Function relay_rest

crates/openshell-supervisor-network/src/l7/relay.rs:738–988

REST relay loop: parse request -> evaluate -> allow/deny -> relay response -> repeat.

(
    config: &L7EndpointConfig,
    engine: &TunnelPolicyEngine,
    client: &mut C,
    upstream: &mut U,
    ctx: &L7EvalContext,
)

/// REST relay loop: parse request -> evaluate -> allow/deny -> relay response -> repeat.
async fn relay_rest<C, U>(
    config: &L7EndpointConfig,
    engine: &TunnelPolicyEngine,
    client: &mut C,
    upstream: &mut U,
    ctx: &L7EvalContext,
) -> Result<()>
where
    C: AsyncRead + AsyncWrite + Unpin + Send,
    U: AsyncRead + AsyncWrite + Unpin + Send,
{
    // Build a provider carrying the per-endpoint canonicalization options so
    // request parsing honors the endpoint's `allow_encoded_slash` setting
    // (e.g. APIs like GitLab that embed `%2F` in path segments).
    let provider =
        crate::l7::rest::RestProvider::with_options(crate::l7::path::CanonicalizeOptions {
            allow_encoded_slash: config.allow_encoded_slash,
            ..Default::default()
        });
    loop {
        if close_if_stale(engine.generation_guard(), ctx) {
            return Ok(());
        }

        // Parse one HTTP request from client
        let req = match provider.parse_request(client).await {
            Ok(Some(req)) => req,
            Ok(None) => return Ok(()), // Client closed connection
            Err(e) => {
                if is_benign_connection_error(&e) {
                    debug!(
                        host = %ctx.host,
                        port = ctx.port,
                        error = %e,
                        "L7 connection closed"
                    );
                } else {
                    let detail =
                        parse_rejection_detail(&e.to_string(), ParseRejectionMode::L7Endpoint);
                    emit_parse_rejection(ctx, &detail, "l7");
                }
                return Ok(()); // Close connection on parse error
            }
        };

        if deny_h2c_upgrade_if_requested(&req, config, ctx, client).await? {
            return Ok(());
        }

        if close_if_stale(engine.generation_guard(), ctx) {
            return Ok(());
        }

        // Rewrite credential placeholders in the request target BEFORE OPA
        // evaluation. OPA sees the redacted path; the resolved path goes only
        // to the upstream write.
        let (eval_target, redacted_target) = if let Some(ref resolver) = ctx.secret_resolver {
            match secrets::rewrite_target_for_eval(&req.target, resolver) {