Function evaluate_l7_request

crates/openshell-supervisor-network/src/l7/relay.rs:1492–1518

Evaluate an L7 request against the OPA engine. Returns `(allowed, deny_reason)`.

(
    engine: &TunnelPolicyEngine,
    ctx: &L7EvalContext,
    request: &L7RequestInfo,
)

///
/// Returns `(allowed, deny_reason)`.
pub fn evaluate_l7_request(
    engine: &TunnelPolicyEngine,
    ctx: &L7EvalContext,
    request: &L7RequestInfo,
) -> Result<(bool, String)> {
    if let Some(jsonrpc) = &request.jsonrpc
        && jsonrpc.is_batch
        && !jsonrpc.calls.is_empty()
    {
        if jsonrpc.has_response {
            let (allowed, reason) = evaluate_l7_request_once(engine, ctx, request)?;
            if !allowed {
                return Ok((false, reason));
            }
        }
        for call in &jsonrpc.calls {
            let item_request = jsonrpc_request_for_call(request, call);
            let (allowed, reason) = evaluate_l7_request_once(engine, ctx, &item_request)?;
            if !allowed {
                return Ok((false, reason));
            }
        }
        return Ok((true, String::new()));
    }

    evaluate_l7_request_once(engine, ctx, request)
}

fn evaluate_jsonrpc_l7_request_for_log(
    engine: &TunnelPolicyEngine,