Function query_allowed_ips

crates/openshell-supervisor-network/src/proxy.rs:2730–2770

Query `allowed_ips` from the matched endpoint config for a CONNECT decision.

(
    engine: &OpaEngine,
    decision: &ConnectDecision,
    host: &str,
    port: u16,
)

/// Query `allowed_ips` from the matched endpoint config for a CONNECT decision.
fn query_allowed_ips(
    engine: &OpaEngine,
    decision: &ConnectDecision,
    host: &str,
    port: u16,
) -> Vec<String> {
    // Only query if action is Allow with a matched policy
    let has_policy = match &decision.action {
        NetworkAction::Allow { matched_policy } => matched_policy.is_some(),
        NetworkAction::Deny { .. } => false,
    };
    if !has_policy {
        return vec![];
    }

    let input = crate::opa::NetworkInput {
        host: host.to_string(),
        port,
        binary_path: decision.binary.clone().unwrap_or_default(),
        binary_sha256: String::new(),
        ancestors: decision.ancestors.clone(),
        cmdline_paths: decision.cmdline_paths.clone(),
    };

    match engine.query_allowed_ips(&input) {
        Ok(ips) => ips,
        Err(e) => {
            let event = NetworkActivityBuilder::new(openshell_ocsf::ctx::ctx())
                .activity(ActivityId::Fail)
                .severity(SeverityId::Low)
                .status(StatusId::Failure)
                .dst_endpoint(Endpoint::from_domain(host, port))
                .message(format!(
                    "Failed to query allowed_ips from endpoint config: {e}"
                ))
                .build();
            ocsf_emit!(event);
            vec![]
        }
    }
}

/// Query whether the matched endpoint was declared as this exact hostname.
fn query_exact_declared_endpoint_host(