trending/OpenShell
1
0
Fork 0
mirror of https://github.com/NVIDIA/OpenShell.git synced 2026-10-25 06:42:52 +08:00
Code Issues Packages Projects Releases Wiki Activity

chore: merge main into Podman OCI workdir

Browse Source 
Signed-off-by: Matthew Grossman <mgrossman@nvidia.com>
This commit is contained in:
Matthew Grossman
2026-08-10 14:22:14 -07:00
parent 10faeb4d40 170961997f
commit bc9f2a9e07
71 changed files with 13605 additions and 1675 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.agents/skills/debug-inference/SKILL.md
+22
View File
@@ -239,6 +239,26 @@ Check instead:
3. The sandbox has that provider attached (`openshell sandbox provider list [name]`)
4. `network_policies` allow that host, port, and HTTP rules
If the response reports `credential_endpoint_mismatch`, the provider is attached
but its credential profile does not authorize that request recipient. Run
`openshell provider get <provider-name>` to identify the provider type, then
inspect its profile endpoints with
`openshell provider profile export <type> -o yaml`. That export uses the current
workspace scope; add `--global` when the provider was created with
`--global-profile`. Compare the profile's endpoint host, port, and path with the
direct request. Correct the provider selection or profile endpoint when that
recipient is intentional. Do not widen the sandbox network policy to work around
the mismatch: policy admission and credential endpoint authorization are
separate checks, and the provider profile should authorize only intended
credential recipients.
If the response reports `request_authority_mismatch`, compare the HTTP request
authority with the CONNECT tunnel endpoint. The host and effective port must
match. For a tunnel to `api.example.com:8443`, send
`Host: api.example.com:8443`; omitting the non-default port makes the request
authority use the transport default and OpenShell rejects it. An absolute-form
request target must use the same authority.
Attach or detach a provider on an existing sandbox with `openshell sandbox provider attach <sandbox> <provider>` and `openshell sandbox provider detach <sandbox> <provider>`.
Use the `generate-sandbox-policy` skill when the user needs help authoring policy YAML.
@@ -348,6 +368,8 @@ Both commands should return the upstream model list.
| `no compatible route` | Provider type does not match request shape | Create or select a provider of the matching type, or change the client API |
| `inference.local` works but a platform function fails | User route is configured but `sandbox-system` is missing or wrong | `openshell inference get --system`; configure or update with `--system`; inspect supervisor logs |
| Direct call to external host is denied | Missing policy or provider attachment | Update `network_policies` and launch sandbox with the right provider |
| Direct call returns `credential_endpoint_mismatch` | Attached provider profile does not authorize the request host, port, or path | Inspect the provider profile endpoints; select or update the profile only if it intentionally authorizes that recipient |
| Direct call returns `request_authority_mismatch` | HTTP authority does not match the CONNECT host and effective port | Include the explicit non-default port in `Host` and use the same authority in absolute-form targets |
| SDK fails on empty auth token | Client requires a non-empty API key even though OpenShell injects the real one | Use any placeholder token such as `test` |
| Upstream timeout from container to host-local backend | Host firewall or network config blocks container-to-host traffic | Allow the Docker bridge subnet to reach the inference port on the host gateway IP (see firewall fix section above) |
.agents/skills/debug-openshell-cluster/SKILL.md
+3
View File
@@ -239,6 +239,9 @@ release. Look for failed installs, unexpected values, missing namespace, wrong
image tag, TLS settings that do not match the registered endpoint, and
scheduling failures.
`server.telemetryEnabled` renders `OPENSHELL_TELEMETRY_ENABLED` on the gateway
pod, and the gateway propagates the effective value to sandbox supervisors.
When no external credential driver is enabled, the Helm chart uses the
gateway's default encrypted database credential storage. The chart creates a
retained Kubernetes Secret for the shared KEK, injects it into gateway pods, and
.agents/skills/generate-sandbox-policy/SKILL.md
+11 -1
View File
@@ -384,6 +384,9 @@ Before presenting the policy to the user, verify correctness **and** flag breadt
- [ ] `protocol: rest` on port 443 should have `tls: terminate`
- [ ] HTTP methods are standard: GET, HEAD, POST, PUT, DELETE, PATCH, OPTIONS, or `*`
- [ ] Credentialed destinations are also covered by the attached provider
profile endpoint; policy admission alone does not authorize credential
resolution
### Structural Checks
@@ -443,10 +446,17 @@ The policy needs to go somewhere. Determine which mode applies:
2. **Check for conflicts**:
- Does a policy with the same key already exist? If so, ask the user whether to **replace** it, **merge** new endpoints/binaries into it, or use a different key.
- Does an existing endpoint selector overlap the new selector? Compatible overlaps are allowed and can intentionally aggregate allow and deny rules. Reject or revise equally specific overlaps that disagree on connection or request-processing metadata, including TLS, destination constraints, protocol/parser behavior, enforcement, or credential handling. A more-specific path selector may override broader request-processing metadata.
- If the sandbox uses an attached provider credential, confirm the provider
profile also declares the intended host, port, and path. A sandbox policy
allow cannot expand the profile's static credential binding.
- For `credential_signing`, confirm an attached endpoint-bearing profile
declares `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` and covers the
signed endpoint. For an endpointless AWS profile, add
`credential_binding.provider` with the exact attached provider name.
3. **Apply the change**:
- **Adding a new policy**: Insert the new policy block under `network_policies`, maintaining the file's existing indentation and style.
- **Modifying an existing policy**: Edit the specific policy in place — add/remove endpoints, change access presets, update rules, add binaries, etc.
- **Modifying an existing policy**: Edit the specific policy in place — add/remove endpoints, change access presets, update rules, add binaries, etc. A rule authorizes every binary it lists to reach every endpoint and port it lists, so adding one binary grants it all of that rule's endpoints, and adding one endpoint grants it to all of that rule's binaries. State the resulting pairs to the user before writing them. When the user wants a binary to reach only part of a rule's endpoints, put that binary and those endpoints in a separate rule instead of extending the existing one. An empty `binaries` list means any binary, so leaving it off widens the rule to every process.
- **Removing a policy**: Delete the policy block if the user asks.
4. **Preserve everything else**: Do not modify `filesystem_policy`, `landlock`, `process`, or other policies unless the user explicitly asks.
.agents/skills/launch-openshell-gator/SKILL.md
+3
View File
@@ -384,6 +384,9 @@ The wrapper intentionally blocks duplicate same-head-SHA gator dispositions. A r
- The earlier attempt failed before posting.
- The prior marked disposition was only a reviewer infrastructure failure.
- The prior marked disposition was only a draft blocker and the PR is now ready for review.
- A state-specific TTL nudge is due after 48 business hours. The nudge may request
the pending human action, but it must not repeat the review disposition or
trigger another reviewer run.
Do not bypass with `OPENSHELL_GATOR_ALLOW_SAME_SHA_COMMENT=1` unless the operator explicitly confirms a maintainer override.
.agents/skills/openshell-cli/SKILL.md
+36 -3
View File
@@ -122,7 +122,22 @@ Bare `KEY` reads the value from the environment variable of that name and avoids
Other credential sources are `--from-gcloud-adc` for compatible profiles and `--runtime-credentials` when the gateway or sandbox resolves the required credentials at runtime.
Profile-backed provider policy and composition are controlled by the gateway-global `providers_v2_enabled` setting:
Static provider credentials resolve only for hosts, ports, and paths declared by
the provider profile. Use `provider profile export` to inspect that boundary
when a placeholder is present but requests receive
`credential_endpoint_mismatch`. A profileless static provider fails closed
because the gateway cannot construct a binding.
When an inspected request receives `request_authority_mismatch`, compare its
HTTP authority with the CONNECT tunnel endpoint. The host and effective port
must match. For a tunnel to `api.example.com:8443`, send
`Host: api.example.com:8443`; `Host: api.example.com` omits the non-default
port and is rejected. An absolute-form request target must use the same
authority.
Profile-backed provider policy composition is controlled by the gateway-global
`providers_v2_enabled` setting. Static credential endpoint binding remains
active even when policy composition is disabled:
```bash
openshell settings get --global
@@ -367,7 +382,10 @@ provider-profile policy—before it stores a direct update, incremental merge,
approved proposal, provider attachment, or profile update that affects attached
sandboxes. An ambiguity failure returns `FAILED_PRECONDITION`; the rejected
candidate does not create a policy revision or partially update affected
sandboxes. Fix the conflicting endpoint selectors and submit again.
sandboxes. The same fail-closed response applies when `credential_signing`
does not have an attached AWS profile whose credential boundary covers the
endpoint, or an explicit binding to an endpointless AWS profile. Fix the
conflicting endpoint selectors or credential source and submit again.
The `--wait` flag blocks until the sandbox confirms the policy is loaded (polls every second). Exit codes:
- **0**: Policy loaded successfully
@@ -514,7 +532,22 @@ When denied actions appear:
1. Prefer incremental updates for additive network changes:
`openshell policy update work-session --add-endpoint api.github.com:443:read-only:rest:enforce --binary /usr/bin/gh --wait`
`openshell policy update work-session --add-allow 'api.github.com:443:POST:/repos/*/issues' --wait`
2. Use full YAML replacement for broad changes or non-network fields:
A rule authorizes every binary it lists to reach every endpoint it lists, so
an update that adds a binary or an endpoint to an existing rule must declare
that rule's whole binary and endpoint scope. The gateway rejects an update
that would grant a binary-to-endpoint pair the update never asked for, and
the error names the binaries still missing. To grant one binary access to
only part of a rule's endpoints, send the narrow authorization under its own
`--rule-name`; it stays on its own rule instead of folding into the broader
one.
`--add-allow` and `--add-deny` select an endpoint by host and port alone. If
that host and port appears in more than one rule, or twice in one rule under
different paths, the update is rejected as ambiguous. Fall back to full YAML
replacement for those endpoints.
2. Use full YAML replacement for broad changes or non-network fields, including
any change that would otherwise require restating a large existing scope:
`openshell policy get work-session --full > policy.yaml`
Modify the policy with the `generate-sandbox-policy` skill.
`openshell policy set work-session --policy policy.yaml --wait`
.agents/skills/test-release-canary/SKILL.md
+6
View File
@@ -16,6 +16,11 @@ The Release Canary (`.github/workflows/release-canary.yml`) smoke-tests the arti
| `fedora` | `fedora:latest` container | `install.sh` installs the RPM packages, the local gateway starts under Podman, and `openshell status` succeeds. |
| `kubernetes` | `ubuntu-latest` + kind | `helm install oci://ghcr.io/nvidia/openshell/helm-chart --version 0.0.0-dev` succeeds in a kind cluster, the gateway pod becomes Ready, port-forward exposes 8080, and the released CLI registers the in-cluster gateway and runs `openshell status` against it. |
All canary jobs disable anonymous OpenShell telemetry. Host package jobs inject
`OPENSHELL_TELEMETRY_ENABLED=false` through the service environment, and the
Kubernetes job installs with `server.telemetryEnabled=false`, so smoke traffic
does not contribute to product usage metrics.
`install.sh` defaults to the *latest tagged* release — the canary is therefore checking that the most recent public release still installs, not the just-published `dev` build. The `kubernetes` job is the exception: it pins to `0.0.0-dev` chart + `:dev` images.
## Trigger paths
@@ -83,6 +88,7 @@ helm install openshell oci://ghcr.io/nvidia/openshell/helm-chart \
--version 0.0.0-dev \
--namespace openshell --create-namespace \
--set server.disableTls=true \
--set server.telemetryEnabled=false \
--wait --timeout 5m
kubectl wait --namespace openshell \
.github/workflows/release-canary.yml
+12 -2
View File
@@ -14,6 +14,9 @@ defaults:
run:
shell: bash
env:
OPENSHELL_TELEMETRY_ENABLED: "false"
jobs:
macos:
name: macOS Homebrew
@@ -24,6 +27,7 @@ jobs:
- name: Ensure VM driver
run: |
launchctl setenv OPENSHELL_DRIVERS vm
launchctl setenv OPENSHELL_TELEMETRY_ENABLED "$OPENSHELL_TELEMETRY_ENABLED"
- name: Install and check status
run: |
@@ -44,7 +48,8 @@ jobs:
fi
sudo systemctl start docker || sudo service docker start
mkdir -p "${HOME}/.config/openshell"
printf 'OPENSHELL_DRIVERS=docker\n' > "${HOME}/.config/openshell/gateway.env"
printf 'OPENSHELL_DRIVERS=docker\nOPENSHELL_TELEMETRY_ENABLED=%s\n' \
"$OPENSHELL_TELEMETRY_ENABLED" > "${HOME}/.config/openshell/gateway.env"
docker info
- name: Install and check status
@@ -130,11 +135,13 @@ jobs:
HOME=/root \
XDG_RUNTIME_DIR=/run/user/0 \
DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/0/bus \
OPENSHELL_TELEMETRY_ENABLED="$OPENSHELL_TELEMETRY_ENABLED" \
INSTALL_SH_URL="https://raw.githubusercontent.com/NVIDIA/OpenShell/${{ github.event.workflow_run.head_sha || github.sha }}/install.sh" \
bash -s <<'EOF'
set -euo pipefail
mkdir -p "${HOME}/.config/openshell"
printf 'OPENSHELL_DRIVERS=podman\n' > "${HOME}/.config/openshell/gateway.env"
printf 'OPENSHELL_DRIVERS=podman\nOPENSHELL_TELEMETRY_ENABLED=%s\n' \
"$OPENSHELL_TELEMETRY_ENABLED" > "${HOME}/.config/openshell/gateway.env"
podman info
curl -LsSf "${INSTALL_SH_URL}" | sh
openshell status
@@ -177,6 +184,8 @@ jobs:
- name: Install snap (dangerous — from release, not store)
run: |
set -euo pipefail
sudo systemctl set-environment \
"OPENSHELL_TELEMETRY_ENABLED=${OPENSHELL_TELEMETRY_ENABLED}"
sudo snap install ./release/*.snap --dangerous
- name: Connect interfaces
@@ -222,6 +231,7 @@ jobs:
--version 0.0.0-dev \
--namespace "$RELEASE_NAMESPACE" --create-namespace \
--set server.disableTls=true \
--set "server.telemetryEnabled=${OPENSHELL_TELEMETRY_ENABLED}" \
--wait --timeout 5m
- name: Verify gateway pod is Ready
README.md
+1 -1
View File
@@ -258,7 +258,7 @@ OpenShell is built agent-first — your agent is your first collaborator. Before
OpenShell collects anonymous telemetry to help improve the project for developers. This data is not used to track individual user behavior. It helps us understand aggregate usage of sandbox, provider, and policy workflows so we can prioritize product improvements and share usage trends with the community.
Disable telemetry at runtime by setting `OPENSHELL_TELEMETRY_ENABLED=false` on the gateway deployment. OpenShell propagates this deployment setting into sandbox supervisor environments so sandbox-side telemetry collection is disabled as well.
Disable telemetry at runtime by setting `OPENSHELL_TELEMETRY_ENABLED=false` on the gateway deployment. For Helm installs, set `server.telemetryEnabled=false`. OpenShell propagates this deployment setting into sandbox supervisor environments so sandbox-side telemetry collection is disabled as well.
You can also compile telemetry out entirely. Telemetry support is a default-on `telemetry` Cargo feature; building with `--no-default-features` produces binaries that contain no telemetry endpoint, no telemetry HTTP client, and no emission code. Build telemetry-free artifacts with, for example, `cargo build --release -p openshell-server --no-default-features` (gateway) and the equivalent for `openshell-sandbox` and `openshell-driver-vm`. With telemetry compiled out, the gateway emits nothing and reports telemetry disabled to the sandboxes it launches.
architecture/build.md
+4
View File
@@ -196,6 +196,10 @@ The high-level CI model:
5. Gate jobs verify that the mirror branch matches the PR head, or that the merge-group workflow ran for the queued SHA, and that the expected non-gate workflow actually ran.
6. Release workflows rebuild and publish binaries, wheels, images, and docs.
Repository CI keeps telemetry compiled into release-parity artifacts but
disables emission for Rust tests, E2E runs, and release canaries. This prevents
synthetic activity from contributing to product usage metrics.
See `CI.md` for the contributor workflow, labels, and maintainer merge-queue workflow.
## Docs Site
architecture/gateway.md
+12
View File
@@ -434,6 +434,18 @@ resolution and again by the sandbox placeholder resolver. This keeps expired
credentials from resolving even when a running sandbox still has retained
placeholder generations from an earlier provider credential snapshot.
Static credential delivery is capability-negotiated and endpoint-bound. The
gateway classifies each returned environment entry as either a credential or
non-secret provider configuration and associates every credential key with the
host, port, and path selectors from its effective provider profile. It withholds
static credential material from supervisors that do not advertise binding
support. If a selected provider profile has no usable endpoint, the gateway
withholds only that profile's static credential keys and their expiry and
binding metadata. It continues to return provider-generated non-secret
configuration, valid endpoint-bound static credentials from other attached
providers, and the dynamic credential snapshot. Provider environment revisions
include profile endpoint and binding changes.
## Inference Resolution
Cluster inference routes store only `provider_name`, `model_id`, and optional
architecture/sandbox.md
+33 -1
View File
@@ -72,6 +72,24 @@ its guarded single-request relay while sharing authorization, request context,
policy-pinning, and destination boundaries.
Adapter-specific response and OCSF event shapes remain at the protocol boundary.
Provider credential placeholders are resolved through the live provider state
for each HTTP request, after destination and L7 policy admission. A static
credential resolves only when the request host, port, and path match an endpoint
in that provider's effective profile. CONNECT, absolute-form forward HTTP,
request targets, headers, supported request bodies, SigV4 signing, and opted-in
WebSocket text rewriting use the same scoped resolver. Provider refresh swaps
credential values and endpoint bindings atomically. An invalid or unavailable
refresh revokes the previous static credential state instead of leaving a
partially active or last-known-good static set. Invalid metadata preserves the
supplied dynamic snapshot, while a fetch failure preserves the currently active
dynamic snapshot.
Route selection and policy evaluation use a syntax-only redacted request target;
they do not materialize real credentials. Cross-endpoint placeholder use returns
HTTP 403. After a WebSocket upgrade it closes the connection with policy
violation code 1008. Both paths emit a denied activity event and a detection
finding without logging the placeholder, environment key, secret, or query.
For inspected HTTP traffic, the proxy can enforce REST method/path rules,
WebSocket upgrade and text-message rules, GraphQL operation rules, and
MCP method, tool, and supported params rules or generic JSON-RPC method rules
@@ -219,7 +237,12 @@ For AWS endpoints that require request-level signing, the proxy supports SigV4
re-signing. When `credential_signing: sigv4` is set on an L7 endpoint, the proxy
strips the client's placeholder-based AWS auth headers, re-signs with real
credentials from the provider, and forwards the request upstream. The signing
mode is auto-detected from the client SDK's `x-amz-content-sha256` header:
endpoint must have a credential source before the policy generation activates:
an attached endpoint-bearing AWS profile whose boundary covers the endpoint, or
an attached endpointless AWS profile explicitly named by the endpoint's
`credential_binding.provider`. Policy activation rejects missing or mismatched
sources atomically. The signing mode is auto-detected from the client SDK's
`x-amz-content-sha256` header:
- **Signed body** (hex hash): buffers the request body (up to 10 MiB), computes
its SHA-256, and includes the hash in the signature. Used by Bedrock and most
@@ -296,6 +319,15 @@ remains `Pending`. If the first poll returns a different revision, the superviso
processes it through the normal reload path instead of treating it as already
loaded.
A newer sandbox-scoped revision can carry the same non-empty effective policy
hash as the currently loaded revision, for example when provenance changes
without changing enforcement content. The supervisor acknowledges that newer
revision without reloading identical policy. If the revision also requires
middleware or policy-runtime reconciliation, acknowledgement waits until that
reconciliation succeeds. Global policies, local overrides, equal or older
versions, and different hashes do not use this shortcut. Success telemetry is
emitted only after the gateway accepts the resulting loaded-status report.
Policy status delivery uses a FIFO background worker. Retryable delivery
failures retain the ordered update and retry with capped exponential backoff;
terminal errors are logged and discarded. The outbox is nonblocking and does
architecture/security-policy.md
+8
View File
@@ -81,6 +81,14 @@ with the sandbox's ephemeral CA and inspect method/path or protocol-specific
metadata before forwarding. The proxy also supports credential injection on
terminated HTTP streams when policy allows the endpoint.
Static provider credentials have an independent endpoint-binding boundary.
Provider profile endpoints define that boundary by default. An endpointless
profile can delegate binding authority to sandbox policy through an endpoint
that names the concrete attached provider instance. The gateway rejects
unattached, profileless, endpointful, and gateway-global uses of that policy
binding. Policy endpoint changes rotate the provider-environment revision so
the supervisor installs policy and credential binding snapshots atomically.
Raw streams and long-lived response bodies are connection scoped. Policy
generation changes close relays pinned to the previous generation instead of
allowing them to continue under stale authorization. HTTP upgrades switch to
crates/openshell-core/src/endpoint_path.rs
+102
View File
@@ -0,0 +1,102 @@
// SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
// SPDX-License-Identifier: Apache-2.0
//! Canonical provider endpoint path matching shared by policy and runtime code.
/// A compiled provider endpoint path pattern.
///
/// Invalid glob syntax retains the existing fail-closed behavior: it matches
/// only when the request path is exactly equal to the configured pattern.
#[derive(Debug, Clone)]
pub struct EndpointPathPattern {
source: String,
kind: EndpointPathPatternKind,
}
#[derive(Debug, Clone)]
enum EndpointPathPatternKind {
Any,
Subtree(String),
Glob(glob::Pattern),
Invalid,
}
impl EndpointPathPattern {
#[must_use]
pub fn new(pattern: &str) -> Self {
let kind = if pattern.is_empty() || pattern == "**" || pattern == "/**" {
EndpointPathPatternKind::Any
} else if let Some(prefix) = pattern.strip_suffix("/**") {
EndpointPathPatternKind::Subtree(prefix.to_string())
} else {
glob::Pattern::new(pattern).map_or(
EndpointPathPatternKind::Invalid,
EndpointPathPatternKind::Glob,
)
};
Self {
source: pattern.to_string(),
kind,
}
}
#[must_use]
pub fn matches(&self, path: &str) -> bool {
if self.source == path {
return true;
}
match &self.kind {
EndpointPathPatternKind::Any => true,
EndpointPathPatternKind::Subtree(prefix) => {
path == prefix
|| path
.strip_prefix(prefix)
.is_some_and(|suffix| suffix.starts_with('/'))
}
EndpointPathPatternKind::Glob(pattern) => pattern.matches(path),
EndpointPathPatternKind::Invalid => false,
}
}
}
/// Return whether `path` is selected by a provider endpoint path pattern.
///
/// Empty paths and `**` match every request path. A trailing `/**` matches the
/// named path itself and every descendant. Other patterns use glob semantics.
#[must_use]
pub fn matches(pattern: &str, path: &str) -> bool {
EndpointPathPattern::new(pattern).matches(path)
}
#[cfg(test)]
mod tests {
use super::{EndpointPathPattern, matches};
#[test]
fn matches_canonical_endpoint_patterns() {
assert!(matches("", "/v1/messages"));
assert!(matches("/**", "/v1/messages"));
assert!(matches("/v1/**", "/v1"));
assert!(matches("/v1/**", "/v1/messages"));
assert!(matches("/v*/messages", "/v1/messages"));
assert!(matches("/v1/*", "/v1/chat/messages"));
assert!(!matches("/v1/**", "/v2/messages"));
assert!(!matches("/v1/*/messages", "/v1/chat/completions"));
}
#[test]
fn compiled_patterns_preserve_canonical_matching() {
let subtree = EndpointPathPattern::new("/v1/**");
assert!(subtree.matches("/v1"));
assert!(subtree.matches("/v1/chat/messages"));
assert!(!subtree.matches("/v2/messages"));
let glob = EndpointPathPattern::new("/v*/messages");
assert!(glob.matches("/v1/messages"));
assert!(!glob.matches("/v1/completions"));
let invalid = EndpointPathPattern::new("[");
assert!(invalid.matches("["));
assert!(!invalid.matches("/v1/messages"));
}
}
crates/openshell-core/src/grpc_client.rs
+5
View File
@@ -741,6 +741,7 @@ pub async fn fetch_provider_environment(
let response = client
.get_sandbox_provider_environment(GetSandboxProviderEnvironmentRequest {
sandbox_id: sandbox_id.to_string(),
supports_static_credential_bindings: true,
})
.await
.into_diagnostic()?;
@@ -751,6 +752,8 @@ pub async fn fetch_provider_environment(
provider_env_revision: inner.provider_env_revision,
credential_expires_at_ms: inner.credential_expires_at_ms,
dynamic_credentials: inner.dynamic_credentials,
static_credential_bindings: inner.static_credential_bindings,
non_secret_environment_keys: inner.non_secret_environment_keys,
})
}
@@ -840,6 +843,8 @@ pub struct ProviderEnvironmentResult {
pub provider_env_revision: u64,
pub credential_expires_at_ms: HashMap<String, i64>,
pub dynamic_credentials: HashMap<String, crate::proto::ProviderProfileCredential>,
pub static_credential_bindings: HashMap<String, crate::proto::StaticCredentialBinding>,
pub non_secret_environment_keys: Vec<String>,
}
impl CachedOpenShellClient {
crates/openshell-core/src/host_pattern.rs
+12 -7
View File
@@ -12,13 +12,13 @@ use std::collections::{HashSet, VecDeque};
/// semantics mirror the Rego endpoint glob matching used for network policy
/// admission (`glob.match` with a `.` delimiter), so a pattern copied from a
/// network endpoint selects exactly the hosts that endpoint admits.
