Function emit_l7_request_log

crates/openshell-supervisor-network/src/l7/relay.rs:523–563

(
    ctx: &L7EvalContext,
    request_info: &L7RequestInfo,
    redacted_target: &str,
    decision_str: &str,
    engine_type: &str,
    reason: &str,
    protocol_summary: &str,
)

}

fn emit_l7_request_log(
    ctx: &L7EvalContext,
    request_info: &L7RequestInfo,
    redacted_target: &str,
    decision_str: &str,
    engine_type: &str,
    reason: &str,
    protocol_summary: &str,
) {
    let (action_id, disposition_id, severity) = match decision_str {
        "deny" => (ActionId::Denied, DispositionId::Blocked, SeverityId::Medium),
        "allow" | "audit" => (
            ActionId::Allowed,
            DispositionId::Allowed,
            SeverityId::Informational,
        ),
        _ => (
            ActionId::Other,
            DispositionId::Other,
            SeverityId::Informational,
        ),
    };
    let event = HttpActivityBuilder::new(openshell_ocsf::ctx::ctx())
        .activity(ActivityId::Other)
        .action(action_id)
        .disposition(disposition_id)
        .severity(severity)
        .http_request(HttpRequest::new(
            &request_info.action,
            OcsfUrl::new("http", &ctx.host, redacted_target, ctx.port),
        ))
        .dst_endpoint(Endpoint::from_domain(&ctx.host, ctx.port))
        .firewall_rule(&ctx.policy_name, engine_type)
        .message(format!(
            "L7_REQUEST {decision_str} {} {}:{}{}{} reason={}",
            request_info.action, ctx.host, ctx.port, redacted_target, protocol_summary, reason,
        ))
        .build();
    ocsf_emit!(event);
    emit_activity(ctx, decision_str == "deny", "l7_policy");
}

fn l7_protocol_log_summary(
    graphql_info: Option<&crate::l7::graphql::GraphqlRequestInfo>,