Function open_ws

crates/openshell-cli/src/edge_tunnel.rs:151–183

Open a WebSocket connection to the edge proxy.

(config: &TunnelConfig)

/// Open a WebSocket connection to the edge proxy.
async fn open_ws(config: &TunnelConfig) -> Result<WebSocketStream<MaybeTlsStream<TcpStream>>> {
    let mut request = (&config.ws_url).into_client_request().into_diagnostic()?;

    // Inject the bearer token via multiple headers for compatibility with
    // Cloudflare Access (which checks `Cf-Access-Token`, the
    // `CF_Authorization` cookie, and the `Cf-Access-Jwt-Assertion` header).
    let token_val = HeaderValue::from_str(&config.edge_token)
        .map_err(|e| miette::miette!("invalid edge token header value: {e}"))?;
    request
        .headers_mut()
        .insert("Cf-Access-Token", token_val.clone());
    request
        .headers_mut()
        .insert("Cf-Access-Jwt-Assertion", token_val);
    request.headers_mut().insert(
        "Cookie",
        HeaderValue::from_str(&format!("CF_Authorization={}", config.edge_token))
            .map_err(|e| miette::miette!("invalid edge token cookie value: {e}"))?,
    );

    debug!(url = %config.ws_url, "opening WebSocket to edge");

    let (ws_stream, response) = tokio_tungstenite::connect_async(request)
        .await
        .map_err(|e| miette::miette!("WebSocket connect failed: {e}"))?;

    debug!(
        status = %response.status(),
        "WebSocket connected to edge"
    );

    Ok(ws_stream)
}

/// Copy bytes from a local TCP reader into WebSocket binary frames.
async fn copy_tcp_to_ws(