Function parse_l7_config

crates/openshell-supervisor-network/src/l7/mod.rs:164–267

Parse an L7 endpoint config from a regorus Value (returned by Rego query). The value is expected to be the raw endpoint object from the Rego data, containing fields: `protocol`, optionally `tls`, `enforcement`.

(val: &regorus::Value)

/// The value is expected to be the raw endpoint object from the Rego data,
/// containing fields: `protocol`, optionally `tls`, `enforcement`.
pub fn parse_l7_config(val: &regorus::Value) -> Option<L7EndpointConfig> {
    let protocol_val = get_object_str(val, "protocol")?;
    let protocol = L7Protocol::parse(&protocol_val)?;

    let tls = match get_object_str(val, "tls").as_deref() {
        Some("skip") => TlsMode::Skip,
        Some("terminate") => {
            let event = openshell_ocsf::NetworkActivityBuilder::new(openshell_ocsf::ctx::ctx())
                .activity(openshell_ocsf::ActivityId::Other)
                .severity(openshell_ocsf::SeverityId::Medium)
                .message(
                    "'tls: terminate' is deprecated; TLS termination is now automatic. \
                     Use 'tls: skip' to explicitly disable. This field will be removed in a future version.",
                )
                .build();
            openshell_ocsf::ocsf_emit!(event);
            TlsMode::Auto
        }
        Some("passthrough") => {
            let event = openshell_ocsf::NetworkActivityBuilder::new(openshell_ocsf::ctx::ctx())
                .activity(openshell_ocsf::ActivityId::Other)
                .severity(openshell_ocsf::SeverityId::Medium)
                .message(
                    "'tls: passthrough' is deprecated; TLS termination is now automatic. \
                     Use 'tls: skip' to explicitly disable. This field will be removed in a future version.",
                )
                .build();
            openshell_ocsf::ocsf_emit!(event);
            TlsMode::Auto
        }
        _ => TlsMode::Auto,
    };

    let enforcement = match get_object_str(val, "enforcement").as_deref() {
        Some("enforce") => EnforcementMode::Enforce,
        _ => EnforcementMode::Audit,
    };

    let allow_encoded_slash = get_object_bool(val, "allow_encoded_slash").unwrap_or(false);
    let websocket_credential_rewrite =
        get_object_bool(val, "websocket_credential_rewrite").unwrap_or(false);
    let request_body_credential_rewrite =
        get_object_bool(val, "request_body_credential_rewrite").unwrap_or(false);
    let websocket_graphql_policy =
        protocol == L7Protocol::Websocket && endpoint_has_graphql_policy(val);
    let graphql_max_body_bytes = get_object_u64(val, "graphql_max_body_bytes")
        .and_then(|v| usize::try_from(v).ok())
        .filter(|v| *v > 0)
        .unwrap_or(graphql::DEFAULT_MAX_BODY_BYTES);
    let json_rpc_max_body_bytes = get_object_u64(val, "json_rpc_max_body_bytes")
        .and_then(|v| usize::try_from(v).ok())
        .filter(|v| *v > 0)
        .unwrap_or(jsonrpc::DEFAULT_MAX_BODY_BYTES);
    let mcp_strict_tool_names = protocol == L7Protocol::Mcp
        && get_object_bool(val, "mcp_strict_tool_names").unwrap_or(true);

    let credential_signing = match get_object_str(val, "credential_signing").as_deref() {
        Some("sigv4") => CredentialSigning::SigV4,