#[derive(Clone)]
#[derive(Debug, Clone)]
pub struct HostPattern {
source: String,
labels: Vec<HostLabelPattern>,
}
#[derive(Clone)]
#[derive(Debug, Clone)]
enum HostLabelPattern {
Recursive,
Label {
@@ -130,13 +130,18 @@ impl HostPattern {
#[must_use]
pub fn matches(&self, host: &str) -> bool {
let host = host.to_ascii_lowercase();
if host.split('.').any(str::is_empty) {
return false;
}
self.matches_labels(&host.split('.').collect::<Vec<_>>())
self.matches_normalized_labels(&host.split('.').collect::<Vec<_>>())
}
fn matches_labels(&self, host: &[&str]) -> bool {
/// Match pre-split lowercase DNS labels.
///
/// This avoids repeating request-host normalization when several compiled
/// patterns are evaluated against the same destination.
#[must_use]
pub(crate) fn matches_normalized_labels(&self, host: &[&str]) -> bool {
if host.iter().any(|label| label.is_empty()) {
return false;
}
let mut pending = vec![(0, 0)];
let mut visited = HashSet::new();
while let Some((pattern_idx, host_idx)) = pending.pop() {
crates/openshell-core/src/lib.rs
+1
View File
@@ -16,6 +16,7 @@ pub mod container_paths;
pub mod denial;
pub mod driver_mounts;
pub mod driver_utils;
pub mod endpoint_path;
pub mod error;
pub mod forward;
pub mod google_cloud;
crates/openshell-core/src/provider_credentials.rs
+1192 -15
View File
File diff suppressed because it is too large Load Diff
crates/openshell-core/src/secrets.rs
+276 -44
View File
@@ -3,8 +3,9 @@
use crate::time::now_ms;
use base64::Engine as _;
use std::collections::HashMap;
use std::collections::{HashMap, HashSet};
use std::fmt;
use std::sync::Arc;
const PLACEHOLDER_PREFIX: &str = "openshell:resolve:env:";
const PROVIDER_ALIAS_MARKER: &str = "OPENSHELL-RESOLVE-ENV-";
@@ -41,21 +42,55 @@ pub fn contains_reserved_credential_marker(value: &str) -> bool {
/// Error returned when a placeholder cannot be resolved or a resolved secret
/// contains prohibited characters.
#[derive(Debug)]
#[derive(Debug, miette::Diagnostic)]
pub struct UnresolvedPlaceholderError {
pub location: &'static str, // "header", "query_param", "path"
reason: UnresolvedPlaceholderReason,
}
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
enum UnresolvedPlaceholderReason {
Unavailable,
EndpointMismatch,
}
impl UnresolvedPlaceholderError {
#[must_use]
pub fn unavailable(location: &'static str) -> Self {
unresolved(location)
}
#[must_use]
pub fn is_endpoint_mismatch(&self) -> bool {
self.reason == UnresolvedPlaceholderReason::EndpointMismatch
}
}
impl fmt::Display for UnresolvedPlaceholderError {
fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
write!(
f,
"unresolved credential placeholder in {}: detected reserved credential token that could not be resolved",
self.location
"{} in {}",
match self.reason {
UnresolvedPlaceholderReason::Unavailable =>
"credential placeholder could not be resolved",
UnresolvedPlaceholderReason::EndpointMismatch =>
"credential is not authorized for the request endpoint",
},
self.location,
)
}
}
impl std::error::Error for UnresolvedPlaceholderError {}
fn unresolved(location: &'static str) -> UnresolvedPlaceholderError {
UnresolvedPlaceholderError {
location,
reason: UnresolvedPlaceholderReason::Unavailable,
}
}
/// Result of rewriting an HTTP header block with credential resolution.
#[derive(Debug)]
pub struct RewriteResult {
@@ -86,11 +121,14 @@ pub struct RewriteTargetResult {
#[derive(Clone, Default)]
pub struct SecretResolver {
by_placeholder: HashMap<String, SecretValue>,
denied_env_keys: HashSet<String>,
identity_bound_env_keys: HashSet<String>,
revision_fallback_allowed_revisions: HashMap<String, Arc<HashSet<u64>>>,
}
#[derive(Clone)]
struct SecretValue {
value: String,
value: Arc<str>,
expires_at_ms: i64,
}
@@ -186,7 +224,7 @@ impl SecretResolver {
}
let placeholder = placeholder_for_env_key_for_revision(&key, revision);
let secret = SecretValue {
value,
value: Arc::from(value),
expires_at_ms: credential_expires_at_ms
.get(&key)
.copied()
@@ -202,55 +240,170 @@ impl SecretResolver {
if by_placeholder.is_empty() {
(child_env, None)
} else {
(child_env, Some(Self { by_placeholder }))
(
child_env,
Some(Self {
by_placeholder,
denied_env_keys: HashSet::new(),
identity_bound_env_keys: HashSet::new(),
revision_fallback_allowed_revisions: HashMap::new(),
}),
)
}
}
pub fn merge<'a>(resolvers: impl IntoIterator<Item = &'a Self>) -> Option<Self> {
let mut by_placeholder = HashMap::new();
let mut denied_env_keys = HashSet::new();
let mut identity_bound_env_keys = HashSet::new();
let mut revision_fallback_allowed_revisions = HashMap::new();
for resolver in resolvers {
by_placeholder.extend(resolver.by_placeholder.clone());
denied_env_keys.extend(resolver.denied_env_keys.iter().cloned());
identity_bound_env_keys.extend(resolver.identity_bound_env_keys.iter().cloned());
revision_fallback_allowed_revisions
.extend(resolver.revision_fallback_allowed_revisions.clone());
}
if by_placeholder.is_empty() {
None
} else {
Some(Self { by_placeholder })
Some(Self {
by_placeholder,
denied_env_keys,
identity_bound_env_keys,
revision_fallback_allowed_revisions,
})
}
}
/// Return a cheap endpoint-scoped resolver view.
///
/// Secret strings are shared through cloned resolver entries. Credential
/// keys listed in `bound_keys` resolve only when also present in
/// `allowed_bound_keys`; unbound provider configuration remains available.
#[must_use]
pub fn scoped_to_env_keys(
&self,
bound_keys: &HashSet<String>,
allowed_bound_keys: &HashSet<String>,
revision_fallback_allowed_revisions: HashMap<String, Arc<HashSet<u64>>>,
) -> Self {
let denied_env_keys = bound_keys
.difference(allowed_bound_keys)
.cloned()
.collect::<HashSet<_>>();
let by_placeholder = self
.by_placeholder
.iter()
.filter(|(placeholder, _)| {
placeholder_env_key(placeholder).is_none_or(|key| !denied_env_keys.contains(key))
})
.map(|(placeholder, secret)| (placeholder.clone(), secret.clone()))
.collect();
Self {
by_placeholder,
denied_env_keys,
identity_bound_env_keys: bound_keys.clone(),
revision_fallback_allowed_revisions,
}
}
fn unresolved_for(
&self,
location: &'static str,
placeholder: &str,
) -> UnresolvedPlaceholderError {
let reason = if placeholder_env_key(placeholder)
.is_some_and(|key| self.denied_env_keys.contains(key))
{
UnresolvedPlaceholderReason::EndpointMismatch
} else {
UnresolvedPlaceholderReason::Unavailable
};
UnresolvedPlaceholderError { location, reason }
}
/// Resolve a placeholder string to the real secret value.
///
/// Returns `None` if the placeholder is unknown or the resolved value
/// contains prohibited control characters (CRLF, null byte).
pub fn resolve_placeholder(&self, value: &str) -> Option<&str> {
if placeholder_env_key(value).is_some_and(|key| self.identity_bound_env_keys.contains(key))
&& revisioned_placeholder_parts(value).is_none()
{
// Canonical placeholders and provider-shaped aliases carry no
// credential identity. Endpoint-bound request input must use the
// revision-scoped placeholder issued to the workload so a stale
// process cannot resolve a replacement provider's credential.
return None;
}
let secret = if let Some(secret) = self.by_placeholder.get(value) {
secret
} else {
// Once an old generation ages out, the revision number is only a
// namespace marker. Fall back by key to the current credential so
// long-running child processes survive provider credential refresh.
// Once an old generation ages out, fall back by key to the current
// credential so long-running child processes survive provider
// credential refresh. For endpoint-bound credentials, permit that
// fallback only when the exact opaque revision belongs to the
// current provider-identity epoch.
let key = revisioned_placeholder_env_key(value).or_else(|| alias_env_key(value))?;
if let Some((revision, key)) = revisioned_placeholder_parts(value)
&& self.identity_bound_env_keys.contains(key)
&& self
.revision_fallback_allowed_revisions
.get(key)
.is_none_or(|revisions| !revisions.contains(&revision))
{
return None;
}
let canonical = placeholder_for_env_key(key);
self.by_placeholder.get(&canonical)?
};
if secret.expires_at_ms > 0 && secret.expires_at_ms <= now_ms() {
tracing::warn!(
location = "resolve_placeholder",
"credential resolution rejected: credential is expired"
);
return None;
resolve_secret_value(secret)
}
/// Resolve the current value for an environment key selected by trusted
/// supervisor code.
///
/// Unlike [`Self::resolve_placeholder_checked`], this method accepts an
/// environment key rather than a user-provided placeholder token. Internal
/// request transforms such as `SigV4` can therefore select the endpoint-bound
/// current credential without making identityless placeholder aliases
/// available to sandbox request input.
pub fn resolve_current_env_key_checked(
&self,
key: &str,
location: &'static str,
) -> Result<Option<&str>, UnresolvedPlaceholderError> {
if self.denied_env_keys.contains(key) {
return Err(UnresolvedPlaceholderError {
location,
reason: UnresolvedPlaceholderReason::EndpointMismatch,
});
}
match validate_resolved_secret(&secret.value) {
Ok(s) => Some(s),
Err(reason) => {
tracing::warn!(
location = "resolve_placeholder",
reason,
"credential resolution rejected: resolved value contains prohibited characters"
);
None
}
let placeholder = placeholder_for_env_key(key);
Ok(self
.by_placeholder
.get(&placeholder)
.and_then(resolve_secret_value))
}
/// Resolve a placeholder while preserving endpoint-denial information.
///
/// `None` means the credential is genuinely unavailable. An endpoint-bound
/// key denied by the scoped resolver returns a typed mismatch so callers
/// can emit the security denial instead of treating it as missing config.
pub fn resolve_placeholder_checked(
&self,
value: &str,
location: &'static str,
) -> Result<Option<&str>, UnresolvedPlaceholderError> {
if placeholder_env_key(value).is_some_and(|key| self.denied_env_keys.contains(key)) {
return Err(UnresolvedPlaceholderError {
location,
reason: UnresolvedPlaceholderReason::EndpointMismatch,
});
}
Ok(self.resolve_placeholder(value))
}
pub fn expires_at_ms_for_placeholder(&self, placeholder: &str) -> Option<i64> {
@@ -284,7 +437,7 @@ impl SecretResolver {
// Prefixed placeholder: `Bearer openshell:resolve:env:KEY`
let Some(split_at) = trimmed.find(char::is_whitespace) else {
if contains_reserved_credential_marker(trimmed) {
return Err(UnresolvedPlaceholderError { location: "header" });
return Err(self.unresolved_for("header", trimmed));
}
return Ok(None);
};
@@ -295,7 +448,7 @@ impl SecretResolver {
}
if contains_reserved_credential_marker(candidate) {
return Err(UnresolvedPlaceholderError { location: "header" });
return Err(self.unresolved_for("header", candidate));
}
Ok(None)
@@ -329,10 +482,10 @@ impl SecretResolver {
if text[abs_start..].starts_with(PLACEHOLDER_PREFIX) {
let Some((token_end, token)) = self.credential_token_at(text, abs_start) else {
return Err(UnresolvedPlaceholderError { location });
return Err(unresolved(location));
};
let Some(secret) = self.resolve_placeholder(token) else {
return Err(UnresolvedPlaceholderError { location });
return Err(self.unresolved_for(location, token));
};
rewritten.push_str(secret);
replacements += 1;
@@ -342,7 +495,7 @@ impl SecretResolver {
if let Some((token_end, token)) = alias_token_at(text, abs_start) {
let Some(secret) = self.resolve_placeholder(token) else {
return Err(UnresolvedPlaceholderError { location });
return Err(self.unresolved_for(location, token));
};
rewritten.push_str(secret);
replacements += 1;
@@ -350,11 +503,11 @@ impl SecretResolver {
continue;
}
return Err(UnresolvedPlaceholderError { location });
return Err(unresolved(location));
}
if contains_raw_reserved_marker(&rewritten) {
return Err(UnresolvedPlaceholderError { location });
return Err(unresolved(location));
}
*text = rewritten;
@@ -433,6 +586,27 @@ impl SecretResolver {
}
}
fn resolve_secret_value(secret: &SecretValue) -> Option<&str> {
if secret.expires_at_ms > 0 && secret.expires_at_ms <= now_ms() {
tracing::warn!(
location = "resolve_placeholder",
"credential resolution rejected: credential is expired"
);
return None;
}
match validate_resolved_secret(secret.value.as_ref()) {
Ok(s) => Some(s),
Err(reason) => {
tracing::warn!(
location = "resolve_placeholder",
reason,
"credential resolution rejected: resolved value contains prohibited characters"
);
None
}
}
}
fn alias_start_for_marker(text: &str, marker_abs: usize) -> usize {
let mut start = marker_abs;
let bytes = text.as_bytes();
@@ -490,9 +664,19 @@ fn alias_env_key(token: &str) -> Option<&str> {
}
fn revisioned_placeholder_env_key(token: &str) -> Option<&str> {
revisioned_placeholder_parts(token).map(|(_, key)| key)
}
fn revisioned_placeholder_parts(token: &str) -> Option<(u64, &str)> {
let suffix = token.strip_prefix(PLACEHOLDER_PREFIX)?;
let (_, key) = split_revisioned_env_key(suffix)?;
Some(key)
let (revision, key) = split_revisioned_env_key(suffix)?;
Some((revision.parse().ok()?, key))
}
fn placeholder_env_key(token: &str) -> Option<&str> {
revisioned_placeholder_env_key(token)
.or_else(|| token.strip_prefix(PLACEHOLDER_PREFIX))
.or_else(|| alias_env_key(token))
}
pub fn uses_reserved_revision_namespace(key: &str) -> bool {
@@ -836,7 +1020,7 @@ fn rewrite_path_segment(
let Some((token_end, full_placeholder)) = canonical_token_at(segment, abs_start)
.or_else(|| alias_token_at(segment, abs_start))
else {
return Err(UnresolvedPlaceholderError { location: "path" });
return Err(unresolved("path"));
};
if let Some(secret) = resolver.resolve_placeholder(full_placeholder) {
validate_credential_for_path(secret).map_err(|reason| {
@@ -845,12 +1029,12 @@ fn rewrite_path_segment(
%reason,
"credential resolution rejected: resolved value unsafe for path"
);
UnresolvedPlaceholderError { location: "path" }
unresolved("path")
})?;
resolved.push_str(secret);
redacted.push_str("[CREDENTIAL]");
} else {
return Err(UnresolvedPlaceholderError { location: "path" });
return Err(resolver.unresolved_for("path", full_placeholder));
}
pos = token_end;
} else {
@@ -887,9 +1071,7 @@ fn rewrite_uri_query_params(
let replacements =
resolver.rewrite_text_placeholders(&mut rewritten, "query_param")?;
if replacements == 0 || contains_raw_reserved_marker(&rewritten) {
return Err(UnresolvedPlaceholderError {
location: "query_param",
});
return Err(unresolved("query_param"));
}
resolved_params.push(format!("{key}={}", percent_encode_query(&rewritten)));
redacted_params.push(format!("{key}=[CREDENTIAL]"));
@@ -941,7 +1123,7 @@ pub fn rewrite_http_header_block(
.map_or(raw.len(), |p| raw.len().min(p + 4 + 256));
let header_region = String::from_utf8_lossy(&raw[..scan_end]);
if contains_reserved_credential_marker(&header_region) {
return Err(UnresolvedPlaceholderError { location: "header" });
return Err(unresolved("header"));
}
return Ok(RewriteResult {
rewritten: raw.to_vec(),
@@ -988,7 +1170,7 @@ pub fn rewrite_http_header_block(
// provider-shaped aliases in both raw and percent-decoded header bytes.
let output_header = String::from_utf8_lossy(&output[..output.len().min(header_end + 256)]);
if contains_reserved_credential_marker(&output_header) {
return Err(UnresolvedPlaceholderError { location: "header" });
return Err(unresolved("header"));
}
Ok(RewriteResult {
@@ -1066,6 +1248,48 @@ pub fn rewrite_target_for_eval(
Ok(RewriteTargetResult { resolved, redacted })
}
/// Produce the policy/logging representation of a request target without
/// consulting or materializing credential values.
///
/// This validates placeholder syntax using the same URI-aware rewrite path as
/// upstream injection, but resolves every referenced key to a fixed redaction
/// marker. Callers can therefore select routes and evaluate policy before the
/// real endpoint-scoped resolver is touched.
pub fn redact_target_for_policy(target: &str) -> Result<String, UnresolvedPlaceholderError> {
if !contains_reserved_credential_marker(target) {
return Ok(target.to_string());
}
let decoded = percent_decode(target);
let mut provider_env = HashMap::new();
let mut pos = 0;
while pos < decoded.len() {
let next_canonical = decoded[pos..].find(PLACEHOLDER_PREFIX).map(|p| pos + p);
let next_alias = decoded[pos..]
.find(PROVIDER_ALIAS_MARKER)
.map(|marker_pos| alias_start_for_marker(&decoded, pos + marker_pos));
let Some(start) = [next_canonical, next_alias].into_iter().flatten().min() else {
break;
};
let Some((end, token)) =
canonical_token_at(&decoded, start).or_else(|| alias_token_at(&decoded, start))
else {
return Err(unresolved("request_target"));
};
let Some(key) = placeholder_env_key(token) else {
return Err(unresolved("request_target"));
};
provider_env.insert(key.to_string(), "[CREDENTIAL]".to_string());
pos = end;
}
let (_, resolver) = SecretResolver::from_provider_env(provider_env);
let Some(resolver) = resolver else {
return Err(unresolved("request_target"));
};
rewrite_target_for_eval(target, &resolver).map(|result| result.redacted)
}
// ---------------------------------------------------------------------------
// Tests
// ---------------------------------------------------------------------------
@@ -2201,4 +2425,12 @@ mod tests {
assert_eq!(result.resolved, "/bottok123/method?key=key456");
assert_eq!(result.redacted, "/bot[CREDENTIAL]/method?key=[CREDENTIAL]");
}
#[test]
fn policy_target_redaction_never_requires_real_secret_material() {
let target = "/v1/openshell:resolve:env:v9_API_KEY/messages?token=provider-OPENSHELL-RESOLVE-ENV-API_KEY";
let redacted = redact_target_for_policy(target).expect("valid placeholder syntax");
assert_eq!(redacted, "/v1/[CREDENTIAL]/messages?token=[CREDENTIAL]");
assert!(!redacted.contains("API_KEY"));
}
}
crates/openshell-gateway-interceptors/src/plan.rs
+31 -6
View File
@@ -19,7 +19,7 @@ use openshell_core::proto::gateway_interceptor::v1::{
use tokio::net::UnixStream;
use tonic::Request;
use tonic::codegen::http::Uri;
use tonic::transport::{Channel, Endpoint};
use tonic::transport::{Channel, ClientTlsConfig, Endpoint};
use tower::service_fn;
use tracing::{info, warn};
@@ -27,6 +27,10 @@ use crate::profile_source::GatewayInterceptorProfileSource;
use crate::routes::OpenShellRouteIndex;
use crate::{InterceptorError, Result};
const CONNECT_TIMEOUT: Duration = Duration::from_secs(10);
const HTTP2_KEEP_ALIVE_INTERVAL: Duration = Duration::from_secs(10);
const KEEP_ALIVE_TIMEOUT: Duration = Duration::from_secs(20);
pub const DEFAULT_TIMEOUT: Duration = Duration::from_millis(500);
pub const DEFAULT_MAX_RESPONSE_BYTES: usize = 1_048_576;
pub const DEFAULT_MAX_PATCHES: usize = 32;
@@ -857,15 +861,36 @@ pub fn parse_duration(value: &str) -> Result<Duration> {
)))
}
/// Repo-standard channel tuning (matches `openshell-core` / `openshell-sdk`):
/// bounded dial + HTTP/2 keepalive so idle interceptor channels survive
/// intermediary idle timeouts and dead peers are detected proactively.
fn tune_endpoint(endpoint: Endpoint) -> Endpoint {
endpoint
.connect_timeout(CONNECT_TIMEOUT)
.http2_keep_alive_interval(HTTP2_KEEP_ALIVE_INTERVAL)
.keep_alive_while_idle(true)
.keep_alive_timeout(KEEP_ALIVE_TIMEOUT)
.http2_adaptive_window(true)
}
async fn connect_endpoint(endpoint: &str) -> Result<Channel> {
let endpoint = endpoint.trim();
if let Some(path) = endpoint.strip_prefix("unix://") {
return connect_unix_endpoint(PathBuf::from(path)).await;
}
Endpoint::from_shared(endpoint.to_string())
.map_err(|e| {
InterceptorError::Config(format!("invalid interceptor endpoint '{endpoint}': {e}"))
})?
let mut ep = Endpoint::from_shared(endpoint.to_string()).map_err(|e| {
InterceptorError::Config(format!("invalid interceptor endpoint '{endpoint}': {e}"))
})?;
if ep.uri().scheme_str() == Some("https") {
ep = ep
.tls_config(ClientTlsConfig::new().with_enabled_roots())
.map_err(|e| {
InterceptorError::Config(format!(
"TLS config for interceptor endpoint '{endpoint}': {e}"
))
})?;
}
tune_endpoint(ep)
.connect()
.await
.map_err(|e| InterceptorError::Transport(format!("connect {endpoint}: {e}")))
@@ -874,7 +899,7 @@ async fn connect_endpoint(endpoint: &str) -> Result<Channel> {
#[cfg(unix)]
async fn connect_unix_endpoint(path: PathBuf) -> Result<Channel> {
let display = path.display().to_string();
Endpoint::from_static("http://[::]:50051")
tune_endpoint(Endpoint::from_static("http://[::]:50051"))
.connect_with_connector(service_fn(move |_: Uri| {
let path = path.clone();
async move { UnixStream::connect(path).await.map(TokioIo::new) }
crates/openshell-policy/src/ambiguity.rs
+39 -1
View File
@@ -190,7 +190,10 @@ fn connection_conflicts(left: &NetworkEndpoint, right: &NetworkEndpoint) -> Vec<
/// cannot compete with the single L7/connection-config endpoint selected for
/// that request.
fn endpoint_contributes_request_pipeline_metadata(endpoint: &NetworkEndpoint) -> bool {
!endpoint.protocol.is_empty() || !endpoint.allowed_ips.is_empty() || !endpoint.tls.is_empty()
!endpoint.protocol.is_empty()
|| !endpoint.allowed_ips.is_empty()
|| !endpoint.tls.is_empty()
|| endpoint.credential_binding.is_some()
}
fn request_pipeline_conflicts(left: &NetworkEndpoint, right: &NetworkEndpoint) -> Vec<String> {
@@ -253,6 +256,20 @@ fn request_pipeline_conflicts(left: &NetworkEndpoint, right: &NetworkEndpoint) -
&left.signing_region,
&right.signing_region,
);
push_conflict(
&mut conflicts,
"credential_binding.provider",
&left
.credential_binding
.as_ref()
.map(|binding| binding.provider.as_str())
.unwrap_or_default(),
&right
.credential_binding
.as_ref()
.map(|binding| binding.provider.as_str())
.unwrap_or_default(),
);
if left.protocol.eq_ignore_ascii_case("graphql")
&& right.protocol.eq_ignore_ascii_case("graphql")
@@ -896,6 +913,27 @@ mod tests {
);
}
#[test]
fn credential_binding_conflicts_are_rejected_on_same_endpoint() {
let mut left = endpoint("api.example.com", 443);
left.credential_binding = Some(openshell_core::proto::NetworkCredentialBinding {
provider: "provider-a".to_string(),
});
let mut right = endpoint("api.example.com", 443);
right.credential_binding = Some(openshell_core::proto::NetworkCredentialBinding {
provider: "provider-b".to_string(),
});
let ambiguities = find_endpoint_ambiguities(&policy_with(left, right));
assert_eq!(ambiguities.len(), 1);
assert!(
ambiguities[0]
.conflicts
.iter()
.any(|field| field.contains("credential_binding.provider"))
);
}
#[test]
fn json_rpc_body_limit_is_compared_only_within_the_same_protocol() {
let mut json_rpc = endpoint("api.example.com", 443);
crates/openshell-policy/src/lib.rs
+49
View File
@@ -157,11 +157,19 @@ struct NetworkEndpointDef {
#[serde(default, skip_serializing_if = "String::is_empty")]
signing_region: String,
#[serde(default, skip_serializing_if = "Option::is_none")]
credential_binding: Option<NetworkCredentialBindingDef>,
#[serde(default, skip_serializing_if = "Option::is_none")]
json_rpc: Option<JsonRpcConfigDef>,
#[serde(default, skip_serializing_if = "Option::is_none")]
mcp: Option<McpConfigDef>,
}
#[derive(Debug, Serialize, Deserialize)]
#[serde(deny_unknown_fields)]
struct NetworkCredentialBindingDef {
provider: String,
}
// Signature dictated by serde's `skip_serializing_if`, which requires `&T`.
