pub struct OpaClient { /* private fields */ }Expand description
OPA HTTP callout client with a TTL-based decision cache.
Created at config publish time and shared across requests. The
cache is a simple HashMap behind a Mutex — no eviction thread;
entries expire on read and are lazily cleaned.
DP-07 (#241): the client is async, using hyper_util for HTTP and
tokio-rustls for TLS. The is_authorized method is async and
should be called from the async proxy pipeline directly (no
spawn_blocking needed).
Implementations§
Source§impl OpaClient
impl OpaClient
Sourcepub fn new(
endpoint: String,
cache_ttl: Duration,
http_timeout: Duration,
) -> Self
pub fn new( endpoint: String, cache_ttl: Duration, http_timeout: Duration, ) -> Self
Create a new OPA client.
endpoint: the OPA REST API URL (e.g.http://opa:8181/v1/data/dwara/allow).cache_ttl: how long to cache decisions.http_timeout: the HTTP callout timeout.
Sourcepub fn with_fail_open(self, fail_open: bool) -> Self
pub fn with_fail_open(self, fail_open: bool) -> Self
REL-11 (#222): set the outage policy. When true (fail-open), an
OPA callout failure returns Allow instead of an error. When
false (fail-closed), the error is propagated. Default: true.
Sourcepub fn with_ssrf_filter(self, filter: SsrfFilter) -> Self
pub fn with_ssrf_filter(self, filter: SsrfFilter) -> Self
SEC-13: set the SSRF egress filter for this OPA client. Called at config compile time when the gateway has an SSRF filter configured. The filter is checked at connect time against the resolved IP of the OPA endpoint.
Check if the request is allowed by OPA.
On a cache hit, the decision is returned without any HTTP call. On a cache miss, the async callout is made and the result is cached.
DP-07 (#241): this is now an async method using hyper_util.
Sourcepub fn clear_cache(&self)
pub fn clear_cache(&self)
Clear the decision cache.
Sourcepub fn cache_size(&self) -> usize
pub fn cache_size(&self) -> usize
The number of entries in the cache (including expired ones).
Sourcepub async fn download_bundle(&self, bundle_url: &str) -> Result<bool, OpaError>
pub async fn download_bundle(&self, bundle_url: &str) -> Result<bool, OpaError>
DP-07 (#241): download an OPA bundle from the given URL and
check if the revision has changed. Returns Ok(true) if the
bundle was reloaded (revision changed), Ok(false) if the
revision is unchanged, or an error on failure.
The bundle is a JSON document with a revision field and a
data field. When the revision changes, the client clears its
decision cache (the new bundle may produce different decisions
for the same inputs).
Sourcepub fn bundle_revision(&self) -> Option<String>
pub fn bundle_revision(&self) -> Option<String>
DP-07 (#241): the current bundle revision, if any.
Trait Implementations§
Auto Trait Implementations§
impl Freeze for OpaClient
impl RefUnwindSafe for OpaClient
impl Send for OpaClient
impl Sync for OpaClient
impl Unpin for OpaClient
impl UnwindSafe for OpaClient
Blanket Implementations§
§impl<T> AnyExt for T
impl<T> AnyExt for T
§fn downcast_ref<T>(this: &Self) -> Option<&T>where
T: Any,
fn downcast_ref<T>(this: &Self) -> Option<&T>where
T: Any,
T behind reference§fn downcast_mut<T>(this: &mut Self) -> Option<&mut T>where
T: Any,
fn downcast_mut<T>(this: &mut Self) -> Option<&mut T>where
T: Any,
T behind mutable reference§fn downcast_rc<T>(this: Rc<Self>) -> Result<Rc<T>, Rc<Self>>where
T: Any,
fn downcast_rc<T>(this: Rc<Self>) -> Result<Rc<T>, Rc<Self>>where
T: Any,
T behind Rc pointer§fn downcast_arc<T>(this: Arc<Self>) -> Result<Arc<T>, Arc<Self>>where
T: Any,
fn downcast_arc<T>(this: Arc<Self>) -> Result<Arc<T>, Arc<Self>>where
T: Any,
T behind Arc pointer§fn downcast_box<T>(this: Box<Self>) -> Result<Box<T>, Box<Self>>where
T: Any,
fn downcast_box<T>(this: Box<Self>) -> Result<Box<T>, Box<Self>>where
T: Any,
T behind Box pointer§fn downcast_move<T>(this: Self) -> Option<T>
fn downcast_move<T>(this: Self) -> Option<T>
Self to T,
useful only in generic context as a workaround for specializationSource§impl<T> BorrowMut<T> for Twhere
T: ?Sized,
impl<T> BorrowMut<T> for Twhere
T: ?Sized,
Source§fn borrow_mut(&mut self) -> &mut T
fn borrow_mut(&mut self) -> &mut T
Source§impl<T> CloneToUninit for Twhere
T: Clone,
impl<T> CloneToUninit for Twhere
T: Clone,
§impl<T, X> CoerceTo<T> for Xwhere
T: CoerceFrom<X> + ?Sized,
impl<T, X> CoerceTo<T> for Xwhere
T: CoerceFrom<X> + ?Sized,
fn coerce_rc_to(self: Rc<X>) -> Rc<T>
fn coerce_box_to(self: Box<X>) -> Box<T>
fn coerce_ref_to(&self) -> &T
fn coerce_mut_to(&mut self) -> &mut T
§impl<T> Instrument for T
impl<T> Instrument for T
§fn instrument(self, span: Span) -> Instrumented<Self>
fn instrument(self, span: Span) -> Instrumented<Self>
§fn in_current_span(self) -> Instrumented<Self>
fn in_current_span(self) -> Instrumented<Self>
Source§impl<T> IntoEither for T
impl<T> IntoEither for T
Source§fn into_either(self, into_left: bool) -> Either<Self, Self>
fn into_either(self, into_left: bool) -> Either<Self, Self>
self into a Left variant of Either<Self, Self>
if into_left is true.
Converts self into a Right variant of Either<Self, Self>
otherwise. Read moreSource§fn into_either_with<F>(self, into_left: F) -> Either<Self, Self>
fn into_either_with<F>(self, into_left: F) -> Either<Self, Self>
self into a Left variant of Either<Self, Self>
if into_left(&self) returns true.
Converts self into a Right variant of Either<Self, Self>
otherwise. Read more