuses pass (nothing to leak), then a
content-encoded body, a non-JSON content type, a declared length
over the cap, an over-cap or dying stream, unparseable JSON, and a
pointer miss each answer 502 with a generic envelope plus one
dwara::policy warn event naming the refusal class server-side.
The gateway’s OWN compression (DW-027) runs later in the tail, so
it can never trip the encoding gate — only upstream-pre-encoded
responses do.
On success every effective pointer (route floor plus the consumer’s
groups — the union rule, config::transforms::Masking) is replaced
with the fixed sentinel, Content-Length is rewritten, and one
dwara::policy info event records route, consumer, masked count,
and request-id: the audit trail the issue’s done-when requires.