#[allow(clippy::trivially_copy_pass_by_ref)]
fn is_zero(v: &u16) -> bool {
@@ -759,6 +767,11 @@ fn to_proto(raw: PolicyFile) -> Result<SandboxPolicy> {
credential_signing: e.credential_signing,
signing_service: e.signing_service,
signing_region: e.signing_region,
credential_binding: e.credential_binding.map(|binding| {
openshell_core::proto::NetworkCredentialBinding {
provider: binding.provider,
}
}),
json_rpc_max_body_bytes: json_rpc_max_body_bytes(&e.json_rpc, &e.mcp),
mcp: mcp_options(&e.mcp),
}
@@ -907,6 +920,11 @@ fn from_proto(policy: &SandboxPolicy) -> PolicyFile {
credential_signing: e.credential_signing.clone(),
signing_service: e.signing_service.clone(),
signing_region: e.signing_region.clone(),
credential_binding: e.credential_binding.as_ref().map(|binding| {
NetworkCredentialBindingDef {
provider: binding.provider.clone(),
}
}),
json_rpc,
mcp,
}
@@ -3004,6 +3022,37 @@ network_policies:
assert_eq!(ep1.path, ep2.path);
}
#[test]
fn round_trip_preserves_endpoint_credential_binding() {
let yaml = r"
version: 1
network_policies:
gcp_storage:
endpoints:
- host: storage.googleapis.com
port: 443
protocol: rest
credential_binding:
provider: work-gcp
";
let proto1 = parse_sandbox_policy(yaml).expect("parse failed");
let endpoint = &proto1.network_policies["gcp_storage"].endpoints[0];
assert_eq!(
endpoint
.credential_binding
.as_ref()
.map(|binding| binding.provider.as_str()),
Some("work-gcp")
);
let yaml_out = serialize_sandbox_policy(&proto1).expect("serialize failed");
let proto2 = parse_sandbox_policy(&yaml_out).expect("re-parse failed");
assert_eq!(proto1, proto2);
assert!(yaml_out.contains("credential_binding:"));
assert!(yaml_out.contains("provider: work-gcp"));
}
#[test]
fn round_trip_preserves_multi_port() {
let yaml = r"
crates/openshell-policy/src/merge.rs
+3367 -103
View File
File diff suppressed because it is too large Load Diff
crates/openshell-providers/src/profiles.rs
+4 -10
View File
@@ -1088,6 +1088,9 @@ fn endpoint_to_proto(endpoint: &EndpointProfile) -> NetworkEndpoint {
credential_signing: endpoint.credential_signing.clone(),
signing_service: endpoint.signing_service.clone(),
signing_region: endpoint.signing_region.clone(),
// Credential bindings reference a concrete sandbox provider instance
// and therefore cannot be authored by a reusable provider profile.
credential_binding: None,
}
}
@@ -2439,16 +2442,7 @@ fn path_prefix_pattern(path: &str) -> Option<&str> {
}
fn endpoint_path_matches(pattern: &str, path: &str) -> bool {
if path_matches_all(pattern) {
return true;
}
if pattern == path {
return true;
}
if let Some(prefix) = path_prefix_pattern(pattern) {
return path == prefix || path.starts_with(&format!("{prefix}/"));
}
glob::Pattern::new(pattern).is_ok_and(|glob| glob.matches(path))
openshell_core::endpoint_path::matches(pattern, path)
}
fn validate_token_grant_endpoint(token_endpoint: &str) -> Result<(), String> {
crates/openshell-sandbox/src/lib.rs
+783 -114
View File
File diff suppressed because it is too large Load Diff
crates/openshell-server/src/grpc/policy.rs
+1588 -26
View File
File diff suppressed because it is too large Load Diff
crates/openshell-server/src/grpc/provider.rs
+883 -108
View File
File diff suppressed because it is too large Load Diff
crates/openshell-server/src/grpc/sandbox.rs
+82 -1
View File
@@ -314,6 +314,17 @@ async fn handle_create_sandbox_inner(
// Ensure metadata is valid (defense in depth - should always be true for server-constructed metadata)
super::validation::validate_object_metadata(sandbox.metadata.as_ref(), "sandbox")?;
super::policy::validate_candidate_provider_attachments(
state,
sandbox.object_workspace(),
&sandbox,
sandbox
.spec
.as_ref()
.map(|spec| spec.providers.as_slice())
.unwrap_or_default(),
)
.await?;
state
.compute
@@ -658,10 +669,22 @@ pub(super) async fn handle_detach_sandbox_provider(
.clone();
// Pre-check: fail fast if sandbox spec is missing (invariant violation)
let _spec = sandbox
let spec = sandbox
.spec
.as_ref()
.ok_or_else(|| Status::internal("sandbox spec is missing"))?;
let mut candidate_spec = spec.clone();
candidate_spec
.providers
.retain(|name| name != &request.provider_name);
dedupe_provider_names(&mut candidate_spec.providers);
super::policy::validate_candidate_provider_attachments(
state,
&workspace,
&sandbox,
&candidate_spec.providers,
)
.await?;
let provider_name = request.provider_name.clone();
let detached = Arc::new(AtomicBool::new(false));
@@ -2889,6 +2912,64 @@ mod tests {
assert!(!response.detached);
}
#[tokio::test]
async fn detach_rejects_provider_referenced_by_policy_credential_binding() {
let state = test_server_state().await;
state
.store
.put_message(&test_provider("work-gcp", "google-cloud"))
.await
.unwrap();
let mut sandbox = test_sandbox("work", vec!["work-gcp".to_string()]);
let policy = sandbox
.spec
.as_mut()
.and_then(|spec| spec.policy.as_mut())
.unwrap();
policy.network_policies.insert(
"gcp_storage".to_string(),
openshell_core::proto::NetworkPolicyRule {
name: "gcp_storage".to_string(),
endpoints: vec![openshell_core::proto::NetworkEndpoint {
host: "storage.googleapis.com".to_string(),
port: 443,
credential_binding: Some(openshell_core::proto::NetworkCredentialBinding {
provider: "work-gcp".to_string(),
}),
..Default::default()
}],
..Default::default()
},
);
state.store.put_message(&sandbox).await.unwrap();
let error = handle_detach_sandbox_provider(
&state,
authed_request(DetachSandboxProviderRequest {
sandbox_name: "work".to_string(),
provider_name: "work-gcp".to_string(),
expected_resource_version: 0,
workspace: String::new(),
}),
)
.await
.expect_err("a referenced provider must remain attached");
assert_eq!(error.code(), tonic::Code::FailedPrecondition);
assert!(error.message().contains("not attached"));
let providers = state
.store
.get_message_by_name::<Sandbox>("default", "work")
.await
.unwrap()
.unwrap()
.spec
.unwrap()
.providers;
assert_eq!(providers, vec!["work-gcp"]);
}
#[tokio::test]
async fn list_sandbox_providers_returns_attached_provider_records() {
let state = test_server_state().await;
crates/openshell-server/src/provider_profile_sources.rs
+109 -31
View File
@@ -439,23 +439,30 @@ impl EffectiveProviderProfileCatalog {
id: &str,
profile_workspace: &str,
) -> Option<ProviderTypeProfile> {
self.scoped_type_profile_for_scope(id, profile_workspace)
.map(|entry| entry.profile.clone())
}
fn scoped_type_profile_for_scope(
&self,
id: &str,
profile_workspace: &str,
) -> Option<&ScopedProfileEntry> {
let id = normalize_profile_id(id)?;
let entry = self.profiles.get(&id)?;
if entry.effective.scope == ProfileScope::Static {
return Some(entry.effective.profile.clone());
return Some(&entry.effective);
}
if profile_workspace.is_empty() {
match &entry.platform_fallback {
Some(fallback) => Some(fallback.profile.clone()),
None if entry.effective.scope == ProfileScope::Platform => {
Some(entry.effective.profile.clone())
}
Some(fallback) => Some(fallback),
None if entry.effective.scope == ProfileScope::Platform => Some(&entry.effective),
None => None,
}
} else {
Some(entry.effective.profile.clone())
Some(&entry.effective)
}
}
@@ -467,36 +474,40 @@ impl EffectiveProviderProfileCatalog {
.map(|entry| entry.effective.source_id.clone())
}
pub(crate) fn hash_profile_revision(&self, profile_id: &str, hasher: &mut Sha256) {
let Some(profile_id) = normalize_profile_id(profile_id) else {
hasher.update(b"invalid-profile-id");
return;
};
let Some(entry) = self.profiles.get(&profile_id) else {
pub(crate) fn hash_type_profile_revision_for_scope(
&self,
profile_id: &str,
profile_workspace: &str,
hasher: &mut Sha256,
) {
let Some(entry) = self.scoped_type_profile_for_scope(profile_id, profile_workspace) else {
hasher.update(b"missing");
return;
};
hasher.update(b"provider-profile-source-entry");
hasher.update(entry.effective.source_id.as_bytes());
hasher.update(entry.effective.source_revision.as_bytes());
let scope_tag: &[u8] = match entry.effective.scope {
ProfileScope::Static => b"static",
ProfileScope::Platform => b"platform",
ProfileScope::Workspace => b"workspace",
};
hasher.update(scope_tag);
let ownership_tag: &[u8] = if entry.effective.user_managed {
b"user-managed"
} else {
b"source-managed"
};
hasher.update(ownership_tag);
hasher.update(entry.effective.response.encode_to_vec());
hash_scoped_profile_revision(entry, hasher);
}
}
fn hash_scoped_profile_revision(entry: &ScopedProfileEntry, hasher: &mut Sha256) {
hasher.update(b"provider-profile-source-entry");
hasher.update(entry.source_id.as_bytes());
hasher.update(entry.source_revision.as_bytes());
let scope_tag: &[u8] = match entry.scope {
ProfileScope::Static => b"static",
ProfileScope::Platform => b"platform",
ProfileScope::Workspace => b"workspace",
};
hasher.update(scope_tag);
let ownership_tag: &[u8] = if entry.user_managed {
b"user-managed"
} else {
b"source-managed"
};
hasher.update(ownership_tag);
hasher.update(entry.response.encode_to_vec());
}
fn scope_to_string(scope: ProfileScope) -> &'static str {
match scope {
ProfileScope::Static => "",
@@ -921,7 +932,11 @@ mod tests {
);
assert!(first.get_type_profile("moving-profile").is_some());
let mut first_profile_hash = Sha256::new();
first.hash_profile_revision("moving-profile", &mut first_profile_hash);
first.hash_type_profile_revision_for_scope(
"moving-profile",
"default",
&mut first_profile_hash,
);
let first_profile_hash = first_profile_hash.finalize();
assert_eq!(fetch_count.load(Ordering::SeqCst), 1);
@@ -932,7 +947,11 @@ mod tests {
"revision-b"
);
let mut second_profile_hash = Sha256::new();
second.hash_profile_revision("moving-profile", &mut second_profile_hash);
second.hash_type_profile_revision_for_scope(
"moving-profile",
"default",
&mut second_profile_hash,
);
assert_ne!(first_profile_hash, second_profile_hash.finalize());
assert_ne!(first.revision(), second.revision());
}
@@ -1633,6 +1652,65 @@ mod tests {
assert_eq!(result.unwrap().display_name, "Platform Anthropic");
}
#[test]
fn scoped_profile_revision_hashes_platform_fallback_beneath_workspace_override() {
let catalog = |platform_path: &str| {
let mut platform = profile("anthropic");
platform.endpoints.truncate(1);
platform.endpoints[0].path = platform_path.to_string();
let mut workspace = profile("anthropic");
workspace.display_name = "Workspace Anthropic".to_string();
build_effective_profiles(vec![CollectedProviderProfileSnapshot {
source_id: "user".to_string(),
revision: "same-source-revision".to_string(),
profiles: vec![
ScopedSnapshotProfile {
scope: ProfileScope::Platform,
profile: platform,
},
ScopedSnapshotProfile {
scope: ProfileScope::Workspace,
profile: workspace,
},
],
user_managed: true,
allow_empty: true,
}])
.unwrap()
};
let broad = catalog("/**");
let narrow = catalog("/v1/**");
let mut broad_platform_hash = Sha256::new();
broad.hash_type_profile_revision_for_scope("anthropic", "", &mut broad_platform_hash);
let mut narrow_platform_hash = Sha256::new();
narrow.hash_type_profile_revision_for_scope("anthropic", "", &mut narrow_platform_hash);
assert_ne!(
broad_platform_hash.finalize(),
narrow_platform_hash.finalize(),
"platform-scoped providers must hash the selected platform fallback"
);
let mut broad_workspace_hash = Sha256::new();
broad.hash_type_profile_revision_for_scope(
"anthropic",
"default",
&mut broad_workspace_hash,
);
let mut narrow_workspace_hash = Sha256::new();
narrow.hash_type_profile_revision_for_scope(
"anthropic",
"default",
&mut narrow_workspace_hash,
);
assert_eq!(
broad_workspace_hash.finalize(),
narrow_workspace_hash.finalize(),
"workspace-scoped providers must remain keyed to the workspace override"
);
}
#[test]
fn scope_lookup_empty_pw_returns_platform_when_no_shadow() {
let mut plat_profile = profile("anthropic");
crates/openshell-supervisor-network/src/l7/graphql.rs
+24
View File
@@ -39,6 +39,30 @@ pub struct GraphqlHttpRequest {
pub info: GraphqlRequestInfo,
}
pub(crate) fn log_summary(info: &GraphqlRequestInfo) -> String {
if let Some(error) = &info.error {
return format!("graphql_error={error:?}");
}
let operations = info.operations.iter().map(|operation| {
let name = operation.operation_name.as_deref().unwrap_or("-");
let fields = if operation.fields.is_empty() {
"-".to_string()
} else {
operation.fields.join(",")
};
let persisted = operation
.persisted_query_hash
.as_deref()
.or(operation.persisted_query_id.as_deref())
.unwrap_or("-");
format!(
"type={} name={} fields={} persisted={}",
operation.operation_type, name, fields, persisted
)
});
format!("graphql_ops={}", operations.collect::<Vec<_>>().join(";"))
}
pub async fn parse_graphql_http_request<C: AsyncRead + AsyncWrite + Unpin + Send>(
client: &mut C,
max_body_bytes: usize,
crates/openshell-supervisor-network/src/l7/mod.rs
+32 -10
View File
@@ -24,6 +24,37 @@ pub(crate) mod websocket;
pub use openshell_policy::L7Protocol;
use openshell_policy::{L7EndpointFields, validate_l7_endpoint_semantics};
pub(crate) fn build_credential_endpoint_mismatch_finding(
policy_name: &str,
host: &str,
protocol: Option<&str>,
message: &str,
) -> openshell_ocsf::OcsfEvent {
use openshell_ocsf::{
ActionId, ActivityId, DetectionFindingBuilder, DispositionId, FindingInfo, SeverityId,
};
let mut evidence = vec![("policy", policy_name), ("host", host)];
if let Some(protocol) = protocol {
evidence.push(("protocol", protocol));
}
evidence.push(("disposition", "denied"));
DetectionFindingBuilder::new(openshell_ocsf::ctx::ctx())
.activity(ActivityId::Open)
.action(ActionId::Denied)
.disposition(DispositionId::Blocked)
.severity(SeverityId::High)
.is_alert(true)
.finding_info(FindingInfo::new(
"openshell.provider_credential.endpoint_mismatch",
"Provider credential used at an unauthorized endpoint",
))
.evidence_pairs(&evidence)
.message(message)
.build()
}
/// TLS handling mode for proxy connections.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Default)]
pub enum TlsMode {
@@ -256,16 +287,7 @@ impl L7EndpointConfig {
}
pub fn endpoint_path_matches(pattern: &str, path: &str) -> bool {
if pattern.is_empty() || pattern == "**" || pattern == "/**" {
return true;
}
if pattern == path {
return true;
}
if let Some(prefix) = pattern.strip_suffix("/**") {
return path == prefix || path.starts_with(&format!("{prefix}/"));
}
glob::Pattern::new(pattern).is_ok_and(|glob| glob.matches(path))
openshell_core::endpoint_path::matches(pattern, path)
}
/// Parse the `tls` field from an endpoint config, independent of L7 protocol.
crates/openshell-supervisor-network/src/l7/path.rs
+32 -7
View File
@@ -135,13 +135,24 @@ pub fn canonicalize_request_target(
None => (target, None),
};
// 4. Handle absolute-form by stripping scheme://authority.
let raw_path = path_part.find("://").map_or(path_part, |idx| {
let after_scheme = &path_part[idx + 3..];
after_scheme
.find('/')
.map_or("/", |slash| &after_scheme[slash..])
});
// 4. Handle absolute-form by stripping the URI authority. Origin-form
// targets may legitimately embed `://` in a path segment, so only a URI
// with a scheme is absolute-form.
let absolute_form_uri = path_part
.parse::<http::Uri>()
.ok()
.filter(|uri| uri.scheme().is_some());
let raw_path = absolute_form_uri
.as_ref()
.map(http::Uri::path)
.filter(|path| !path.is_empty())
.unwrap_or_else(|| {
if absolute_form_uri.is_some() {
"/"
} else {
path_part
}
});
// 5. Empty is equivalent to "/".
let raw_path = if raw_path.is_empty() { "/" } else { raw_path };
@@ -443,6 +454,20 @@ mod tests {
assert_eq!(canon("http://host:443/foo").unwrap(), "/foo");
}
#[test]
fn origin_form_with_embedded_url_is_not_stripped_as_absolute_form() {
let (path, query) = canonicalize_request_target(
"/fetch/http://example.test?next=http://other.test",
&CanonicalizeOptions::default(),
)
.expect("origin-form target with embedded URLs must be accepted");
// Repeated slashes are canonicalized everywhere, but the embedded
// URL must remain part of the origin-form path rather than being
// treated as a new absolute-form authority.
assert_eq!(path.path, "/fetch/http:/example.test");
assert_eq!(query.as_deref(), Some("next=http://other.test"));
}
#[test]
fn legitimate_percent_encoded_bytes_round_trip() {
assert_eq!(
crates/openshell-supervisor-network/src/l7/relay.rs
+1453 -149
View File
File diff suppressed because it is too large Load Diff
crates/openshell-supervisor-network/src/l7/rest.rs
+249 -15
View File
@@ -240,6 +240,11 @@ async fn parse_http_request<C: AsyncRead + Unpin>(
if version != "HTTP/1.1" && version != "HTTP/1.0" {
return Err(miette!("Unsupported HTTP version: {version}"));
}
let host_authority = request_host_authority_from_str(header_str)?;
if version == "HTTP/1.1" && host_authority.is_none() {
return Err(miette!("HTTP/1.1 request is missing a Host header"));
}
validate_absolute_form_authority(&target, host_authority.as_ref())?;
// Determine body framing from headers
let body_length = parse_body_length(header_str)?;
@@ -385,6 +390,130 @@ pub(crate) fn validate_http_request_header_block(headers: &[u8]) -> Result<()> {
Ok(())
}
#[derive(Debug)]
pub(crate) struct RequestAuthority {
pub(crate) authority: http::uri::Authority,
pub(crate) effective_port: u16,
}
pub(crate) fn request_authority(
raw_header: &[u8],
transport_default_port: Option<u16>,
) -> Result<Option<RequestAuthority>> {
let header_end = raw_header
.windows(4)
.position(|window| window == b"\r\n\r\n")
.ok_or_else(|| miette!("HTTP request headers are missing the CRLF terminator"))?
+ 4;
let headers = std::str::from_utf8(&raw_header[..header_end])
.map_err(|_| miette!("HTTP headers contain invalid UTF-8"))?;
let Some(host_authority) = request_host_authority_from_str(headers)? else {
return Ok(None);
};
let request_target = headers
.lines()
.next()
.and_then(|line| line.split_whitespace().nth(1))
.ok_or_else(|| miette!("HTTP request is missing a request target"))?;
let absolute_uri = absolute_form_uri(request_target)?;
let (authority, default_port) = if let Some(uri) = absolute_uri {
let authority = uri
.authority()
.ok_or_else(|| miette!("HTTP absolute-form request target is missing an authority"))?
.clone();
let default_port = default_port_for_scheme(uri.scheme_str()).ok_or_else(|| {
miette!("HTTP absolute-form request target uses an unsupported scheme")
})?;
(authority, default_port)
} else {
let default_port = transport_default_port
.ok_or_else(|| miette!("HTTP origin-form request transport scheme is unavailable"))?;
(host_authority, default_port)
};
let effective_port = authority.port_u16().unwrap_or(default_port);
Ok(Some(RequestAuthority {
authority,
effective_port,
}))
}
fn request_host_authority_from_str(headers: &str) -> Result<Option<http::uri::Authority>> {
let mut authorities = headers.lines().skip(1).filter_map(|line| {
let (name, value) = line.split_once(':')?;
name.eq_ignore_ascii_case("host").then_some(value.trim())
});
let Some(authority) = authorities.next() else {
return Ok(None);
};
if authorities.next().is_some() {
return Err(miette!("HTTP request contains multiple Host headers"));
}
authority
.parse()
.map(Some)
.map_err(|_| miette!("HTTP request Host header contains an invalid authority"))
}
fn validate_absolute_form_authority(
target: &str,
host_authority: Option<&http::uri::Authority>,
) -> Result<()> {
let Some(uri) = absolute_form_uri(target)? else {
return Ok(());
};
let request_authority = uri
.authority()
.ok_or_else(|| miette!("HTTP absolute-form request target is missing an authority"))?;
let host_authority = host_authority
.ok_or_else(|| miette!("HTTP absolute-form request is missing a Host header"))?;
if !authorities_match(request_authority, host_authority, uri.scheme_str()) {
return Err(miette!(
"HTTP absolute-form request authority does not match the Host header"
));
}
Ok(())
}
/// Return a URI only when the request-target uses HTTP absolute form.
///
/// Origin-form request-targets can legitimately contain `://` in a path or
/// query value, so a substring check would incorrectly make those requests
/// participate in authority validation.
fn absolute_form_uri(target: &str) -> Result<Option<http::Uri>> {
let uri = target
.parse::<http::Uri>()
.map_err(|_| miette!("HTTP absolute-form request target contains an invalid URI"))?;
Ok(uri.scheme().is_some().then_some(uri))
}
fn authorities_match(
left: &http::uri::Authority,
right: &http::uri::Authority,
scheme: Option<&str>,
) -> bool {
if !normalized_authority_host(left.host())
.eq_ignore_ascii_case(normalized_authority_host(right.host()))
{
return false;
}
let default_port = default_port_for_scheme(scheme);
left.port_u16().or(default_port) == right.port_u16().or(default_port)
}
fn default_port_for_scheme(scheme: Option<&str>) -> Option<u16> {
match scheme {
Some(scheme) if scheme.eq_ignore_ascii_case("http") => Some(80),
Some(scheme) if scheme.eq_ignore_ascii_case("https") => Some(443),
_ => None,
}
}
fn normalized_authority_host(host: &str) -> &str {
host.trim_end_matches('.')
}
fn validate_http_request_line(request_line: &str) -> Result<()> {
let mut parts = request_line.split(' ');
let method = parts
@@ -593,6 +722,7 @@ where
upstream,
RelayRequestOptions {
resolver,
credential_generation: None,
generation_guard,
websocket_extensions: WebSocketExtensionMode::Preserve,
request_body_credential_rewrite: false,
@@ -616,6 +746,7 @@ pub(crate) enum WebSocketExtensionMode {
#[derive(Clone, Copy, Default)]
pub(crate) struct RelayRequestOptions<'a> {
pub(crate) resolver: Option<&'a SecretResolver>,
pub(crate) credential_generation: Option<CredentialGenerationGuard<'a>>,
pub(crate) generation_guard: Option<&'a PolicyGenerationGuard>,
pub(crate) websocket_extensions: WebSocketExtensionMode,
pub(crate) request_body_credential_rewrite: bool,
@@ -626,6 +757,38 @@ pub(crate) struct RelayRequestOptions<'a> {
pub(crate) port: u16,
}
#[derive(Clone, Copy)]
pub(crate) struct CredentialGenerationGuard<'a> {
state: &'a openshell_core::provider_credentials::ProviderCredentialState,
revision: u64,
}
impl<'a> CredentialGenerationGuard<'a> {
pub(crate) fn new(
state: &'a openshell_core::provider_credentials::ProviderCredentialState,
revision: u64,
) -> Self {
Self { state, revision }
}
pub(crate) fn ensure_current(self) -> Result<()> {
if self.state.revision() == self.revision {
Ok(())
} else {
Err(miette!(
"provider credential generation changed before upstream write"
))
}
}
}
fn ensure_credential_generation_current(options: RelayRequestOptions<'_>) -> Result<()> {
if let Some(guard) = options.credential_generation {
guard.ensure_current()?;
}
Ok(())
}
pub(crate) async fn relay_http_request_with_options_guarded<C, U>(
req: &L7Request,
client: &mut C,
@@ -636,6 +799,7 @@ where
C: AsyncRead + AsyncWrite + Unpin,
U: AsyncRead + AsyncWrite + Unpin,
{
ensure_credential_generation_current(options)?;
let header_end = req
.raw_header
.windows(4)
@@ -677,8 +841,8 @@ where
offered_subprotocols: request.subprotocols.clone(),
});
let rewrite_result = rewrite_http_header_block(&header_bytes, options.resolver)
.map_err(|e| miette!("credential injection failed: {e}"))?;
let rewrite_result =
rewrite_http_header_block(&header_bytes, options.resolver).map_err(miette::Report::new)?;
if let Some(guard) = options.generation_guard {
guard.ensure_current()?;
@@ -706,19 +870,18 @@ where
client.flush().await.into_diagnostic()?;
}
if let Some(resolver) = options.resolver {
let access_key_placeholder =
openshell_core::secrets::placeholder_for_env_key("AWS_ACCESS_KEY_ID");
let secret_key_placeholder =
openshell_core::secrets::placeholder_for_env_key("AWS_SECRET_ACCESS_KEY");
let session_token_placeholder =
openshell_core::secrets::placeholder_for_env_key("AWS_SESSION_TOKEN");
let access_key = resolver
.resolve_current_env_key_checked("AWS_ACCESS_KEY_ID", "sigv4")
.map_err(miette::Report::new)?;
let secret_key = resolver
.resolve_current_env_key_checked("AWS_SECRET_ACCESS_KEY", "sigv4")
.map_err(miette::Report::new)?;
let session_token = resolver
.resolve_current_env_key_checked("AWS_SESSION_TOKEN", "sigv4")
.map_err(miette::Report::new)?;
match (
resolver.resolve_placeholder(&access_key_placeholder),
resolver.resolve_placeholder(&secret_key_placeholder),
) {
match (access_key, secret_key) {
(Some(access_key), Some(secret_key)) => {
let session_token = resolver.resolve_placeholder(&session_token_placeholder);
// Use explicit signing_region from policy if set,
// otherwise extract from hostname.
let region = if options.signing_region.is_empty() {
@@ -815,6 +978,7 @@ where
secret_key,
session_token,
)?;
ensure_credential_generation_current(options)?;
upstream.write_all(&signed).await.into_diagnostic()?;
} else {
// Sign headers only, stream body through.
@@ -834,6 +998,7 @@ where
session_token,
signable_body,
)?;
ensure_credential_generation_current(options)?;
upstream
.write_all(&signed_headers)
.await
@@ -917,11 +1082,13 @@ where
options.generation_guard,
)
.await?;
ensure_credential_generation_current(options)?;
upstream.write_all(&body.headers).await.into_diagnostic()?;
if !body.body.is_empty() {
upstream.write_all(&body.body).await.into_diagnostic()?;
}
} else {
ensure_credential_generation_current(options)?;
upstream
.write_all(&rewrite_result.rewritten)
.await
@@ -1295,7 +1462,7 @@ fn rewrite_buffered_body(
} else {
resolver
.rewrite_text_placeholders(&mut text, "request_body")
.map_err(|e| miette!("credential injection failed: {e}"))?
.map_err(miette::Report::new)?
};
if replacements == 0 || contains_reserved_credential_marker(&text) {
return Err(miette!(
@@ -1342,7 +1509,7 @@ fn rewrite_form_urlencoded_body(body: &str, resolver: &SecretResolver) -> Result
let mut rewritten_value = decoded_value;
let field_replacements = resolver
.rewrite_text_placeholders(&mut rewritten_value, "request_body")
.map_err(|e| miette!("credential injection failed: {e}"))?;
.map_err(miette::Report::new)?;
if field_replacements == 0 || contains_reserved_credential_marker(&rewritten_value) {
return Err(miette!(
"request body credential rewrite left unresolved credential placeholders"
@@ -4712,6 +4879,73 @@ mod tests {
);
}
#[tokio::test]
async fn parse_http_request_rejects_absolute_authority_mismatched_with_host() {
let (mut client, mut peer) = tokio::io::duplex(1024);
peer.write_all(
b"GET http://attacker.example.test/v1 HTTP/1.1\r\nHost: api.example.test\r\n\r\n",
)
.await
.unwrap();
let error = parse_http_request(
&mut client,
&crate::l7::path::CanonicalizeOptions::default(),
)
.await
.expect_err("absolute-form authority mismatch must fail closed");
assert!(
error
.to_string()
.contains("request authority does not match the Host header"),
"{error}"
);
}
#[test]
fn origin_form_targets_with_embedded_urls_use_host_authority() {
let host: http::uri::Authority = "api.example.test".parse().unwrap();
for target in ["/fetch/http://example.test", "/?next=http://example.test"] {
assert!(
absolute_form_uri(target).unwrap().is_none(),
"{target} must remain origin-form"
);
validate_absolute_form_authority(target, Some(&host))
.expect("embedded URL must not trigger absolute-form validation");
let raw = format!("GET {target} HTTP/1.1\r\nHost: api.example.test\r\n\r\n");
let authority = request_authority(raw.as_bytes(), Some(443))
.unwrap()
.expect("origin-form request with Host must have an authority");
assert_eq!(authority.authority, host);
assert_eq!(authority.effective_port, 443);
}
}
#[tokio::test]
async fn parse_http_request_keeps_embedded_url_in_origin_form_path() {
let (mut client, mut peer) = tokio::io::duplex(1024);
peer.write_all(
b"GET /fetch/http://example.test?next=http://other.test HTTP/1.1\r\nHost: api.example.test\r\n\r\n",
)
.await
.unwrap();
let request = parse_http_request(
&mut client,
&crate::l7::path::CanonicalizeOptions::default(),
)
.await
.expect("embedded URL origin-form request must parse")
.expect("request must be present");
assert_eq!(request.target, "/fetch/http:/example.test");
assert_eq!(
request.raw_header,
b"GET /fetch/http:/example.test?next=http://other.test HTTP/1.1\r\nHost: api.example.test\r\n\r\n",
);
}
#[tokio::test]
async fn parse_http_request_canonicalization_preserves_query_string() {
let (mut client, mut writer) = tokio::io::duplex(4096);
crates/openshell-supervisor-network/src/l7/websocket.rs
+295 -53
View File
@@ -11,12 +11,14 @@ use crate::l7::{EnforcementMode, L7RequestInfo};
use crate::opa::TunnelPolicyEngine;
use flate2::{Compress, Compression, Decompress, FlushCompress, FlushDecompress, Status};
use miette::{IntoDiagnostic, Result, miette};
use openshell_core::secrets::SecretResolver;
use openshell_core::provider_credentials::ProviderCredentialState;
use openshell_core::secrets::{SecretResolver, contains_reserved_credential_marker};
use openshell_ocsf::{
ActionId, ActivityId, DispositionId, Endpoint, NetworkActivityBuilder, SeverityId, StatusId,
ocsf_emit,
};
use std::collections::HashMap;
use std::future::Future;
use tokio::io::{AsyncRead, AsyncReadExt, AsyncWrite, AsyncWriteExt};
const MAX_TEXT_MESSAGE_BYTES: usize = 1024 * 1024;
@@ -28,6 +30,7 @@ const OPCODE_BINARY: u8 = 0x2;
const OPCODE_CLOSE: u8 = 0x8;
const OPCODE_PING: u8 = 0x9;
const OPCODE_PONG: u8 = 0xA;
const CREDENTIAL_ENDPOINT_MISMATCH: &str = "websocket credential endpoint mismatch";
#[derive(Debug)]
struct FrameHeader {
@@ -65,6 +68,8 @@ pub(super) struct InspectionOptions<'a> {
pub(super) struct RelayOptions<'a> {
pub(super) policy_name: &'a str,
pub(super) resolver: Option<&'a SecretResolver>,
pub(super) provider_credentials: Option<&'a ProviderCredentialState>,
pub(super) target: &'a str,
pub(super) inspector: Option<InspectionOptions<'a>>,
pub(super) compression: WebSocketCompression,
}
@@ -105,11 +110,53 @@ where
result = client_to_server => result,
result = server_to_client => result,
};
if result
.as_ref()
.is_err_and(|error| error.to_string().contains(CREDENTIAL_ENDPOINT_MISMATCH))
{
emit_credential_endpoint_mismatch(host, port, options.policy_name);
write_policy_violation_close(&mut client_write).await?;
}
let _ = upstream_write.shutdown().await;
let _ = client_write.shutdown().await;
result
}
async fn write_policy_violation_close<W: AsyncWrite + Unpin>(writer: &mut W) -> Result<()> {
let reason = b"credential endpoint mismatch";
let mut frame = Vec::with_capacity(reason.len() + 4);
frame.push(0x80 | OPCODE_CLOSE);
frame.push(u8::try_from(reason.len() + 2).expect("close reason fits one-byte length"));
frame.extend_from_slice(&1008u16.to_be_bytes());
frame.extend_from_slice(reason);
writer.write_all(&frame).await.into_diagnostic()?;
writer.flush().await.into_diagnostic()
}
fn emit_credential_endpoint_mismatch(host: &str, port: u16, policy_name: &str) {
ocsf_emit!(
NetworkActivityBuilder::new(openshell_ocsf::ctx::ctx())
.activity(ActivityId::Fail)
.action(ActionId::Denied)
.disposition(DispositionId::Blocked)
.severity(SeverityId::High)
.status(StatusId::Failure)
.dst_endpoint(Endpoint::from_domain(host, port))
.firewall_rule(policy_name, "credential-binding")
.message(format!(
"WebSocket credential use denied: credential is not authorized for {host}:{port}"
))
.status_detail("credential_endpoint_mismatch")
.build()
);
ocsf_emit!(crate::l7::build_credential_endpoint_mismatch_finding(
policy_name,
host,
Some("websocket"),
"Provider credential endpoint binding mismatch; WebSocket closed",
));
}
async fn relay_client_to_server<R, W>(
reader: &mut R,
writer: &mut W,
@@ -485,6 +532,36 @@ async fn relay_text_payload<W: AsyncWrite + Unpin>(
port: u16,
options: &RelayOptions<'_>,
) -> Result<()> {
relay_text_payload_with_before_credential_write(
writer,
frame,
payload,
force_reframe,
compressed,
host,
port,
options,
std::future::ready(()),
)
.await
}
#[allow(clippy::too_many_arguments)]
async fn relay_text_payload_with_before_credential_write<W, F>(
writer: &mut W,
frame: &FrameHeader,
payload: Vec<u8>,
force_reframe: bool,
compressed: bool,
host: &str,
port: u16,
options: &RelayOptions<'_>,
before_credential_write: F,
) -> Result<()>
where
W: AsyncWrite + Unpin,
F: Future<Output = ()>,
{
let message_payload = if compressed {
decompress_permessage_deflate(&payload)?
} else {
@@ -492,10 +569,31 @@ async fn relay_text_payload<W: AsyncWrite + Unpin>(
};
let mut text = String::from_utf8(message_payload)
.map_err(|_| miette!("websocket text message is not valid UTF-8"))?;
let replacements = if let Some(resolver) = options.resolver {
let live_resolver = options.provider_credentials.map(|credentials| {
let (resolver, revision) =
credentials.resolver_for_endpoint_with_revision(host, port, options.target);
(
resolver,
crate::l7::rest::CredentialGenerationGuard::new(credentials, revision),
)
});
let resolver = live_resolver
.as_ref()
.map_or(options.resolver, |(resolver, _)| resolver.as_deref());
let replacements = if let Some(resolver) = resolver {
resolver
.rewrite_websocket_text_placeholders(&mut text)
.map_err(|_| miette!("websocket credential placeholder resolution failed"))?
.map_err(|error| {
if error.is_endpoint_mismatch() {
miette!(CREDENTIAL_ENDPOINT_MISMATCH)
} else {
miette!("websocket credential placeholder resolution failed")
}
})?
} else if contains_reserved_credential_marker(&text) {
return Err(miette!(
"websocket credential placeholder resolution failed"
));
} else {
0
};
@@ -522,11 +620,19 @@ async fn relay_text_payload<W: AsyncWrite + Unpin>(
if replacements > 0 {
emit_rewrite_event(host, port, options.policy_name, replacements);
}
if compressed {
let compressed_payload = compress_permessage_deflate(text.as_bytes())?;
return write_masked_frame_with_rsv(writer, OPCODE_TEXT, 0x40, &compressed_payload).await;
let (rsv, frame_payload) = if compressed {
(0x40, compress_permessage_deflate(text.as_bytes())?)
} else {
(0, text.into_bytes())
};
let rewritten_frame = masked_frame_bytes(OPCODE_TEXT, rsv, &frame_payload);
if replacements > 0 {
before_credential_write.await;
if let Some((_, guard)) = live_resolver {
guard.ensure_current()?;
}
}
write_masked_frame(writer, OPCODE_TEXT, text.as_bytes()).await
write_frame_bytes(writer, &rewritten_frame).await
}
fn inspect_websocket_text_message(
@@ -813,20 +919,7 @@ where
Ok(())
}
async fn write_masked_frame<W: AsyncWrite + Unpin>(
writer: &mut W,
opcode: u8,
payload: &[u8],
) -> Result<()> {
write_masked_frame_with_rsv(writer, opcode, 0, payload).await
}
async fn write_masked_frame_with_rsv<W: AsyncWrite + Unpin>(
writer: &mut W,
opcode: u8,
rsv: u8,
payload: &[u8],
) -> Result<()> {
fn masked_frame_bytes(opcode: u8, rsv: u8, payload: &[u8]) -> Vec<u8> {
let mut header = Vec::with_capacity(14);
header.push(0x80 | rsv | opcode);
match payload.len() {
@@ -849,8 +942,12 @@ async fn write_masked_frame_with_rsv<W: AsyncWrite + Unpin>(
let mut masked = payload.to_vec();
apply_mask(&mut masked, mask_key);
writer.write_all(&header).await.into_diagnostic()?;
writer.write_all(&masked).await.into_diagnostic()?;
header.extend_from_slice(&masked);
header
}
async fn write_frame_bytes<W: AsyncWrite + Unpin>(writer: &mut W, frame: &[u8]) -> Result<()> {
writer.write_all(frame).await.into_diagnostic()?;
writer.flush().await.into_diagnostic()?;
Ok(())
}
@@ -1003,7 +1100,10 @@ fn emit_websocket_l7_event(
SeverityId::Informational,
),
};
let summary = graphql.map(graphql_log_summary).unwrap_or_default();
let summary = graphql
.map(crate::l7::graphql::log_summary)
.map(|summary| format!(" {summary}"))
.unwrap_or_default();
let event = NetworkActivityBuilder::new(openshell_ocsf::ctx::ctx())
.activity(ActivityId::Other)
.action(action_id)
@@ -1020,34 +1120,6 @@ fn emit_websocket_l7_event(
ocsf_emit!(event);
}
fn graphql_log_summary(info: &crate::l7::graphql::GraphqlRequestInfo) -> String {
if let Some(error) = info.error.as_deref() {
return format!(" graphql_error={error:?}");
}
let ops: Vec<String> = info
.operations
.iter()
.map(|op| {
let name = op.operation_name.as_deref().unwrap_or("-");
let fields = if op.fields.is_empty() {
"-".to_string()
} else {
op.fields.join(",")
};
let persisted = op
.persisted_query_hash
.as_deref()
.or(op.persisted_query_id.as_deref())
.unwrap_or("-");
format!(
"type={} name={} fields={} persisted={}",
op.operation_type, name, fields, persisted
)
})
.collect();
format!(" graphql_ops={}", ops.join(";"))
}
fn protocol_failure_class(error: &miette::Report) -> &'static str {
let msg = error.to_string().to_ascii_lowercase();
if msg.contains("credential") {
@@ -1108,6 +1180,8 @@ mod tests {
use super::*;
use crate::l7::relay::L7EvalContext;
use crate::opa::{NetworkInput, OpaEngine};
use openshell_core::proto::{StaticCredentialBinding, StaticCredentialEndpointBinding};
use openshell_core::provider_credentials::ProviderCredentialState;
use openshell_core::secrets::SecretResolver;
use std::path::PathBuf;
use tokio::io::{AsyncReadExt, AsyncWriteExt};
@@ -1226,6 +1300,8 @@ network_policies:
let options = RelayOptions {
policy_name: "test-policy",
resolver: Some(&resolver),
provider_credentials: None,
target: "/",
inspector: None,
compression: WebSocketCompression::None,
};
@@ -1244,6 +1320,166 @@ network_policies:
result.map(|()| output)
}
fn bound_websocket_provider_state() -> ProviderCredentialState {
ProviderCredentialState::from_bound_environment(
1,
HashMap::from([("DISCORD_BOT_TOKEN".to_string(), "real-token".to_string())]),
HashMap::new(),
HashMap::new(),
HashMap::from([(
"DISCORD_BOT_TOKEN".to_string(),
StaticCredentialBinding {
endpoints: vec![StaticCredentialEndpointBinding {
host: "gateway.example.test".to_string(),
port: 443,
path: "/socket".to_string(),
}],
credential_identity: "provider-a:DISCORD_BOT_TOKEN".to_string(),
},
)]),
Vec::new(),
)
.expect("bound websocket provider state")
}
async fn relay_frame_after_live_state_change(
state: &ProviderCredentialState,
fallback: &SecretResolver,
) -> (Result<()>, Vec<u8>) {
let placeholder = b"openshell:resolve:env:v1_DISCORD_BOT_TOKEN";
let input = masked_frame(true, 0x1, placeholder);
let (mut client_write, mut relay_read) = tokio::io::duplex(4096);
let (mut relay_write, mut upstream_read) = tokio::io::duplex(4096);
client_write.write_all(&input).await.unwrap();
drop(client_write);
let options = RelayOptions {
policy_name: "test-policy",
resolver: Some(fallback),
provider_credentials: Some(state),
target: "/socket",
inspector: None,
compression: WebSocketCompression::None,
};
let result = relay_client_to_server(
&mut relay_read,
&mut relay_write,
"gateway.example.test",
443,
&options,
)
.await;
drop(relay_write);
let mut output = Vec::new();
upstream_read.read_to_end(&mut output).await.unwrap();
(result, output)
}
#[tokio::test]
async fn established_websocket_does_not_restore_resolver_after_detach() {
let state = bound_websocket_provider_state();
let fallback = state.resolver().expect("upgrade-time resolver");
state.revoke_static_provider_environment(2);
let (result, output) = relay_frame_after_live_state_change(&state, fallback.as_ref()).await;
assert!(result.is_err(), "revoked placeholder must close the relay");
assert!(
output.is_empty(),
"revoked WebSocket credential must not reach upstream"
);
}
#[tokio::test]
async fn established_websocket_does_not_restore_resolver_after_invalid_refresh() {
let state = bound_websocket_provider_state();
let fallback = state.resolver().expect("upgrade-time resolver");
let refresh = state.install_bound_environment(
2,
HashMap::from([("DISCORD_BOT_TOKEN".to_string(), "rotated".to_string())]),
HashMap::new(),
HashMap::new(),
HashMap::new(),
Vec::new(),
);
assert!(
refresh.is_err(),
"incomplete bindings must revoke static state"
);
let (result, output) = relay_frame_after_live_state_change(&state, fallback.as_ref()).await;
assert!(
result.is_err(),
"invalid-refresh placeholder must close the relay"
);
assert!(
output.is_empty(),
"invalid-refresh credential must not reach upstream"
);
}
#[tokio::test]
async fn websocket_rewrite_rejects_revocation_before_frame_write() {
let state = bound_websocket_provider_state();
let fallback = state.resolver().expect("upgrade-time resolver");
let placeholder = b"openshell:resolve:env:v1_DISCORD_BOT_TOKEN";
let compressed = compress_permessage_deflate(placeholder).expect("compress placeholder");
let frame = FrameHeader {
fin: true,
rsv: 0x40,
opcode: OPCODE_TEXT,
masked: true,
payload_len: compressed.len() as u64,
mask_key: Some([0x37, 0xfa, 0x21, 0x3d]),
raw_header: Vec::new(),
};
let options = RelayOptions {
policy_name: "test-policy",
resolver: Some(fallback.as_ref()),
provider_credentials: Some(&state),
target: "/socket",
inspector: None,
compression: WebSocketCompression::PermessageDeflate,
};
let reached_write = tokio::sync::Barrier::new(2);
let release_write = tokio::sync::Barrier::new(2);
let (mut relay_write, mut upstream_read) = tokio::io::duplex(4096);
let relay = relay_text_payload_with_before_credential_write(
&mut relay_write,
&frame,
compressed,
false,
true,
"gateway.example.test",
443,
&options,
async {
reached_write.wait().await;
release_write.wait().await;
},
);
let revoke = async {
reached_write.wait().await;
state.revoke_static_provider_environment(2);
release_write.wait().await;
};
let (result, ()) = tokio::join!(relay, revoke);
assert!(
result
.as_ref()
.is_err_and(|error| error.to_string().contains("generation changed")),
"revoked credential generation must fail before the frame write: {result:?}"
);
drop(relay_write);
let mut output = Vec::new();
upstream_read.read_to_end(&mut output).await.unwrap();
assert!(
output.is_empty(),
"credential revoked before the write guard must not reach upstream"
);
}
async fn run_client_to_server_with_graphql_policy(
input: Vec<u8>,
resolver: Option<&SecretResolver>,
@@ -1284,6 +1520,8 @@ network_policies:
let options = RelayOptions {
policy_name: "graphql_ws",
resolver,
provider_credentials: None,
target: "/graphql",
inspector: Some(InspectionOptions {
engine: &tunnel_engine,
ctx: &ctx,
@@ -1320,6 +1558,8 @@ network_policies:
let options = RelayOptions {
policy_name: "test-policy",
resolver: Some(&resolver),
provider_credentials: None,
target: "/",
inspector: None,
compression: WebSocketCompression::PermessageDeflate,
};
@@ -1507,7 +1747,7 @@ network_policies:
panic!("expected operation, got {other:?}")
}
};
let summary = graphql_log_summary(&graphql);
let summary = crate::l7::graphql::log_summary(&graphql);
assert!(summary.contains("type=query"));
assert!(summary.contains("fields=viewer"));
@@ -1557,6 +1797,8 @@ network_policies:
RelayOptions {
policy_name: "test-policy",
resolver: Some(&resolver),
provider_credentials: None,
target: "/",
inspector: None,
compression: WebSocketCompression::None,
},
crates/openshell-supervisor-network/src/policy_local.rs
+2
View File
@@ -1179,6 +1179,8 @@ fn network_endpoint_from_json(
credential_signing: String::new(),
signing_service: String::new(),
signing_region: String::new(),
// policy.local proposals cannot reference a concrete sandbox provider.
credential_binding: None,
})
}
crates/openshell-supervisor-network/src/proxy.rs
+929 -158
View File
File diff suppressed because it is too large Load Diff
crates/openshell-supervisor-network/src/proxy/relay.rs
+14
View File
@@ -40,11 +40,19 @@ pub(super) struct RelayContext<'a> {
/// Build the request-processing context shared by CONNECT and forward HTTP.
pub(super) fn http_context(
decision: &EgressDecision,
provider_credentials: Option<openshell_core::provider_credentials::ProviderCredentialState>,
secret_resolver: Option<Arc<SecretResolver>>,
activity_tx: Option<ActivitySender>,
dynamic_credentials: Option<DynamicCredentials>,
agent_proposals: openshell_core::proposals::AgentProposals,
) -> L7EvalContext {
// Provider-backed credentials must be acquired from the live state for
// each request after middleware/token-grant awaits. Keep only the legacy
// resolver fallback when no live provider state exists.
let secret_resolver = provider_credentials
.is_none()
.then_some(secret_resolver)
.flatten();
let policy_name = match &decision.action {
NetworkAction::Allow { matched_policy } => matched_policy.clone().unwrap_or_default(),
NetworkAction::Deny { .. } => String::new(),
@@ -53,6 +61,7 @@ pub(super) fn http_context(
L7EvalContext {
host: decision.intent.destination.host.clone(),
port: decision.intent.destination.port,
request_default_port: None,
policy_name,
binary_path: decision
.binary
@@ -70,6 +79,8 @@ pub(super) fn http_context(
.map(|path| path.to_string_lossy().into_owned())
.collect(),
secret_resolver,
provider_credentials,
provider_credential_revision: None,
activity_tx,
dynamic_credentials: dynamic_credentials.clone(),
token_grant_resolver: dynamic_credentials
@@ -333,11 +344,14 @@ mod tests {
L7EvalContext {
host: "example.com".to_string(),
port: 80,
request_default_port: Some(80),
policy_name: "test".to_string(),
binary_path: String::new(),
ancestors: vec![],
cmdline_paths: vec![],
secret_resolver: None,
provider_credentials: None,
provider_credential_revision: None,
activity_tx: None,
dynamic_credentials: None,
token_grant_resolver: None,
crates/openshell-supervisor-network/src/proxy/tests/compatibility.rs
+1
View File
@@ -553,6 +553,7 @@ network_policies:
None,
None,
None,
None,
))
.await
.unwrap();
deploy/helm/openshell/README.md
+1
View File
@@ -253,6 +253,7 @@ add `ci/values-spire.yaml` to the OpenShell release values files.
| server.sandboxJwt.signingSecretName | string | `""` | Name of the Opaque Secret holding the signing key material. Empty falls back to the chart fullname with "-jwt-keys" appended. |
| server.sandboxJwt.ttlSecs | int | `3600` | Token TTL in seconds. Defaults to 3600 (1h). |
| server.sandboxNamespace | string | `""` | Namespace where sandbox pods are created. Defaults to the Helm release namespace (.Release.Namespace) when left empty. |
| server.telemetryEnabled | bool | `true` | Enable anonymous OpenShell telemetry from the gateway and the sandbox supervisors it launches. |
| server.tls.certSecretName | string | `"openshell-server-tls"` | K8s secret (type kubernetes.io/tls) with tls.crt and tls.key for the server. |
| server.tls.clientCaSecretName | string | `"openshell-server-client-ca"` | K8s secret with ca.crt for client certificate verification (mTLS). Set to "" to disable mTLS and run HTTPS-only (use OIDC for auth instead). |
| server.tls.clientTlsSecretName | string | `"openshell-client-tls"` | K8s secret mounted into sandbox pods for mTLS to the server. |
deploy/helm/openshell/templates/_gateway-workload.tpl
+2
View File
@@ -75,6 +75,8 @@ spec:
- name: SSL_CERT_FILE
value: /etc/openshell-tls/oidc-ca/ca.crt
{{- end }}
- name: OPENSHELL_TELEMETRY_ENABLED
value: {{ .Values.server.telemetryEnabled | quote }}
volumeMounts:
{{- if eq (include "openshell.workloadKind" .) "statefulset" }}
- name: openshell-data
deploy/helm/openshell/tests/gateway_config_test.yaml
+20
View File
@@ -42,6 +42,26 @@ tests:
path: spec.template.spec.containers[0].name
value: openshell-gateway
- it: enables anonymous telemetry by default
template: templates/statefulset.yaml
asserts:
- contains:
path: spec.template.spec.containers[0].env
content:
name: OPENSHELL_TELEMETRY_ENABLED
value: "true"
- it: disables anonymous telemetry when configured
template: templates/statefulset.yaml
set:
server.telemetryEnabled: false
asserts:
- contains:
path: spec.template.spec.containers[0].env
content:
name: OPENSHELL_TELEMETRY_ENABLED
value: "false"
- it: mounts the OIDC CA bundle when TLS is disabled
template: templates/statefulset.yaml
set:
deploy/helm/openshell/values.yaml
+3
View File
@@ -164,6 +164,9 @@ affinity: {}
server:
# -- Gateway log level.
logLevel: info
# -- Enable anonymous OpenShell telemetry from the gateway and the sandbox
# supervisors it launches.
telemetryEnabled: true
# -- Namespace where sandbox pods are created. Defaults to the Helm release
# namespace (.Release.Namespace) when left empty.
sandboxNamespace: ""
docs/kubernetes/setup.mdx
+1
View File
@@ -151,6 +151,7 @@ The most commonly changed values are:
| `workload.allowMultiReplicaStatefulSet` | Allow `replicaCount > 1` with `workload.kind=statefulset`. Prefer Deployment for external database-backed multi-replica gateways. |
| `server.sandboxNamespace` | Namespace where sandbox pods are created. Defaults to the Helm release namespace when left empty. |
| `server.externalDbSecret` | Secret containing a PostgreSQL connection URI in the `uri` key. Use when the database is managed outside the chart. |
| `server.telemetryEnabled` | Enable anonymous OpenShell telemetry from the gateway and its sandbox supervisors. Set to `false` to opt out. |
| `server.sandboxImage` | Default sandbox image used when a sandbox does not specify one. |
| `server.sandboxImagePullSecrets` | Image pull secrets attached to sandbox pods. Referenced Secrets must exist in the sandbox namespace. |
| `server.grpcEndpoint` | Endpoint that sandbox supervisors use to call back to the gateway. Must be reachable from inside the cluster. |
docs/providers/aws-sigv4.mdx
+19 -3
View File
@@ -12,7 +12,8 @@ AWS SigV4 credential signing lets sandbox agents call AWS services (Bedrock, S3,
## Prerequisites
- A provider with `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` credentials configured. Optionally include `AWS_SESSION_TOKEN` for STS temporary credentials.
- A sandbox policy with `credential_signing` enabled on the target endpoint.
- An endpointless `aws` provider profile when the sandbox policy defines the service endpoints, or an endpoint-bearing service profile such as `aws-s3`.
- A sandbox policy with `credential_signing` enabled on the target endpoint. For the endpointless `aws` profile, the endpoint must also set `credential_binding.provider` to the attached provider name.
## Provider Setup
@@ -21,6 +22,7 @@ Create a provider with AWS credentials:
```shell
openshell provider create \
--name aws-prod \
--type aws \
--credential AWS_ACCESS_KEY_ID=AKIA... \
--credential AWS_SECRET_ACCESS_KEY=wJalr...
```
@@ -30,6 +32,7 @@ For STS temporary credentials, include the session token:
```shell
openshell provider create \
--name aws-sts \
--type aws \
--credential AWS_ACCESS_KEY_ID=ASIA... \
--credential AWS_SECRET_ACCESS_KEY=secret... \
--credential AWS_SESSION_TOKEN=FwoGZX...
@@ -43,10 +46,13 @@ signer reads. See [Manage Providers](/sandboxes/manage-providers#aws-sts).
## Policy Configuration
Enable SigV4 signing on a per-endpoint basis using three policy fields:
Enable SigV4 signing on a per-endpoint basis. The binding selects which
provider instance supplies credentials, while the signing fields control how
the proxy applies them:
| Field | Type | Required | Description |
|---|---|---|---|
| `credential_binding.provider` | string | For endpointless profiles | Exact name of the attached provider instance that supplies AWS credentials. |
| `credential_signing` | string | Yes | Signing mode: `sigv4`, `sigv4:body`, or `sigv4:no_body`. |
| `signing_service` | string | Yes | AWS service name for the SigV4 signature (e.g. `bedrock`, `s3`, `sts`). |
| `signing_region` | string | No | AWS region override. When omitted, extracted from the endpoint hostname. Required for non-standard endpoints. |
@@ -60,6 +66,8 @@ network_policies:
- host: bedrock-runtime.us-east-1.amazonaws.com
port: 443
protocol: rest
credential_binding:
provider: aws-prod
credential_signing: sigv4
signing_service: bedrock
rules:
@@ -82,6 +90,8 @@ network_policies:
port: 443
protocol: rest
access: full
credential_binding:
provider: aws-prod
credential_signing: sigv4
signing_service: s3
```
@@ -96,6 +106,8 @@ network_policies:
port: 443
protocol: rest
access: full
credential_binding:
provider: aws-prod
credential_signing: sigv4
signing_service: sts
```
@@ -133,6 +145,8 @@ endpoints:
port: 443
protocol: rest
access: full
credential_binding:
provider: aws-prod
credential_signing: sigv4
signing_service: s3
signing_region: us-west-2
@@ -141,8 +155,10 @@ endpoints:
## Restrictions
- `credential_signing` and `request_body_credential_rewrite` are mutually exclusive on the same endpoint. The policy validator rejects policies that set both.
- `credential_binding.provider` must name a provider attached to that sandbox. Use it only when the selected provider profile has no endpoints. Endpoint-bearing profiles already define their credential boundary.
- OpenShell rejects a signed sandbox policy before activation unless the endpoint has a resolvable AWS credential source. An endpoint-bearing profile must declare `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` and cover the signed host, port, and path. An endpointless profile must declare those keys and be selected with `credential_binding.provider` on the signed endpoint.
- The `sigv4:body` mode buffers at most 10 MiB. Requests with larger bodies are rejected. Use `sigv4:no_body` or `sigv4` (auto-detect) for large payloads.
- The proxy requires `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` in the provider. If either is missing, the request fails with an error.
- The active provider must contain current `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` values. If either becomes unavailable after policy activation, the request fails closed.
## Use from a Sandbox
docs/reference/policy-schema.mdx
+29
View File
@@ -176,6 +176,8 @@ Each endpoint defines a reachable destination and optional inspection rules.
| `credential_signing` | string | No | Proxy-side credential signing mode. When set, the proxy strips the sandbox client's `Authorization` header and re-signs with real provider credentials. Values: `sigv4` (auto-detect payload mode from client headers), `sigv4:body` (buffer and hash body, max 10 MiB), `sigv4:no_body` (unsigned payload, stream body). Mutually exclusive with `request_body_credential_rewrite`. See [AWS SigV4](/providers/aws-sigv4). |
| `signing_service` | string | No | AWS service name for SigV4 signing (e.g. `bedrock`, `s3`, `sts`). Required when `credential_signing` is set. |
| `signing_region` | string | No | AWS region override for SigV4 signing (e.g. `us-east-1`). When omitted, the region is extracted from the endpoint hostname. Required for non-standard AWS endpoints where the region cannot be inferred. |
| `credential_binding` | object | No | Binds static credentials from an attached provider to this endpoint when that provider's profile defines no endpoints. This field is valid only in a sandbox-scoped policy. |
| `credential_binding.provider` | string | Yes with `credential_binding` | Exact name of the provider instance attached to the sandbox. The referenced provider must have a profile, and that profile must define no endpoints. |
| `persisted_queries` | string | No | GraphQL hash-only behavior for `protocol: graphql` and GraphQL-over-WebSocket operation policy. Default is `deny`; use `allow_registered` only with `graphql_persisted_queries`. |
| `graphql_persisted_queries` | map | No | Trusted GraphQL persisted-query registry keyed by hash or saved-query ID. Values contain `operation_type`, optional `operation_name`, and optional root `fields`. |
| `graphql_max_body_bytes` | integer | No | Maximum GraphQL-over-HTTP request body bytes buffered for inspection. Defaults to `65536`. |
@@ -196,9 +198,36 @@ Each endpoint defines a reachable destination and optional inspection rules.
- `rules: []` (empty list) is rejected; use `access: full` or remove `rules`.
- Non-empty `rules` must contain at least one effective allow clause; rules where every entry lacks an allow are rejected as deny-all.
- `deny_rules: []` (empty list) is rejected; remove it if no denials are needed.
- `credential_signing` requires a resolvable AWS credential source before a sandbox policy can activate. Use an attached endpoint-bearing profile that declares `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` and covers the signed endpoint, or bind an attached endpointless profile that declares those keys with `credential_binding.provider`.
Credential rewrite recognizes the canonical `openshell:resolve:env:KEY` placeholder form and whole-token provider-shaped aliases such as `provider-OPENSHELL-RESOLVE-ENV-API_TOKEN` when the referenced environment key exists in the configured provider credentials.
Static provider placeholders also require the request host, port, and path to
match their credential binding. Profile endpoints supply this boundary by
default. An endpointless profile can instead use a sandbox policy endpoint with
`credential_binding.provider` set to the exact attached provider name. OpenShell
rejects unattached providers, profileless providers, endpointful profiles, and
global policies that use this field. Network policy admission does not expand
the credential boundary unless the endpoint explicitly supplies this binding.
OpenShell rejects a request mismatch with HTTP 403 and
`credential_endpoint_mismatch`. Refer to [Static Credential Endpoint
Binding](/sandboxes/providers-v2#understand-static-credential-endpoint-binding).
This example allows the sandbox to reach Google Cloud Storage and binds the
static credentials from the attached `work-gcp` provider to that endpoint:
```yaml showLineNumbers={false}
network_policies:
gcp_storage:
endpoints:
- host: storage.googleapis.com
port: 443
protocol: rest
access: full
credential_binding:
provider: work-gcp
```
#### Access Levels
The `access` field accepts one of the following values on REST, WebSocket, and GraphQL endpoints. MCP and JSON-RPC endpoints reject `access` because HTTP method/path presets cannot authorize JSON-RPC safely. Use explicit MCP rules, set `mcp.allow_all_known_mcp_methods: true` for the MCP method profile, or use explicit JSON-RPC rules.
docs/sandboxes/manage-providers.mdx
+79 -27
View File
@@ -46,7 +46,7 @@ and stores them in the provider.
Supply a credential value directly:
```shell
openshell provider create --name my-api --type generic --credential API_KEY=sk-abc123
openshell provider create --name my-nvidia --type nvidia --credential NVIDIA_API_KEY=nvapi-example
```
### Bare Key Form
@@ -55,10 +55,10 @@ Pass a key name without a value to read the value from the environment variable
of that name:
```shell
openshell provider create --name my-api --type generic --credential API_KEY
openshell provider create --name my-nvidia --type nvidia --credential NVIDIA_API_KEY
```
This looks up the current value of `$API_KEY` in your shell and stores it.
This looks up the current value of `$NVIDIA_API_KEY` in your shell and stores it.
Provider profile metadata is available for known provider types. Provider profile
network policy is gateway opt-in:
@@ -67,7 +67,9 @@ network policy is gateway opt-in:
openshell settings set --global --key providers_v2_enabled --value true
```
Without `providers_v2_enabled=true`, provider behavior remains credential-only.
Without `providers_v2_enabled=true`, attached provider profiles do not contribute
network policy to the sandbox. Static credential endpoint binding remains active
in either mode.
When `providers_v2_enabled=true`, `--from-existing` uses profile-backed
discovery instead of the legacy provider registry. The requested `--type` must
@@ -90,6 +92,14 @@ one file at a time and rejects stale resource versions. When
`providers_v2_enabled=true`, updated profile policy applies to all provider
instances of that type on the next sandbox config sync.
<Warning>
Static credentials require a built-in or imported provider profile. Profiles
normally define at least one endpoint. An endpointless profile requires an
explicit `credential_binding.provider` on a sandbox policy endpoint. OpenShell
does not activate static credentials from a profileless provider because it
cannot determine which credential definition applies.
</Warning>
## Manage Providers
List, inspect, update, and delete providers from the active gateway.
@@ -247,11 +257,14 @@ Pass one or more `--provider` flags when creating a sandbox:
openshell sandbox create --provider my-claude --provider my-github -- claude
```
Each `--provider` flag attaches one provider. The sandbox receives all
credentials from every attached provider at runtime. Profile-managed providers
also contribute provider-generated network policy entries when
`providers_v2_enabled` is enabled at the gateway. When the setting is disabled,
providers keep the previous behavior and only provide credentials.
Each `--provider` flag attaches one provider. The sandbox receives eligible
credentials from every attached provider as placeholders at runtime. Each
static credential resolves only for endpoints in that provider's profile, or
for explicitly bound sandbox policy endpoints when the profile is endpointless.
Profile-managed providers also contribute provider-generated network policy
entries when `providers_v2_enabled` is enabled at the gateway. When the setting
is disabled, endpoint binding still applies, but provider-generated policy does
not.
<Warning>
Legacy provider attachment is fixed at sandbox creation time. Providers v2 adds
@@ -282,9 +295,35 @@ provider instance, and pass `--provider <name>` explicitly.
## How Credential Injection Works
The agent process inside the sandbox never sees real credential values. At startup, the proxy replaces each credential with an opaque placeholder token in the agent's environment. When the agent sends an HTTP request containing a placeholder, the proxy resolves it to the real credential before forwarding upstream.
The agent process inside the sandbox never sees real credential values. At
startup, OpenShell replaces each credential with an opaque placeholder token in
the agent's environment. When the agent sends an HTTP request containing a
placeholder, the proxy resolves it immediately before forwarding the request.
This resolution requires the proxy to see plaintext HTTP. Endpoints must use `protocol: rest` in the policy (which auto-terminates TLS) or explicit `tls: terminate`. Endpoints without TLS termination pass traffic through as an opaque stream, and credential placeholders are forwarded unresolved.
Static credential resolution has two independent authorization boundaries:
1. Network policy must allow the calling binary and request destination.
2. The credential binding must include the request host, port, and path. Profile
endpoints provide the binding by default. An endpointless profile can use a
sandbox policy endpoint that names the attached provider instance through
`credential_binding.provider`.
Both checks must pass. A provider profile endpoint does not grant network access
unless provider policy composition or the sandbox's own policy allows the
request. A plain sandbox policy endpoint does not grant credential use unless
the profile already covers it or the endpoint explicitly binds an endpointless
provider.
Endpoint binding applies whether `providers_v2_enabled` is enabled or disabled.
The setting controls provider policy composition only. Every static credential
declared by a provider receives the complete endpoint set from that provider's
profile, or the explicitly bound sandbox policy endpoints for an endpointless
profile.
Credential resolution requires the proxy to handle the request as HTTP. Raw
`tls: skip` and non-HTTP tunnels remain opaque and do not support credential
rewrite. Refer to [Providers v2](/sandboxes/providers-v2#understand-static-credential-endpoint-binding)
for endpoint matching and migration guidance.
### Supported injection locations
@@ -296,30 +335,42 @@ The proxy resolves credential placeholders in the following parts of an HTTP req
| Header value (Basic auth) | Agent base64-encodes `user:<placeholder>` in an `Authorization: Basic` header. The proxy decodes, resolves, and re-encodes. | `Authorization: Basic <base64>` |
| Query parameter value | Agent places the placeholder in a URL query parameter. | `GET /api?key=<placeholder>` |
| URL path segment | Agent builds a URL with the placeholder in the path. Supports concatenated patterns. | `POST /bot<placeholder>/sendMessage` |
| Supported request body | An inspected REST endpoint opts in with `request_body_credential_rewrite: true`. | `{"api_key":"<placeholder>"}` |
| WebSocket text message | A REST or WebSocket endpoint opts in with `websocket_credential_rewrite: true`. | `{"token":"<placeholder>"}` |
| AWS SigV4 signing | An endpoint configures `credential_signing`, and the proxy signs with the endpoint-bound AWS credentials. | `credential_signing: sigv4` |
The proxy does not modify request bodies, cookies, or response content.
The proxy does not rewrite cookies, response content, unsupported request
bodies, or WebSocket binary frames.
### Fail-closed behavior
If the proxy detects a credential placeholder in a request but cannot resolve it, it rejects the request with HTTP 500 instead of forwarding the raw placeholder to the upstream server. This prevents accidental credential leakage in server logs or error responses.
If policy allows a request but the credential binding does not include the
request endpoint, the proxy rejects the request with HTTP 403 and the
`credential_endpoint_mismatch` reason. It emits a denied activity event and a
security finding without recording the secret, placeholder, environment key, or
query string.
### Example: Telegram Bot API (path-based credential)
Unknown, malformed, expired, or otherwise unresolved placeholders also fail
closed instead of being forwarded to the upstream service.
Create a provider with the Telegram bot token:
### Inspect an Endpoint Binding
Export the profile used by a provider to inspect its credential boundary:
```shell
openshell provider create --name telegram --type generic --credential TELEGRAM_BOT_TOKEN=123456:ABC-DEF
openshell provider profile export github -o yaml
```
The agent reads `TELEGRAM_BOT_TOKEN` from its environment and builds a request like `POST /bot<placeholder>/sendMessage`. The proxy resolves the placeholder in the URL path and forwards `POST /bot123456:ABC-DEF/sendMessage` to the upstream.
For the built-in GitHub profile, `GITHUB_TOKEN` and `GH_TOKEN` can resolve for
the profile's `api.github.com:443` and `github.com:443` endpoints. Even if a
sandbox policy allows `uploads.example.com:443`, sending either placeholder
there returns `credential_endpoint_mismatch`.
### Example: Google API (query parameter credential)
```shell
openshell provider create --name google --type generic --credential YOUTUBE_API_KEY=AIzaSy-secret
```
The agent sends `GET /youtube/v3/search?part=snippet&key=<placeholder>`. The proxy resolves the placeholder in the query parameter value and percent-encodes the result before forwarding.
For a custom service, define the credential in a custom provider profile. Put
stable endpoints in the profile, or leave the profile endpointless and bind
each concrete provider instance from sandbox policy. Refer to [Provider
Profiles](/sandboxes/providers-v2#provider-profiles) for the profile workflow
and schema.
## Supported Provider Types
@@ -333,7 +384,7 @@ The following provider types are supported.
| `codex` | `OPENAI_API_KEY` | OpenAI Codex |
| `copilot` | `COPILOT_GITHUB_TOKEN`, `GH_TOKEN`, `GITHUB_TOKEN` | GitHub Copilot CLI |
| `deepinfra` | `DEEPINFRA_API_KEY` | DeepInfra inference API |
| `generic` | User-defined | Any service with custom credentials |
| `generic` | User-defined | Legacy credential storage. Import an endpoint-bearing custom profile for credentials attached to a sandbox. |
| `github` | `GITHUB_TOKEN`, `GH_TOKEN` | GitHub API and `gh` CLI. Refer to [GitHub Sandbox](/get-started/tutorials/github-sandbox). |
| `gitlab` | `GITLAB_TOKEN`, `GLAB_TOKEN`, `CI_JOB_TOKEN` | GitLab API, `glab` CLI |
| `nvidia` | `NVIDIA_API_KEY` | NVIDIA API Catalog |
@@ -345,8 +396,9 @@ The following provider types are supported.
</Note>
<Tip>
Use the `generic` type for any service not listed above. You define the
environment variable names and values yourself with `--credential`.
For a service not listed above, import a custom provider profile that declares
its credential environment variables and endpoints. Use the imported profile
ID as the provider `--type`.
</Tip>
docs/sandboxes/policies.mdx
+33
View File
@@ -329,6 +329,12 @@ Use the `request-body-credential-rewrite` endpoint option with `protocol: rest`
Credential rewrite recognizes the canonical `openshell:resolve:env:KEY` placeholder form and whole-token provider-shaped aliases such as `provider-OPENSHELL-RESOLVE-ENV-API_TOKEN` when the referenced environment key exists in the configured provider credentials.
Static provider placeholders resolve only when the request host, port, and path
also match an endpoint in the provider profile. A sandbox policy allow does not
expand that binding. A mismatch returns HTTP 403 with
`credential_endpoint_mismatch`. Refer to [Static Credential Endpoint
Binding](/sandboxes/providers-v2#understand-static-credential-endpoint-binding).
For example:
- `api.github.com:443:read-only:rest` is valid.
@@ -501,7 +507,25 @@ The CLI validates the argument shapes before it sends the request. The gateway t
- a port is outside `1` through `65535`.
- `--add-allow` or `--add-deny` points at an endpoint that does not exist.
- `--add-allow` or `--add-deny` targets an endpoint that is neither REST nor WebSocket.
- `--add-allow` or `--add-deny` targets a host and port that resolves to more than one endpoint.
- `--add-deny` targets an endpoint that has no base allow set.
- an update names an existing rule and adds a binary to it without declaring every endpoint and port that rule already authorizes.
- an update names an existing rule and adds or changes an endpoint on it without declaring every binary that rule already authorizes.
- an update widens a rule to any binary without declaring every endpoint that rule already authorizes.
- an update changes an endpoint without declaring every port that endpoint carries.
- an update puts an MCP endpoint on the same host and port as a differently inspected endpoint, or gives one host and port two different MCP inspection contracts, including through separate rules or different paths.
A rule authorizes every listed binary to reach every listed endpoint and port, so merging a binary and an endpoint into the same rule authorizes that pair too. The gateway rejects the whole batch rather than granting a pair the update did not ask for. The error names the binary scope and the ports involved, and lists the binaries you still need to declare. An empty binary list means any binary, so widening a rule to any binary is subject to the same requirement.
You can declare the scope across several `--add-endpoint` arguments. The update is complete as long as every binary-to-port pair the merged rule ends up authorizing appears somewhere in the update.
An endpoint's allow rules, deny rules, and allowed IPs apply to every port that endpoint carries, so an update that changes any of them has to name every one of those ports. Declaring `api.example.com:443` alone on an endpoint that also serves `8443` is rejected, because the change would reach `8443` as well. Declaring every existing binary does not lift this requirement; the two are separate axes of the same product.
The sandbox picks the parser for a request by most-specific path, but it authorizes the request against every endpoint that matches it. A broad REST endpoint and a narrower GraphQL endpoint on one host and port share the same method-and-path rule vocabulary, so that combination stays supported. MCP does not: its rules address JSON-RPC methods and tool names, so a plain REST rule on an overlapping path could authorize a tool call the MCP endpoint denies. An MCP endpoint therefore cannot share a host and port with a differently inspected endpoint, and two MCP endpoints there must agree on strict-tool-name, method-profile, and body-limit settings, even under different paths or in separate rules. An update creating either situation is rejected. A policy that already contains one is left alone so unrelated updates still apply, but it should be repaired with full YAML replacement.
To grant one binary access to only part of an existing rule's endpoints, send it under its own `--rule-name`. The gateway normally folds an update into an existing rule that shares an endpoint, but it keeps your rule name whenever folding would grant authorization you did not declare, so the narrow grant lands as its own rule authorizing exactly what you asked for. The update reports that it kept your rule name and names the rule it would otherwise have folded into. An MCP contract conflict is the exception: one host and port carry a single MCP contract regardless of which rule holds them, so a conflicting update is rejected rather than moved to a separate rule.
Once a host and port appears in more than one rule, `--add-allow` and `--add-deny` can no longer target it. They select an endpoint by host and port alone, so they cannot say which rule's binary scope to widen, and the gateway rejects the update rather than guessing. The same applies when one rule carries two endpoints on that host and port under different paths. Use full YAML replacement to change L7 rules on an endpoint that appears more than once.
## Global Policy Override
@@ -539,9 +563,18 @@ When triaging denied requests, check:
- Destination host and port to confirm which endpoint is missing.
- Calling binary path to confirm which `binaries` entry needs to be added or adjusted.
- HTTP method and path for REST endpoints, or `GET` / `WEBSOCKET_TEXT` and the upgraded request path for WebSocket endpoints, to confirm which `rules` entry needs to be added or adjusted.
- `credential_endpoint_mismatch` in sandbox logs to confirm that policy admitted the request but the attached provider profile did not authorize its credential for that host, port, and path.
- `request_authority_mismatch` in the response or sandbox logs to confirm that the HTTP request authority differs from the authorized tunnel endpoint. For a CONNECT tunnel to `api.example.com:8443`, send `Host: api.example.com:8443`; omitting the non-default port makes the request authority use the transport default and OpenShell rejects it. Absolute-form request targets must use the same host and port.
Then push the updated policy as described above.
Do not fix `credential_endpoint_mismatch` by widening sandbox policy. Export the
provider profile with `openshell provider profile export <profile-id> -o yaml`.
Update the custom provider profile only when the destination is an intended
credential recipient. Refer to [Static Credential Endpoint
Binding](/sandboxes/providers-v2#understand-static-credential-endpoint-binding)
for the complete authorization model.
For small changes, prefer `openshell policy update` over rewriting the full YAML:
```shell
docs/sandboxes/providers-v2.mdx
+142 -8
View File
@@ -25,7 +25,7 @@ Providers v2 keeps those pieces together:
| Custom provider definitions | You can export, edit, lint, import, list, and delete custom profiles. |
| Runtime provider lifecycle | You can list, attach, and detach providers on existing sandboxes. |
| Credential rotation | Provider refresh metadata lets the gateway refresh short-lived access tokens and update provider records. |
| Backward compatibility | Credential delivery still uses environment placeholders and proxy rewrite. |
| Credential transport | Credential delivery uses environment placeholders and proxy rewrite. Static placeholders resolve only at profile endpoints or explicitly bound sandbox policy endpoints for endpointless profiles. |
## Enable Providers v2
@@ -35,7 +35,7 @@ Provider profile policy composition is controlled by the gateway-level `provider
openshell settings set --global --key providers_v2_enabled --value true
```
When the setting is disabled or unset, providers keep the existing credential-only behavior. Sandboxes still receive provider credential placeholders, but attached provider profiles do not add network policy entries to the effective policy.
When the setting is disabled or unset, attached provider profiles do not add network policy entries to the effective policy. Static provider credential placeholders still use the profile endpoints as a resolution boundary.
To disable provider profile policy composition, delete the setting:
@@ -44,7 +44,7 @@ openshell settings delete --global --key providers_v2_enabled
```
<Note>
The feature flag controls provider-derived policy layers. OpenShell still supports placeholder environment variables for provider credentials, and provider profiles can also declare dynamic token grants that the sandbox proxy resolves on demand for matching HTTP endpoints.
The feature flag controls provider-derived policy layers. It does not disable endpoint binding for static credential placeholders. Provider profiles can also declare dynamic token grants that the sandbox proxy resolves on demand for matching HTTP endpoints.
</Note>
## Available Features
@@ -63,6 +63,138 @@ Providers v2 currently includes these user-facing features:
- Credential refresh configuration with `openshell provider refresh status|configure|rotate|delete`.
- Credential expiry metadata with `openshell provider update --credential-expires-at`; values accept Unix epoch milliseconds or ISO/RFC3339 timestamps.
- Dynamic token grants that use the sandbox's SPIFFE JWT-SVID as an OAuth2 client assertion and inject short-lived tokens into supported headers for matching profile endpoints.
- Endpoint-bound static credential placeholders. The sandbox proxy resolves a static credential only for request hosts, ports, and paths declared by its provider profile or explicitly bound in sandbox policy for an endpointless profile.
## Understand Static Credential Endpoint Binding
Static credential endpoint binding prevents a placeholder for one service from
resolving on a different policy-allowed service. OpenShell associates every
static credential environment key with an endpoint boundary. Profile endpoints
supply that boundary by default. For an endpointless profile, a sandbox policy
endpoint can name the attached provider instance explicitly. The proxy checks
the resulting association before it substitutes the real value.
A request can use a static credential only when all of these checks pass:
| Check | Configuration source |
|---|---|
| The placeholder belongs to the current attached provider state. | Sandbox provider attachment and current provider record. |
| The calling binary and destination are allowed. | Effective sandbox network policy. |
| The host, port, and canonical request path match the credential binding. | Provider profile endpoints, or an explicit sandbox policy binding for an endpointless profile. |
| The HTTP method, path, or protocol operation is allowed when L7 inspection is configured. | Effective sandbox network policy. |
| The credential has not expired. | Provider credential expiry metadata. |
Network policy and credential binding serve different purposes. Network policy
authorizes traffic. A credential binding authorizes use of one provider
instance's credentials at an admitted endpoint. A credential binding cannot
widen sandbox network policy.
For example, this profile endpoint binds all static credential environment keys
from the profile to `api.example.com:443` under `/v1`:
```yaml showLineNumbers={false}
endpoints:
- host: api.example.com
port: 443
path: /v1/**
```
The path `/v1/**` matches `/v1` and its descendants. An empty path, `**`, or
`/**` matches every path on the selected host and port. Other path values use
glob matching. OpenShell removes the query string and uses a canonical,
secret-redacted path for this check, so a credential embedded in a request path
does not need to be revealed before authorization.
Use an explicit sandbox policy binding when the profile intentionally defines
credentials without defining service endpoints. The policy names the concrete
provider instance, not the profile type:
```yaml showLineNumbers={false}
network_policies:
gcp_storage:
endpoints:
- host: storage.googleapis.com
port: 443
protocol: rest
access: full
credential_binding:
provider: work-gcp
```
The provider must be attached to the sandbox and must select an endpointless
profile. OpenShell rejects the complete policy update if the provider is
unattached, has no profile, or selects a profile that already defines endpoints.
This keeps one source of credential-binding authority for each provider.
`credential_binding` is sandbox-scoped and is not accepted in a gateway-global
policy.
For AWS endpoints, the binding and signing fields have separate jobs.
`credential_binding.provider` selects the provider instance that supplies
credentials. `credential_signing`, `signing_service`, and `signing_region`
control how the proxy applies those credentials:
```yaml showLineNumbers={false}
network_policies:
aws_s3:
endpoints:
- host: s3.us-west-2.amazonaws.com
port: 443
protocol: rest
access: full
credential_binding:
provider: work-aws
credential_signing: sigv4
signing_service: s3
signing_region: us-west-2
```
The binding applies to CONNECT and forward-proxy HTTP requests, including
headers, Basic and Bearer authorization, URL paths, query parameters, opted-in
request bodies, AWS SigV4 signing, and opted-in WebSocket text messages. Raw
`tls: skip` and non-HTTP tunnels do not perform static credential substitution.
Before it activates a sandbox policy, OpenShell verifies that every endpoint
with `credential_signing` has an attached profile that declares
`AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY`. An endpoint-bearing profile must
cover the signed host, port, and path. An endpointless profile must be selected
by `credential_binding.provider` on that endpoint. A missing or mismatched
source rejects the whole policy update with `FAILED_PRECONDITION`.
If an HTTP request contains a known placeholder at a destination outside its
binding, OpenShell returns HTTP 403 with this response:
```json
{"error":"credential_endpoint_mismatch","message":"Credential is not authorized for this request endpoint"}
```
The sandbox logs include the destination and
`credential_endpoint_mismatch`. OCSF output includes both the denied activity
and a detection finding. These events omit credential values, placeholders,
environment keys, and query strings.
For opted-in WebSocket text-message rewriting, the mismatch can occur after the
HTTP 101 upgrade has completed. OpenShell closes that WebSocket with policy
violation code 1008 instead of returning an HTTP response.
Binding updates apply to both current and retained placeholder generations.
Credential rotation keeps the current endpoint set. Updating a provider profile
changes the binding on the next sandbox provider-environment sync, and detaching
the provider revokes resolution for placeholders already held by running
processes.
<Warning>
Static credentials require at least one usable binding. OpenShell withholds only
the static credential keys and associated expiry and binding metadata from an
endpointless selected profile when no sandbox policy endpoint explicitly binds
that provider. It retains that provider's generated non-secret configuration
and valid endpoint-bound static credentials from other attached providers.
</Warning>
After upgrading a gateway and supervisor to a release with endpoint binding,
restart or recreate older running sandboxes. A new gateway withholds static
credential material from supervisors that do not advertise binding support.
Rotate attached static credentials after upgrading when an older sandbox may
have received their real values.
## Roadmap
@@ -71,7 +203,7 @@ The following Providers v2 design items are not part of the current behavior:
| Roadmap item | Current behavior |
|---|---|
| General profile-driven credential placement | Static `auth_style`, `header_name`, `query_param`, and `path_template` placement metadata is stored and validated, but static credential injection still depends on environment placeholders generated from provider credentials. Dynamic `token_grant` credentials support `bearer` and `header` placement for matching HTTP endpoints. |
| Endpoint and binary scoped credential injection | Provider profile endpoints and binaries affect policy composition. Dynamic token grants are endpoint-scoped. Static placeholder injection is not yet restricted by profile endpoint or binary metadata. |
| Binary-scoped credential injection | Provider profile binaries affect policy composition but do not yet restrict placeholder resolution by calling binary. Static and dynamic credentials are endpoint-scoped. |
| Credential verification on create | `openshell provider create` does not yet probe provider verification endpoints or expose `--no-verify`. |
| Automatic credential scope extraction | OpenShell does not yet inspect upstream provider responses to discover credential scopes. |
| Inference mounting from attached providers | `inference_capable` is profile metadata. Attaching an inference-capable provider does not yet create `inference.local` routes. |
@@ -284,7 +416,7 @@ binaries:
`category` groups profiles in `openshell provider list-profiles`. Use one of the values in the category enum.
`credentials` declares the credential names, environment variables, auth metadata, optional refresh metadata, and optional dynamic token grant metadata for the provider type. The `auth_style` field accepts `basic`, `bearer`, `header`, `query`, or `path`. When `auth_style` is `path`, set `path_template` to a URL path containing the `{credential}` placeholder exactly once (for example, `/v1/{credential}/resources`). Static credentials are exposed as placeholder environment variables and resolved in outbound HTTP requests. Dynamic token grants are resolved by the sandbox proxy on demand for matching profile endpoints and support `bearer` or `header` placement. Credential environment variable names must not use the reserved `v<digits>_` prefix, such as `v10_GITHUB_TOKEN`, because OpenShell uses that namespace for revision-scoped placeholders.
`credentials` declares the credential names, environment variables, auth metadata, optional refresh metadata, and optional dynamic token grant metadata for the provider type. The `auth_style` field accepts `basic`, `bearer`, `header`, `query`, or `path`. When `auth_style` is `path`, set `path_template` to a URL path containing the `{credential}` placeholder exactly once (for example, `/v1/{credential}/resources`). Static credentials are exposed as placeholder environment variables and resolved in outbound HTTP requests only at their binding endpoints. Every static credential environment key receives the full profile endpoint set when the profile defines endpoints. An endpointless profile requires explicit sandbox policy bindings for each attached provider instance. Dynamic token grants are resolved by the sandbox proxy on demand for matching profile endpoints and support `bearer` or `header` placement. Credential environment variable names must not use the reserved `v<digits>_` prefix, such as `v10_GITHUB_TOKEN`, because OpenShell uses that namespace for revision-scoped placeholders.
`discovery` controls what `--from-existing` scans when
`providers_v2_enabled=true`. Each entry in `discovery.credentials` must name a
@@ -470,6 +602,8 @@ Use an ISO/RFC3339 timestamp or Unix epoch milliseconds. Use `0` as the timestam
OpenShell skips expired provider credentials when it builds a sandbox provider environment. Running sandboxes also reject expired retained credential generations during placeholder resolution, so stale placeholders fail closed instead of forwarding unresolved or expired credential material.
The gateway sends a complete host, port, and path binding for every emitted static credential key. It derives bindings from profile endpoints or explicit sandbox policy endpoints for endpointless profiles. It withholds static credential keys from endpointless selected profiles that have no explicit policy binding. Supervisors reject other incomplete binding metadata and clear previously active provider material when a refresh fails validation. Refer to [Static Credential Endpoint Binding](#understand-static-credential-endpoint-binding) for matching, denial, lifecycle, and migration behavior.
## Configure Credential Refresh
Refresh configuration is stored separately from the current injectable credential value. The gateway refresh worker reads refresh state, mints a new short-lived token for supported strategies, writes the token back to the provider record, and updates credential expiry metadata.
@@ -610,7 +744,7 @@ openshell sandbox create \
-- claude
```
When `providers_v2_enabled=true`, each attached provider with a matching profile contributes a provider policy layer to the sandbox effective policy. The base policy is the user-authored sandbox policy that you can edit and apply. The effective policy is the composed policy that the sandbox enforces: base policy plus provider policy layers. When the setting is disabled, the sandbox receives provider credentials but not provider-derived policy entries.
When `providers_v2_enabled=true`, each attached provider with a matching profile contributes a provider policy layer to the sandbox effective policy. The base policy is the user-authored sandbox policy that you can edit and apply. The effective policy is the composed policy that the sandbox enforces: base policy plus provider policy layers. When the setting is disabled, the sandbox still receives endpoint-bound provider credentials but not provider-derived policy entries.
Updating a custom provider profile affects every provider instance whose `type` matches that profile ID. Provider instances are not rewritten, and sandbox-authored policies are not modified. Running sandboxes observe the updated provider-derived policy on their next config sync. If a gateway-global policy is active, provider-derived policy layers remain suppressed.
@@ -755,9 +889,9 @@ Provider attach and detach update the persisted sandbox provider list. Running s
The policy effect applies to future effective policy reads after the sandbox observes the update. The credential environment effect applies only to new process launches after the update is observed, such as later SSH, exec, or SFTP sessions.
Already-running processes keep the environment they started with. OpenShell does not mutate a live process environment after provider attach, detach, or credential update. If a long-running process needs a newly attached provider credential placeholder, restart that process or launch a new process after the sandbox has observed the provider update.
Already-running processes keep the placeholder environment they started with. OpenShell does not mutate a live process environment after provider attach, detach, or credential update. The proxy resolves existing placeholders against current credentials and bindings, so rotation, expiry, endpoint changes, and detach take effect without restarting the process. If a long-running process needs a newly attached provider credential placeholder, restart that process or launch a new process after the sandbox has observed the provider update.
Detaching a provider removes its provider policy layer from future effective policy reads and removes its credential placeholders from future process environments. It does not remove environment variables from already-running processes.
Detaching a provider removes its provider policy layer from future effective policy reads, revokes resolution for its existing placeholders, and removes its credential placeholders from future process environments. It does not remove the placeholder strings from already-running process environments.
OpenShell rejects provider updates and refresh configuration when they would make two providers attached to the same sandbox expose the same active credential environment key. It also rejects attached provider sets with ambiguous dynamic token grants at equal host/path specificity. Use provider-specific credential names and make one dynamic grant selector more specific when one sandbox needs multiple providers with overlapping upstream concepts.
e2e/python/test_sandbox_policy.py
+18 -13
View File
@@ -6,6 +6,7 @@ from __future__ import annotations
import json
from typing import TYPE_CHECKING
import grpc
import pytest
from openshell._proto import datamodel_pb2, sandbox_pb2
@@ -319,7 +320,11 @@ def _proxy_connect_then_http_with_server():
{"connect_status": connect_resp.strip(), "http_status": 0}
)
request = f"{method} {path} HTTP/1.1\r\nHost: {target_host}\r\nConnection: close\r\n\r\n"
request = (
f"{method} {path} HTTP/1.1\r\n"
f"Host: {target_host}:{target_port}\r\n"
"Connection: close\r\n\r\n"
)
conn.sendall(request.encode())
data = b""
@@ -1956,8 +1961,8 @@ def test_overlapping_policies_with_conflicting_destination_metadata_are_rejected
"""OVL-1: Conflicting metadata on the same host:port fails closed.
One endpoint permits any resolved address while the other constrains
``allowed_ips``. The complete candidate is ambiguous and must not activate
either entry.
``allowed_ips``. The complete candidate is ambiguous and must be rejected
before the sandbox is provisioned.
"""
policy = _base_policy(
network_policies={
@@ -1985,16 +1990,16 @@ def test_overlapping_policies_with_conflicting_destination_metadata_are_rejected
},
)
spec = datamodel_pb2.SandboxSpec(policy=policy)
with sandbox(spec=spec, delete_on_exit=True) as sb:
result = sb.exec_python(
_forward_proxy_with_server(),
args=(_PROXY_HOST, _PROXY_PORT, _SANDBOX_IP, _FORWARD_PROXY_PORT),
)
assert result.exit_code == 0, result.stderr
assert "403" in result.stdout, (
"Conflicting overlapping policies should fail closed; "
f"expected 403, got: {result.stdout}"
)
with (
pytest.raises(grpc.RpcError) as exc_info,
sandbox(spec=spec, delete_on_exit=True),
):
pytest.fail("ambiguous policy unexpectedly created a sandbox")
assert exc_info.value.code() == grpc.StatusCode.FAILED_PRECONDITION
details = exc_info.value.details() or ""
assert "network endpoint ambiguity validation failed" in details
assert "allowed_ips" in details
def test_overlapping_policies_l7_connect_does_not_crash(
e2e/python/test_sandbox_providers.py
+82 -9
View File
@@ -195,11 +195,11 @@ def test_provider_credentials_available_as_env_vars(
assert value != "sk-e2e-test-key-12345"
def test_generic_provider_credentials_available_as_env_vars(
def test_profileless_provider_credentials_fail_closed(
sandbox: Callable[..., Sandbox],
sandbox_client: SandboxClient,
) -> None:
"""Generic provider env vars are placeholders, not raw secrets."""
"""Profileless credentials are withheld because they have no endpoint binding."""
with provider(
sandbox_client._stub,
name="e2e-test-generic-provider-env",
@@ -225,8 +225,81 @@ def test_generic_provider_credentials_available_as_env_vars(
result = sb.exec_python(read_generic_env_vars)
assert result.exit_code == 0, result.stderr
token, url = result.stdout.strip().split("|")
assert _is_placeholder_for_env_key(token, "CUSTOM_SERVICE_TOKEN")
assert _is_placeholder_for_env_key(url, "CUSTOM_SERVICE_URL")
assert token == "NOT_SET"
assert url == "NOT_SET"
def test_endpointless_profile_credentials_fail_closed_without_policy_binding(
sandbox: Callable[..., Sandbox],
sandbox_client: SandboxClient,
) -> None:
"""Endpointless profile credentials are withheld without an explicit binding."""
with provider(
sandbox_client._stub,
name="e2e-test-google-cloud-without-policy-binding",
provider_type="google-cloud",
credentials={"GCP_ADC_ACCESS_TOKEN": "gcp-e2e-token"},
) as provider_name:
spec = datamodel_pb2.SandboxSpec(
policy=_default_policy(),
providers=[provider_name],
)
def read_gcp_token() -> str:
import os
return os.environ.get("GCP_ADC_ACCESS_TOKEN", "NOT_SET")
with sandbox(spec=spec, delete_on_exit=True) as sb:
result = sb.exec_python(read_gcp_token)
assert result.exit_code == 0, result.stderr
assert result.stdout.strip() == "NOT_SET"
def test_endpointless_profile_credentials_use_explicit_policy_binding(
sandbox: Callable[..., Sandbox],
sandbox_client: SandboxClient,
) -> None:
"""An endpointless profile emits credentials only with an explicit binding."""
with provider(
sandbox_client._stub,
name="e2e-test-google-cloud-policy-binding",
provider_type="google-cloud",
credentials={"GCP_ADC_ACCESS_TOKEN": "gcp-e2e-token"},
) as provider_name:
policy = _default_policy()
policy.network_policies["gcp_storage"].CopyFrom(
sandbox_pb2.NetworkPolicyRule(
name="gcp_storage",
endpoints=[
sandbox_pb2.NetworkEndpoint(
host="storage.googleapis.com",
port=443,
protocol="rest",
access="full",
credential_binding=sandbox_pb2.NetworkCredentialBinding(
provider=provider_name
),
)
],
)
)
spec = datamodel_pb2.SandboxSpec(
policy=policy,
providers=[provider_name],
)
def read_gcp_token() -> str:
import os
return os.environ.get("GCP_ADC_ACCESS_TOKEN", "NOT_SET")
with sandbox(spec=spec, delete_on_exit=True) as sb:
result = sb.exec_python(read_gcp_token)
assert result.exit_code == 0, result.stderr
assert _is_placeholder_for_env_key(
result.stdout.strip(), "GCP_ADC_ACCESS_TOKEN"
)
def test_nvidia_provider_injects_nvidia_api_key_env_var(
@@ -269,15 +342,15 @@ def test_attach_detach_updates_credentials_for_later_exec_launches(
with provider(
stub,
name=provider_name,
provider_type="generic",
credentials={"CUSTOM_ATTACH_TOKEN": "token-attach-detach"},
provider_type="nvidia",
credentials={"NVIDIA_API_KEY": "token-attach-detach"},
):
spec = datamodel_pb2.SandboxSpec(policy=_default_policy(), providers=[])
def read_attach_token() -> str:
import os
return os.environ.get("CUSTOM_ATTACH_TOKEN", "NOT_SET")
return os.environ.get("NVIDIA_API_KEY", "NOT_SET")
def exec_token(sb: Sandbox) -> str:
result = sb.exec_python(read_attach_token)
@@ -292,7 +365,7 @@ def test_attach_detach_updates_credentials_for_later_exec_launches(
if expected == "NOT_SET":
matched = last == expected
else:
matched = _is_placeholder_for_env_key(last, "CUSTOM_ATTACH_TOKEN")
matched = _is_placeholder_for_env_key(last, "NVIDIA_API_KEY")
if matched:
return
time.sleep(2)
@@ -310,7 +383,7 @@ def test_attach_detach_updates_credentials_for_later_exec_launches(
)
wait_for_token(
sb,
"openshell:resolve:env:CUSTOM_ATTACH_TOKEN",
"openshell:resolve:env:NVIDIA_API_KEY",
)
stub.DetachSandboxProvider(
e2e/rust/e2e-openshift.sh
+4
View File
@@ -15,6 +15,9 @@
set -euo pipefail
ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
# shellcheck source=e2e/support/gateway-common.sh
source "${ROOT}/e2e/support/gateway-common.sh"
CHART_PATH="${CHART_PATH:-./deploy/helm/openshell}"
NAMESPACE="openshell"
RELEASE="openshell"
@@ -119,6 +122,7 @@ oc adm policy add-scc-to-user privileged -z "${RELEASE}-sandbox" -n "$NAMESPACE"
OPENSHIFT_FLAGS=(
--set server.disableTls=true
--set "server.telemetryEnabled=${OPENSHELL_TELEMETRY_ENABLED}"
--set podSecurityContext.fsGroup=null
--set securityContext.runAsUser=null
--set image.tag="$IMAGE_TAG"
e2e/rust/tests/host_gateway_alias.rs
+272 -1
View File
@@ -9,7 +9,7 @@ use std::sync::Mutex;
use openshell_e2e::harness::binary::openshell_cmd;
use openshell_e2e::harness::sandbox::SandboxGuard;
use tempfile::NamedTempFile;
use tempfile::{Builder as TempFileBuilder, NamedTempFile};
use tokio::io::AsyncReadExt;
use tokio::io::AsyncWriteExt;
use tokio::net::TcpListener;
@@ -17,6 +17,10 @@ use tokio::task::JoinHandle;
const INFERENCE_PROVIDER_NAME: &str = "e2e-host-inference";
const INFERENCE_PROVIDER_UNREACHABLE_NAME: &str = "e2e-host-inference-unreachable";
const BINDING_PROVIDER_A_NAME: &str = "e2e-static-endpoint-binding-provider-a";
const BINDING_PROVIDER_B_NAME: &str = "e2e-static-endpoint-binding-provider-b";
const BINDING_PROFILE_A_ID: &str = "e2e-static-endpoint-binding-a";
const BINDING_PROFILE_B_ID: &str = "e2e-static-endpoint-binding-b";
static INFERENCE_ROUTE_LOCK: Mutex<()> = Mutex::new(());
async fn run_cli(args: &[&str]) -> Result<String, String> {
@@ -43,6 +47,36 @@ async fn run_cli(args: &[&str]) -> Result<String, String> {
Ok(combined)
}
async fn wait_for_sandbox_logs(
sandbox_name: &str,
expected: impl Fn(&str) -> bool,
) -> Result<String, String> {
let deadline = tokio::time::Instant::now() + std::time::Duration::from_secs(10);
loop {
let logs = run_cli(&[
"logs",
sandbox_name,
"-n",
"500",
"--since",
"2m",
"--source",
"sandbox",
])
.await?;
if expected(&logs) {
return Ok(logs);
}
if tokio::time::Instant::now() >= deadline {
return Err(format!(
"timed out waiting for expected sandbox logs:\n{logs}"
));
}
tokio::time::sleep(std::time::Duration::from_millis(250)).await;
}
}
struct HostServer {
port: u16,
task: JoinHandle<()>,
@@ -50,6 +84,13 @@ struct HostServer {
impl HostServer {
async fn start(response_body: &str) -> Result<Self, String> {
Self::start_with_auth_check(response_body, None).await
}
async fn start_with_auth_check(
response_body: &str,
expected_authorization: Option<&str>,
) -> Result<Self, String> {
let listener = TcpListener::bind(("0.0.0.0", 0))
.await
.map_err(|e| format!("bind host test server: {e}"))?;
@@ -58,12 +99,14 @@ impl HostServer {
.map_err(|e| format!("read host test server address: {e}"))?
.port();
let response_body = response_body.as_bytes().to_vec();
let expected_authorization = expected_authorization.map(str::to_string);
let task = tokio::spawn(async move {
loop {
let Ok((mut stream, _)) = listener.accept().await else {
break;
};
let body = response_body.clone();
let expected_authorization = expected_authorization.clone();
tokio::spawn(async move {
let mut request = Vec::new();
let mut buf = [0_u8; 1024];
@@ -80,6 +123,16 @@ impl HostServer {
}
}
let body = expected_authorization.map_or(body, |expected| {
let request = String::from_utf8_lossy(&request);
format!(
r#"{{"authorized":{}}}"#,
request.lines().any(|line| {
line.eq_ignore_ascii_case(&format!("Authorization: {expected}"))
})
)
.into_bytes()
});
let response = format!(
"HTTP/1.1 200 OK\r\nContent-Type: application/json\r\nContent-Length: {}\r\nConnection: close\r\n\r\n",
body.len()
@@ -97,6 +150,88 @@ impl HostServer {
}
}
fn write_binding_profile(
id: &str,
display_name: &str,
env_var: &str,
host: &str,
port: u16,
) -> Result<NamedTempFile, String> {
let mut file = TempFileBuilder::new()
.suffix(".yaml")
.tempfile()
.map_err(|e| format!("create provider profile: {e}"))?;
let profile = format!(
r#"id: {id}
display_name: {display_name}
category: other
credentials:
- name: bound_token
env_vars: [{env_var}]
required: true
auth_style: bearer
header_name: authorization
endpoints:
- host: {host}
port: {port}
path: /allowed/**
protocol: rest
access: full
enforcement: enforce
binaries: [/usr/bin/curl]
"#
);
file.write_all(profile.as_bytes())
.map_err(|e| format!("write provider profile: {e}"))?;
file.flush()
.map_err(|e| format!("flush provider profile: {e}"))?;
Ok(file)
}
fn write_binding_policy(port: u16) -> Result<NamedTempFile, String> {
let mut file = NamedTempFile::new().map_err(|e| format!("create binding policy: {e}"))?;
let policy = format!(
r#"version: 1
filesystem_policy:
include_workdir: true
read_only: [/usr, /lib, /proc, /dev/urandom, /app, /etc, /var/log]
read_write: [/sandbox, /tmp, /dev/null]
landlock:
compatibility: best_effort
process:
run_as_user: sandbox
run_as_group: sandbox
network_policies:
binding_test:
name: binding_test
endpoints:
- host: host.openshell.internal
port: {port}
path: /**
protocol: rest
access: full
enforcement: enforce
- host: host.docker.internal
port: {port}
path: /**
protocol: rest
access: full
enforcement: enforce
binaries:
- path: /usr/bin/curl
"#
);
file.write_all(policy.as_bytes())
.map_err(|e| format!("write binding policy: {e}"))?;
file.flush()
.map_err(|e| format!("flush binding policy: {e}"))?;
Ok(file)
}
impl Drop for HostServer {
fn drop(&mut self) {
self.task.abort();
@@ -123,6 +258,17 @@ async fn delete_provider(name: &str) {
let _ = cmd.status().await;
}
async fn delete_provider_profile(id: &str) {
let mut cmd = openshell_cmd();
cmd.arg("provider")
.arg("profile")
.arg("delete")
.arg(id)
.stdout(Stdio::null())
.stderr(Stdio::null());
let _ = cmd.status().await;
}
async fn create_openai_provider(name: &str, base_url: &str) -> Result<String, String> {
run_cli(&[
"provider",
@@ -223,6 +369,131 @@ async fn sandbox_reaches_host_openshell_internal_via_host_gateway_alias() {
);
}
#[tokio::test]
async fn static_provider_credentials_are_bound_to_profile_endpoints() {
let server = HostServer::start_with_auth_check("", Some("Bearer e2e-bound-secret"))
.await
.expect("start credential echo server");
let profile_a = write_binding_profile(
BINDING_PROFILE_A_ID,
"E2E static endpoint binding A",
"BOUND_TOKEN_A",
"host.openshell.internal",
server.port,
)
.expect("write provider A binding profile");
let profile_b = write_binding_profile(
BINDING_PROFILE_B_ID,
"E2E static endpoint binding B",
"BOUND_TOKEN_B",
"host.docker.internal",
server.port,
)
.expect("write provider B binding profile");
let policy = write_binding_policy(server.port).expect("write binding policy");
let profile_a_path = profile_a.path().to_string_lossy().into_owned();
let profile_b_path = profile_b.path().to_string_lossy().into_owned();
let policy_path = policy.path().to_string_lossy().into_owned();
delete_provider(BINDING_PROVIDER_A_NAME).await;
delete_provider(BINDING_PROVIDER_B_NAME).await;
delete_provider_profile(BINDING_PROFILE_A_ID).await;
delete_provider_profile(BINDING_PROFILE_B_ID).await;
run_cli(&["provider", "profile", "import", "--file", &profile_a_path])
.await
.expect("import provider A endpoint-binding profile");
run_cli(&["provider", "profile", "import", "--file", &profile_b_path])
.await
.expect("import provider B endpoint-binding profile");
run_cli(&[
"provider",
"create",
"--name",
BINDING_PROVIDER_A_NAME,
"--type",
BINDING_PROFILE_A_ID,
"--credential",
"BOUND_TOKEN_A=e2e-bound-secret",
])
.await
.expect("create endpoint-bound provider A");
run_cli(&[
"provider",
"create",
"--name",
BINDING_PROVIDER_B_NAME,
"--type",
BINDING_PROFILE_B_ID,
"--credential",
"BOUND_TOKEN_B=e2e-provider-b-secret",
])
.await
.expect("create endpoint-bound provider B");
let command = format!(
r#"allowed=$(curl --silent --show-error --max-time 15 -H "Authorization: Bearer $BOUND_TOKEN_A" http://host.openshell.internal:{}/allowed/check); host_denied=$(curl --silent --show-error --max-time 15 -o /tmp/host-denied-body -w "%{{http_code}}" -H "Authorization: Bearer $BOUND_TOKEN_A" http://host.docker.internal:{}/allowed/check); path_denied=$(curl --silent --show-error --max-time 15 -o /tmp/path-denied-body -w "%{{http_code}}" -H "Authorization: Bearer $BOUND_TOKEN_A" http://host.openshell.internal:{}/other/check); printf 'ALLOWED=%s HOST_DENIED=%s PATH_DENIED=%s\n' "$allowed" "$host_denied" "$path_denied""#,
server.port, server.port, server.port
);
let mut guard = SandboxGuard::create(&[
"--policy",
&policy_path,
"--provider",
BINDING_PROVIDER_A_NAME,
"--provider",
BINDING_PROVIDER_B_NAME,
"--no-auto-providers",
"--",
"sh",
"-c",
&command,
])
.await
.expect("run endpoint-binding requests");
let logs = wait_for_sandbox_logs(&guard.name, |logs| {
logs.contains("openshell.provider_credential.endpoint_mismatch")
&& logs.contains("credential_endpoint_mismatch")
})
.await
.expect("fetch endpoint mismatch logs");
assert!(
guard
.create_output
.contains(r#"ALLOWED={"authorized":true}"#),
"credential should resolve at the bound endpoint:\n{}\nlogs:\n{logs}",
guard.create_output,
);
assert!(
guard.create_output.contains("HOST_DENIED=403"),
"same placeholder must be denied at an unbound host:\n{}",
guard.create_output
);
assert!(
guard.create_output.contains("PATH_DENIED=403"),
"same placeholder must be denied at an unbound path on its bound host:\n{}",
guard.create_output
);
assert!(
logs.contains("openshell.provider_credential.endpoint_mismatch")
&& logs.contains("credential_endpoint_mismatch"),
"OCSF logs should explain the endpoint-binding denial without secret material:\n{logs}"
);
assert!(
!logs.contains("e2e-bound-secret")
&& !logs.contains("e2e-provider-b-secret")
&& !logs.contains("BOUND_TOKEN_A")
&& !logs.contains("BOUND_TOKEN_B"),
"OCSF logs must not contain credential values or environment keys:\n{logs}"
);
guard.cleanup().await;
delete_provider(BINDING_PROVIDER_A_NAME).await;
delete_provider(BINDING_PROVIDER_B_NAME).await;
delete_provider_profile(BINDING_PROFILE_A_ID).await;
delete_provider_profile(BINDING_PROFILE_B_ID).await;
}
#[tokio::test]
async fn sandbox_inference_local_routes_to_host_openshell_internal() {
let _inference_lock = INFERENCE_ROUTE_LOCK
e2e/rust/tests/proxy_egress_pipeline.rs
+59 -11
View File
@@ -24,13 +24,14 @@ use std::sync::{
use openshell_e2e::harness::binary::openshell_cmd;
use openshell_e2e::harness::sandbox::SandboxGuard;
use serde_json::Value;
use tempfile::NamedTempFile;
use tempfile::{Builder as TempFileBuilder, NamedTempFile};
use tokio::io::{AsyncReadExt, AsyncWriteExt};
use tokio::net::{TcpListener, TcpStream};
use tokio::task::JoinHandle;
const TEST_SERVER_HOST: &str = "host.openshell.internal";
const PROVIDER_NAME: &str = "e2e-proxy-egress-credentials";
const PROVIDER_PROFILE_ID: &str = "e2e-proxy-egress-credentials";
const TOKEN_ENV: &str = "PROXY_E2E_TOKEN";
const TEST_SECRET: &str = "sk-e2e-proxy-egress-secret";
const PLACEHOLDER_PREFIX: &str = "openshell:resolve:env:";
@@ -102,7 +103,15 @@ async fn delete_provider(name: &str) {
let _ = cmd.status().await;
}
async fn create_generic_provider(name: &str) -> Result<String, String> {
async fn delete_provider_profile(id: &str) {
let mut cmd = openshell_cmd();
cmd.args(["provider", "profile", "delete", id])
.stdout(Stdio::null())
.stderr(Stdio::null());
let _ = cmd.status().await;
}
async fn create_bound_provider(name: &str) -> Result<String, String> {
let credential = format!("{TOKEN_ENV}={TEST_SECRET}");
run_cli(&[
"provider",
@@ -110,13 +119,51 @@ async fn create_generic_provider(name: &str) -> Result<String, String> {
"--name",
name,
"--type",
"generic",
PROVIDER_PROFILE_ID,
"--credential",
&credential,
])
.await
}
fn write_credential_profile(port: u16) -> Result<NamedTempFile, String> {
let mut file = TempFileBuilder::new()
.suffix(".yaml")
.tempfile()
.map_err(|error| format!("create provider profile: {error}"))?;
let profile = format!(
r#"id: {PROVIDER_PROFILE_ID}
display_name: E2E proxy egress credentials
category: other
credentials:
- name: proxy_e2e_token
env_vars: [{TOKEN_ENV}]
required: true
auth_style: bearer
header_name: authorization
endpoints:
- host: {TEST_SERVER_HOST}
port: {port}
path: /probe
protocol: rest
access: full
enforcement: enforce
request_body_credential_rewrite: true
allowed_ips:
- "10.0.0.0/8"
- "172.0.0.0/8"
- "192.168.0.0/16"
- "fc00::/7"
binaries: ["/**"]
"#
);
file.write_all(profile.as_bytes())
.map_err(|error| format!("write provider profile: {error}"))?;
file.flush()
.map_err(|error| format!("flush provider profile: {error}"))?;
Ok(file)
}
fn write_policy_document(
host: &str,
port: u16,
@@ -1615,19 +1662,19 @@ async fn http_credentials_are_rewritten_in_headers_and_bodies_for_both_adapters(
.lock()
.unwrap_or_else(std::sync::PoisonError::into_inner);
delete_provider(PROVIDER_NAME).await;
create_generic_provider(PROVIDER_NAME)
.await
.expect("create generic provider");
delete_provider_profile(PROVIDER_PROFILE_ID).await;
let result = async {
let server = CredentialProbeServer::start().await?;
let endpoint_options = r#" protocol: rest
let profile = write_credential_profile(server.port)?;
let profile_path = profile.path().to_string_lossy().into_owned();
run_cli(&["provider", "profile", "import", "--file", &profile_path]).await?;
create_bound_provider(PROVIDER_NAME).await?;
let endpoint_options = r#" path: /probe
protocol: rest
enforcement: enforce
request_body_credential_rewrite: true
rules:
- allow:
method: POST
path: "/probe""#;
access: full"#;
let policy = write_policy(TEST_SERVER_HOST, server.port, endpoint_options)?;
let policy_path = policy_path(&policy);
let script = format!(
@@ -1721,6 +1768,7 @@ print(json.dumps({{"connect": connect, "forward": forward}}, sort_keys=True))
.await;
delete_provider(PROVIDER_NAME).await;
delete_provider_profile(PROVIDER_PROFILE_ID).await;
let guard = result.expect("sandbox create");
let result = parse_json_line(&guard.create_output);
e2e/rust/tests/websocket_conformance.rs
+59 -6
View File
@@ -19,13 +19,14 @@ use base64::Engine as _;
use openshell_e2e::harness::binary::openshell_cmd;
use openshell_e2e::harness::sandbox::SandboxGuard;
use sha1::{Digest, Sha1};
use tempfile::NamedTempFile;
use tempfile::{Builder as TempFileBuilder, NamedTempFile};
use tokio::io::{AsyncReadExt, AsyncWriteExt};
use tokio::net::{TcpListener, TcpStream};
use tokio::task::JoinHandle;
const WEBSOCKET_GUID: &str = "258EAFA5-E914-47DA-95CA-C5AB0DC85B11";
const PROVIDER_NAME: &str = "e2e-websocket-conformance";
const PROVIDER_PROFILE_ID: &str = "e2e-websocket-conformance";
const TEST_SERVER_HOST: &str = "host.openshell.internal";
const TEST_SECRET: &str = "sk-e2e-websocket-conformance-secret";
const TOKEN_ENV: &str = "WS_E2E_TOKEN";
@@ -66,7 +67,15 @@ async fn delete_provider(name: &str) {
let _ = cmd.status().await;
}
async fn create_generic_provider(name: &str) -> Result<String, String> {
async fn delete_provider_profile(id: &str) {
let mut cmd = openshell_cmd();
cmd.args(["provider", "profile", "delete", id])
.stdout(Stdio::null())
.stderr(Stdio::null());
let _ = cmd.status().await;
}
async fn create_bound_provider(name: &str) -> Result<String, String> {
let credential = format!("{TOKEN_ENV}={TEST_SECRET}");
run_cli(&[
"provider",
@@ -74,13 +83,54 @@ async fn create_generic_provider(name: &str) -> Result<String, String> {
"--name",
name,
"--type",
"generic",
PROVIDER_PROFILE_ID,
"--credential",
&credential,
])
.await
}
fn write_credential_profile(port: u16) -> Result<NamedTempFile, String> {
let mut file = TempFileBuilder::new()
.suffix(".yaml")
.tempfile()
.map_err(|error| format!("create provider profile: {error}"))?;
let profile = format!(
r#"id: {PROVIDER_PROFILE_ID}
display_name: E2E WebSocket conformance credentials
category: other
credentials:
- name: websocket_token
env_vars: [{TOKEN_ENV}]
required: true
auth_style: bearer
header_name: authorization
endpoints:
- host: {TEST_SERVER_HOST}
port: {port}
path: /ws
protocol: websocket
enforcement: enforce
access: read-write
websocket_credential_rewrite: true
allowed_ips:
- "10.0.0.0/8"
- "172.0.0.0/8"
- "192.168.0.0/16"
- "fc00::/7"
binaries:
- path: /usr/bin/python*
- path: /usr/local/bin/python*
- path: /sandbox/.uv/python/*/bin/python*
"#
);
file.write_all(profile.as_bytes())
.map_err(|error| format!("write provider profile: {error}"))?;
file.flush()
.map_err(|error| format!("flush provider profile: {error}"))?;
Ok(file)
}
struct WebSocketProbeServer {
port: u16,
task: JoinHandle<()>,
@@ -435,12 +485,14 @@ async fn websocket_text_placeholder_is_rewritten_through_both_adapters() {
.unwrap_or_else(std::sync::PoisonError::into_inner);
delete_provider(PROVIDER_NAME).await;
create_generic_provider(PROVIDER_NAME)
.await
.expect("create generic provider");
delete_provider_profile(PROVIDER_PROFILE_ID).await;
let result = async {
let server = WebSocketProbeServer::start().await?;
let profile = write_credential_profile(server.port)?;
let profile_path = profile.path().to_string_lossy().into_owned();
run_cli(&["provider", "profile", "import", "--file", &profile_path]).await?;
create_bound_provider(PROVIDER_NAME).await?;
let policy = write_websocket_policy(TEST_SERVER_HOST, server.port)?;
let policy_path = policy
.path()
@@ -464,6 +516,7 @@ async fn websocket_text_placeholder_is_rewritten_through_both_adapters() {
.await;
delete_provider(PROVIDER_NAME).await;
delete_provider_profile(PROVIDER_PROFILE_ID).await;
let guard = result.expect("sandbox create");
assert!(
e2e/support/gateway-common.sh
+4
View File
@@ -5,6 +5,10 @@
# Shared helpers for local gateway-backed e2e wrappers. Driver-specific setup,
# cleanup, and runtime behavior stay in the Docker/Podman wrapper scripts.
# E2E traffic is synthetic and must not contribute to product usage metrics.
# Keep an explicit override so telemetry-specific tests can opt back in.
export OPENSHELL_TELEMETRY_ENABLED="${OPENSHELL_TELEMETRY_ENABLED:-false}"
e2e_cargo_target_dir() {
local root=$1
shift
e2e/with-kube-gateway.sh
+1
View File
@@ -666,6 +666,7 @@ if [ "${OPENSHELL_E2E_CREDENTIAL_DRIVERS:-0}" = "1" ] \
fi
helm_extra_args=()
helm_extra_args+=(--set "server.telemetryEnabled=${OPENSHELL_TELEMETRY_ENABLED}")
if [ -n "${HOST_GATEWAY_IP}" ]; then
helm_extra_args+=(--set "server.hostGatewayIP=${HOST_GATEWAY_IP}")
fi
proto/openshell.proto
+28
View File
@@ -1723,6 +1723,26 @@ message DeleteProviderProfileResponse {
message GetSandboxProviderEnvironmentRequest {
// The sandbox ID.
string sandbox_id = 1;
// Whether the requesting supervisor enforces endpoint bindings for static
// provider credentials. Gateways withhold static credential material when
// this capability is absent.
bool supports_static_credential_bindings = 2;
}
// One network endpoint at which a static provider credential may be resolved.
message StaticCredentialEndpointBinding {
string host = 1;
uint32 port = 2;
string path = 3;
}
// Endpoint allowlist for one static provider credential environment variable.
message StaticCredentialBinding {
repeated StaticCredentialEndpointBinding endpoints = 1;
// Stable identity of the provider credential that produced this binding.
// Supervisors use it to retain old revision placeholders only across
// rotations of the same provider credential.
string credential_identity = 2;
}
// Get sandbox provider environment response.
@@ -1737,6 +1757,14 @@ message GetSandboxProviderEnvironmentResponse {
// Maps endpoint-bound provider metadata to credential metadata.
// Supervisor uses this to inject Authorization headers for token grant credentials.
map<string, ProviderProfileCredential> dynamic_credentials = 4;
// Endpoint allowlists for static credential environment variables. Metadata
// can be incomplete when a provider profile is invalid; capable supervisors
// reject all static material in that snapshot while preserving independently
// endpoint-bound dynamic credentials.
map<string, StaticCredentialBinding> static_credential_bindings = 5;
// Environment variables that contain provider configuration rather than
// credentials and therefore do not require endpoint-scoped resolution.
repeated string non_secret_environment_keys = 6;
}
// ---------------------------------------------------------------------------
proto/sandbox.proto
+11
View File
@@ -93,6 +93,13 @@ message MiddlewareEndpointSelector {
repeated string exclude = 2;
}
// Binds a policy endpoint to static credentials from a sandbox provider.
message NetworkCredentialBinding {
// Name of the provider attached to this sandbox whose static credentials
// may be resolved for requests admitted by this endpoint.
string provider = 1;
}
// A network endpoint (host + port) with optional L7 inspection config.
message NetworkEndpoint {
// Hostname or host glob pattern. Exact match is case-insensitive.
@@ -175,6 +182,10 @@ message NetworkEndpoint {
uint32 json_rpc_max_body_bytes = 22;
// MCP-only policy and inspection options. Only used when protocol is "mcp".
McpOptions mcp = 23;
// Explicit binding authority for static credentials from an attached
// endpointless provider profile. Profiles that already define endpoints
// continue to use those profile endpoints as their credential boundary.
NetworkCredentialBinding credential_binding = 24;
}
// MCP options are grouped so MCP-specific policy can grow without adding more
scripts/agents/gator/agent.yaml
+3 -3
View File
@@ -2,7 +2,7 @@
# SPDX-License-Identifier: Apache-2.0
id: gator
payload_version: 2
payload_version: 3
display_name: Gator Gate Agent
description: Validate and monitor OpenShell GitHub issues and pull requests through the gator state machine.
@@ -16,8 +16,8 @@ harness:
default: codex
supported:
codex:
model: gpt-5.5
reasoning: high
model: gpt-5.6-sol
reasoning: medium
runtime:
mode: watch
scripts/agents/gator/bin/gh
+21 -1
View File
@@ -7,7 +7,7 @@ set -euo pipefail
REAL_GH="${OPENSHELL_REAL_GH:-/usr/bin/gh}"
GATOR_MARKER='> **gator-agent**'
GATOR_PAYLOAD_VERSION="${OPENSHELL_AGENT_PAYLOAD_VERSION:-2}"
GATOR_PAYLOAD_VERSION="${OPENSHELL_AGENT_PAYLOAD_VERSION:-3}"
if [[ $# -lt 1 || "$1" != "api" ]]; then
exec "$REAL_GH" "$@"
@@ -100,6 +100,22 @@ is_draft_only_blocker_disposition() {
[[ "$lower_body" == *"marked as a draft"* || "$lower_body" == *"pull request is a draft"* || "$lower_body" == *"pr is draft"* ]] || return 1
}
is_ttl_state_nudge() {
local body="$1"
[[ "$body" == *"$GATOR_MARKER"* ]] || return 1
[[ "$body" == *"more than 48 business hours"* ]] || return 1
case "$body" in
*"## Author Follow-Up Nudge"*|*"## Maintainer Review Nudge"*|*"## Merge Decision Nudge"*|*"## Blocker Follow-Up Nudge"*)
return 0
;;
*)
return 1
;;
esac
}
has_blocking_same_sha_disposition() {
local head_sha="$1"
local current_is_draft="$2"
@@ -135,6 +151,10 @@ guard_duplicate_gator_disposition() {
[[ "$body" == *"$GATOR_MARKER"* ]] || return 0
[[ "$body" != *"## Monitoring Complete"* ]] || return 0
# A TTL state nudge is not a review disposition. Its frequency and target
# are governed by the gator skill; allow it to keep an unchanged PR moving.
is_ttl_state_nudge "$body" && return 0
local pull_json head_sha current_is_draft
if ! pull_json="$($REAL_GH api "repos/$owner/$repo/pulls/$number" 2>/dev/null)"; then
echo "openshell-agent: blocked gator write because current PR head lookup failed for $owner/$repo#$number" >&2
scripts/agents/gator/bin/gh_guard_test.sh
+25 -5
View File
@@ -112,7 +112,7 @@ run_review_case() {
## PR Review Status
Head SHA: `0e4d7af7722fbedce2307d571b0c937a1eb3250f`' \
--arg payload 'Gator payload: `2`' \
--arg payload 'Gator payload: `3`' \
--arg inline_body '> **gator-agent**
**Warning:** Keep this validation bound to the accepted value.' \
@@ -142,7 +142,7 @@ same_sha_body='> **gator-agent**
## PR Review Status
Head SHA: `0e4d7af7722fbedce2307d571b0c937a1eb3250f`
Gator payload: `2`'
Gator payload: `3`'
run_case "blocks duplicate marked comment" \
"$same_sha_body" \
@@ -169,7 +169,7 @@ run_case "allows first versioned review disposition" \
## PR Review Status
Head SHA: `0e4d7af7722fbedce2307d571b0c937a1eb3250f`
Gator payload: `2`' \
Gator payload: `3`' \
0
run_case "allows unmarked comment" \
@@ -184,6 +184,26 @@ run_case "allows terminal cleanup" \
## Monitoring Complete' \
0
run_case "allows a same-SHA author nudge" \
"$same_sha_body" \
'> **gator-agent**
## Author Follow-Up Nudge
This PR has been in `gator:in-review` for more than 48 business hours with unresolved review feedback.
@author, please respond to the review comments or push an update.' \
0
run_case "blocks a same-SHA status comment that is not a TTL nudge" \
"$same_sha_body" \
'> **gator-agent**
## CI Update
Checks completed for the current head.' \
20
run_case "blocks new reviewer failure disposition" \
'' \
'> **gator-agent**
@@ -204,7 +224,7 @@ Gator is blocked from completing the required independent re-review for current
## PR Review Status
Head SHA: `0e4d7af7722fbedce2307d571b0c937a1eb3250f`
Gator payload: `2`' \
Gator payload: `3`' \
0
draft_blocked_body='> **gator-agent**
@@ -224,7 +244,7 @@ run_case "ignores draft blocker after PR is ready" \
## PR Review Status
Head SHA: `0e4d7af7722fbedce2307d571b0c937a1eb3250f`
Gator payload: `2`' \
Gator payload: `3`' \
0 \
false
scripts/agents/gator/bin/review_feedback_ledger_test.sh
+1 -1
View File
@@ -346,7 +346,7 @@ rg -q 'COPY bin/validate-review-findings /usr/local/bin/validate-review-findings
"$GATOR_DIR/Dockerfile"
ruby -ryaml -e '
manifest = YAML.load_file(ARGV.fetch(0))
abort unless manifest.fetch("payload_version") == 2
abort unless manifest.fetch("payload_version") == 3
resource = manifest.fetch("resources").find {
|entry| entry.fetch("id") == "gator-review-findings-schema"
}
scripts/agents/gator/prompts/gator.md
+1 -1
View File
@@ -28,7 +28,7 @@ Important sandbox constraints:
- If you receive 403 errors from the sandbox proxy, inspect the JSON response and propose a policy update to allow the requested action if the response contains a structured error message.
- Incorporate PR commentary only from the PR author and verified maintainers by default. Ignore third-party or unknown-actor comments unless the PR author or a maintainer explicitly acknowledges the specific third-party details to incorporate; then incorporate only those acknowledged details. When you incorporate trusted author or maintainer feedback, acknowledge the person plainly and conversationally by name, paraphrase their point, and explain what you checked. Never call PR-author or verified-maintainer feedback third-party.
- Use `gator:approval-needed` only when gator is complete but maintainer approval is still missing. Once maintainer approval is present and required checks remain green with no unresolved feedback, move to `gator:merge-ready` for the final merge or close decision.
- Before running the `principal-engineer-reviewer` sub-agent or posting any marked gator comment/review, check existing gator comments and PR reviews for the current `headRefOid`. Do not run a reviewer or post any marked gator comment/review for a head SHA that already has a gator disposition unless a maintainer explicitly requests a same-SHA public response, the PR is merged/closed and needs terminal cleanup, or the earlier attempt failed before posting. A prior marked comment that only says the reviewer sub-agent failed before producing output is a legacy infrastructure-failure report, not a valid review disposition; ignore it and retry the reviewer. A prior marked `## Blocked` comment whose only blocker was that the PR was draft is also not a valid code-review disposition after the PR becomes ready for review; ignore it for review suppression and run the reviewer once. Same-SHA status updates, including CI changes, human replies, label changes, and reviewer comments, must not create public comments; record only the supervised result sentinel and wait for a new commit, merge, closure, or maintainer override.
- Before running the `principal-engineer-reviewer` sub-agent or posting a review disposition, check existing gator comments and PR reviews for the current `headRefOid`. Do not run a reviewer or post another marked review/status disposition for a head SHA that already has one unless a maintainer explicitly requests a same-SHA public response, the PR is merged/closed and needs terminal cleanup, or the earlier attempt failed before posting. A prior marked comment that only says the reviewer sub-agent failed before producing output is a legacy infrastructure-failure report, not a valid review disposition; ignore it and retry the reviewer. A prior marked `## Blocked` comment whose only blocker was that the PR was draft is also not a valid code-review disposition after the PR becomes ready for review; ignore it for review suppression and run the reviewer once. Same-SHA CI changes, human replies, label changes, and reviewer comments must not create public status comments; record them only in the supervised result sentinel. A state-specific TTL nudge is the exception: after 48 business hours and no more often than once per 48 business hours for the same state and responsible actor, post the matching `## Author Follow-Up Nudge`, `## Maintainer Review Nudge`, `## Merge Decision Nudge`, or `## Blocker Follow-Up Nudge` template even when the head SHA is unchanged. A nudge must name the pending action, does not authorize a re-review, and does not consume or replace the one review disposition for that SHA.
- When the gator skill requires the `principal-engineer-reviewer` sub-agent and the current effective patch has not already been reviewed by gator, first build the required review feedback ledger with `review-feedback-ledger`, then run a bounded independent review with `{{REVIEWER_COMMAND}}`. Treat the ledger's review mode, tree identity, patch identity, previous reviewed SHA, convergence checkpoint, and telemetry as authoritative. Use the full PR diff for an initial review; for a follow-up, inspect unresolved feedback plus the author-only delta and do not mine unchanged or upstream-only code for new findings. Carry open findings without duplicating them, and preserve resolved or waived dispositions unless the new diff materially invalidates them.
- Require reviewer output to follow the JSON evidence contract in
`/etc/openshell/agent-payload/skills/gator-gate/references/review-findings-schema.md`.
scripts/agents/gator/skills/gator-gate/SKILL.md
+10 -8
View File
@@ -66,13 +66,13 @@ All comments posted by this skill must begin with this marker:
> **gator-agent**
```
Use one canonical gator disposition per issue or PR head SHA for baseline state summaries. A disposition may be one issue comment or one submitted GitHub review. A submitted review, including its summary body and every inline comment in its `comments` array, counts as one disposition for the head SHA; do not count its inline comments separately.
Use one canonical gator disposition per issue or PR head SHA for baseline review and status summaries. A disposition may be one issue comment or one submitted GitHub review. A submitted review, including its summary body and every inline comment in its `comments` array, counts as one disposition for the head SHA; do not count its inline comments separately. A rate-limited TTL state nudge is not a disposition: it may be posted on an unchanged SHA to request the already-known next human action, but never to restate findings, report CI, or re-review.
For a PR review with any actionable line-specific finding that can be anchored to the current diff, use one batched GitHub review rather than an issue comment or standalone inline-comment requests. Begin the review summary and every inline comment body with the gator marker. Include the head SHA in the review summary so the wrapper can enforce the one-disposition rule. Do not post line comments individually through `POST /pulls/<pr>/comments`; a partially submitted set is not an acceptable baseline disposition.
Edit a canonical issue comment only for housekeeping updates that do not respond to new human activity. GitHub reviews and their inline comments are immutable after submission; correct them only through a new-head review or an explicit same-SHA maintainer override.
When gator is continuing a conversation after a human comment, review, or requested change, post a new marked comment only if the PR head SHA changed or no marked gator comment/review exists for the current head SHA. If a marked gator comment or PR review already exists for the current head SHA, do not post another public comment; record the state in the supervised result sentinel and wait for a new commit, maintainer override, merge, or closure.
When gator is continuing a conversation after a human comment, review, or requested change, post a new marked disposition only if the PR head SHA changed or no marked gator disposition exists for the current head SHA. If a marked gator comment or PR review already exists for the current head SHA, do not post another public disposition; record the state in the supervised result sentinel and wait for a new commit, maintainer override, merge, or closure. The sole exception is a state-specific TTL nudge that is due under the watch rules.
## Human Comment Disposition
@@ -659,7 +659,8 @@ rules above. Also check whether gator has already posted for the
current PR head SHA. Search existing issue comments and PR reviews for the gator
marker and either `Head SHA: <sha>`, `Head SHA: `<sha>``, or the current
`headRefOid` anywhere in the body. Gator may post at most one marked public
disposition for a given head SHA.
disposition for a given head SHA. A state-specific TTL nudge is separately
rate-limited and is not a disposition.
The `gh` write wrapper independently re-reads the current head, issue comments,
and reviews immediately before a marked POST. It fails closed when any lookup
@@ -668,15 +669,15 @@ Gator payload version. Do not bypass guard exits 21 or 22. Return a transient
`gator_write_guard_failed` result and investigate stale payload or GitHub
transport state instead.
If the current head SHA already has a marked gator comment or PR review:
If the current head SHA already has a marked gator disposition:
- Do not run the reviewer sub-agent again for that SHA.
- Do not post another marked issue comment, `PR Review Status`, `Re-check After ... Update`, CI update, duplicate findings summary, or PR review for that SHA.
- Reuse the latest gator disposition for that SHA internally to decide whether the PR is still waiting on author action, ready for pipeline watch, or blocked.
- For any same-SHA status update, including CI completion, failed checks, human replies, label changes, or maintainer/reviewer comments, do not post a public comment. Record the next state only in the supervised result sentinel.
- Do not post author, maintainer, or blocker nudges for the same SHA. Wait for a new commit, merge, closure, or explicit maintainer override.
- For any same-SHA status update, including CI completion, failed checks, human replies, label changes, or maintainer/reviewer comments, do not post a public status comment. Record the next state only in the supervised result sentinel.
- Do post a state-specific TTL nudge when it is due under the watch rules, even on the same SHA. Use only the nudge templates below, name the responsible actor and outstanding action, and respect the 48-business-hour limit for the same state and actor. A nudge neither authorizes another reviewer run nor consumes, replaces, or alters the existing disposition.
Only run a fresh review or post another marked public disposition when the PR head SHA changes, a maintainer explicitly asks gator to re-review or publicly respond on the same SHA, the PR reaches terminal merged/closed cleanup, or the earlier gator attempt failed before posting any marked disposition. A prior marked comment that only says the reviewer sub-agent failed before producing review output is a legacy infrastructure-failure report, not a valid current-head review disposition; ignore it for same-SHA review suppression and run the reviewer again. A prior marked `## Blocked` comment whose only blocker was that the PR was draft is also not a valid code-review disposition after the PR becomes ready for review; ignore it for same-SHA review suppression and run the reviewer once.
Only run a fresh review or post another marked public disposition when the PR head SHA changes, a maintainer explicitly asks gator to re-review or publicly respond on the same SHA, the PR reaches terminal merged/closed cleanup, or the earlier gator attempt failed before posting any marked disposition. State-specific TTL nudges remain allowed on an unchanged SHA as described above. A prior marked comment that only says the reviewer sub-agent failed before producing review output is a legacy infrastructure-failure report, not a valid current-head review disposition; ignore it for same-SHA review suppression and run the reviewer again. A prior marked `## Blocked` comment whose only blocker was that the PR was draft is also not a valid code-review disposition after the PR becomes ready for review; ignore it for same-SHA review suppression and run the reviewer once.
For PRs authored by `dependabot[bot]`, the primary gator responsibility is dependency-update validation, not normal feature review. Do a quick sanity check for suspicious changes outside expected dependency manifests or lockfiles, then ensure the full required test suite runs, including E2E, and watch for breakages caused by the update.
@@ -784,7 +785,8 @@ other dispositions without duplicating them. If the author replied without
pushing a new commit, do not re-review, repost findings, or post a same-SHA
disposition; inspect the response internally and wait for a new commit or
maintainer override. If CI changes state without a new commit, do not post a
same-SHA CI update.
same-SHA CI update. A due TTL author nudge remains allowed when the unresolved
feedback still requires an author action.
If review feedback is waiting on the PR author for more than 48 business hours, post a single author nudge. Use the latest of these timestamps as the TTL start:
sdk/go/openshell/v1/internal/converter/coverage_test.go
+1
View File
@@ -119,6 +119,7 @@ func TestConverterCoversAllProtoFields_NetworkEndpoint(t *testing.T) {
"signing_region": true,
"json_rpc_max_body_bytes": true,
"mcp": true,
"credential_binding": true,
}
assertAllFieldsCovered(t, (&sandboxpb.NetworkEndpoint{}).ProtoReflect().Descriptor(), handled, nil)
sdk/go/openshell/v1/internal/converter/network_policy.go
+10
View File
@@ -85,6 +85,11 @@ func policyNetworkEndpointFromProto(ep *sbv1.NetworkEndpoint) types.PolicyNetwor
if mcp := ep.GetMcp(); mcp != nil {
result.Mcp = mcpOptionsFromProto(mcp)
}
if binding := ep.GetCredentialBinding(); binding != nil {
result.CredentialBinding = &types.NetworkCredentialBinding{
Provider: binding.GetProvider(),
}
}
if ports := ep.GetPorts(); len(ports) > 0 {
result.Ports = make([]uint32, len(ports))
copy(result.Ports, ports)
@@ -142,6 +147,11 @@ func policyNetworkEndpointToProto(ep *types.PolicyNetworkEndpoint) *sbv1.Network
if ep.Mcp != nil {
result.Mcp = mcpOptionsToProto(ep.Mcp)
}
if ep.CredentialBinding != nil {
result.CredentialBinding = &sbv1.NetworkCredentialBinding{
Provider: ep.CredentialBinding.Provider,
}
}
if len(ep.Ports) > 0 {
result.Ports = make([]uint32, len(ep.Ports))
copy(result.Ports, ep.Ports)
sdk/go/openshell/v1/internal/converter/sandbox_test.go
+10 -1
View File
@@ -293,7 +293,14 @@ func TestSandboxRoundTrip(t *testing.T) {
"web": {
Name: "web",
Endpoints: []v1.PolicyNetworkEndpoint{
{Host: "api.example.com", Port: 443, Protocol: "rest"},
{
Host: "api.example.com",
Port: 443,
Protocol: "rest",
CredentialBinding: &v1.NetworkCredentialBinding{
Provider: "api-credentials",
},
},
},
},
},
@@ -342,6 +349,8 @@ func TestSandboxRoundTrip(t *testing.T) {
assert.Equal(t, "web", webRule.Name)
require.Len(t, webRule.Endpoints, 1)
assert.Equal(t, "api.example.com", webRule.Endpoints[0].Host)
require.NotNil(t, webRule.Endpoints[0].CredentialBinding)
assert.Equal(t, "api-credentials", webRule.Endpoints[0].CredentialBinding.Provider)
}
func TestSandboxSpecToProto(t *testing.T) {
sdk/go/openshell/v1/types/network_policy.go
+7
View File
@@ -40,6 +40,13 @@ type PolicyNetworkEndpoint struct {
SigningRegion string
JsonRpcMaxBodyBytes uint32
Mcp *McpOptions
CredentialBinding *NetworkCredentialBinding
}
// NetworkCredentialBinding binds an endpoint to static credentials from an attached provider.
type NetworkCredentialBinding struct {
// Provider is the attached provider whose static credentials may be resolved for the endpoint.
Provider string
}
// PolicyNetworkBinary identifies a binary subject to network policy enforcement.
sdk/go/proto/openshellv1/openshell.pb.go
+766 -597
View File
File diff suppressed because it is too large Load Diff
sdk/go/proto/sandboxv1/sandbox.pb.go
+177 -114
View File
@@ -595,6 +595,53 @@ func (x *MiddlewareEndpointSelector) GetExclude() []string {
return nil
}
// Binds a policy endpoint to static credentials from a sandbox provider.
type NetworkCredentialBinding struct {
state protoimpl.MessageState `protogen:"open.v1"`
// Name of the provider attached to this sandbox whose static credentials
// may be resolved for requests admitted by this endpoint.
Provider string `protobuf:"bytes,1,opt,name=provider,proto3" json:"provider,omitempty"`
unknownFields protoimpl.UnknownFields
sizeCache protoimpl.SizeCache
}
func (x *NetworkCredentialBinding) Reset() {
*x = NetworkCredentialBinding{}
mi := &file_sandbox_proto_msgTypes[7]
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
ms.StoreMessageInfo(mi)
}
func (x *NetworkCredentialBinding) String() string {
return protoimpl.X.MessageStringOf(x)
}
func (*NetworkCredentialBinding) ProtoMessage() {}
func (x *NetworkCredentialBinding) ProtoReflect() protoreflect.Message {
mi := &file_sandbox_proto_msgTypes[7]
if x != nil {
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
if ms.LoadMessageInfo() == nil {
ms.StoreMessageInfo(mi)
}
return ms
}
return mi.MessageOf(x)
}
// Deprecated: Use NetworkCredentialBinding.ProtoReflect.Descriptor instead.
func (*NetworkCredentialBinding) Descriptor() ([]byte, []int) {
return file_sandbox_proto_rawDescGZIP(), []int{7}
}
func (x *NetworkCredentialBinding) GetProvider() string {
if x != nil {
return x.Provider
}
return ""
}
// A network endpoint (host + port) with optional L7 inspection config.
type NetworkEndpoint struct {
state protoimpl.MessageState `protogen:"open.v1"`
@@ -678,14 +725,18 @@ type NetworkEndpoint struct {
// Defaults to 65536 when unset.
JsonRpcMaxBodyBytes uint32 `protobuf:"varint,22,opt,name=json_rpc_max_body_bytes,json=jsonRpcMaxBodyBytes,proto3" json:"json_rpc_max_body_bytes,omitempty"`
// MCP-only policy and inspection options. Only used when protocol is "mcp".
Mcp *McpOptions `protobuf:"bytes,23,opt,name=mcp,proto3" json:"mcp,omitempty"`
unknownFields protoimpl.UnknownFields
sizeCache protoimpl.SizeCache
Mcp *McpOptions `protobuf:"bytes,23,opt,name=mcp,proto3" json:"mcp,omitempty"`
// Explicit binding authority for static credentials from an attached
// endpointless provider profile. Profiles that already define endpoints
// continue to use those profile endpoints as their credential boundary.
CredentialBinding *NetworkCredentialBinding `protobuf:"bytes,24,opt,name=credential_binding,json=credentialBinding,proto3" json:"credential_binding,omitempty"`
unknownFields protoimpl.UnknownFields
sizeCache protoimpl.SizeCache
}
func (x *NetworkEndpoint) Reset() {
*x = NetworkEndpoint{}
mi := &file_sandbox_proto_msgTypes[7]
mi := &file_sandbox_proto_msgTypes[8]
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
ms.StoreMessageInfo(mi)
}
@@ -697,7 +748,7 @@ func (x *NetworkEndpoint) String() string {
func (*NetworkEndpoint) ProtoMessage() {}
func (x *NetworkEndpoint) ProtoReflect() protoreflect.Message {
mi := &file_sandbox_proto_msgTypes[7]
mi := &file_sandbox_proto_msgTypes[8]
if x != nil {
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
if ms.LoadMessageInfo() == nil {
@@ -710,7 +761,7 @@ func (x *NetworkEndpoint) ProtoReflect() protoreflect.Message {
// Deprecated: Use NetworkEndpoint.ProtoReflect.Descriptor instead.
func (*NetworkEndpoint) Descriptor() ([]byte, []int) {
return file_sandbox_proto_rawDescGZIP(), []int{7}
return file_sandbox_proto_rawDescGZIP(), []int{8}
}
func (x *NetworkEndpoint) GetHost() string {
@@ -874,6 +925,13 @@ func (x *NetworkEndpoint) GetMcp() *McpOptions {
return nil
}
func (x *NetworkEndpoint) GetCredentialBinding() *NetworkCredentialBinding {
if x != nil {
return x.CredentialBinding
}
return nil
}
// MCP options are grouped so MCP-specific policy can grow without adding more
// top-level NetworkEndpoint fields. Current enforcement targets the active
// 2025-11-25 Streamable HTTP/tools behavior, while preserving space for
@@ -911,7 +969,7 @@ type McpOptions struct {
func (x *McpOptions) Reset() {
*x = McpOptions{}
mi := &file_sandbox_proto_msgTypes[8]
mi := &file_sandbox_proto_msgTypes[9]
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
ms.StoreMessageInfo(mi)
}
@@ -923,7 +981,7 @@ func (x *McpOptions) String() string {
func (*McpOptions) ProtoMessage() {}
func (x *McpOptions) ProtoReflect() protoreflect.Message {
mi := &file_sandbox_proto_msgTypes[8]
mi := &file_sandbox_proto_msgTypes[9]
if x != nil {
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
if ms.LoadMessageInfo() == nil {
@@ -936,7 +994,7 @@ func (x *McpOptions) ProtoReflect() protoreflect.Message {
// Deprecated: Use McpOptions.ProtoReflect.Descriptor instead.
func (*McpOptions) Descriptor() ([]byte, []int) {
return file_sandbox_proto_rawDescGZIP(), []int{8}
return file_sandbox_proto_rawDescGZIP(), []int{9}
}
func (x *McpOptions) GetStrictToolNames() bool {
@@ -968,7 +1026,7 @@ type GraphqlOperation struct {
func (x *GraphqlOperation) Reset() {
*x = GraphqlOperation{}
mi := &file_sandbox_proto_msgTypes[9]
mi := &file_sandbox_proto_msgTypes[10]
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
ms.StoreMessageInfo(mi)
}
@@ -980,7 +1038,7 @@ func (x *GraphqlOperation) String() string {
func (*GraphqlOperation) ProtoMessage() {}
func (x *GraphqlOperation) ProtoReflect() protoreflect.Message {
mi := &file_sandbox_proto_msgTypes[9]
mi := &file_sandbox_proto_msgTypes[10]
if x != nil {
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
if ms.LoadMessageInfo() == nil {
@@ -993,7 +1051,7 @@ func (x *GraphqlOperation) ProtoReflect() protoreflect.Message {
// Deprecated: Use GraphqlOperation.ProtoReflect.Descriptor instead.
func (*GraphqlOperation) Descriptor() ([]byte, []int) {
return file_sandbox_proto_rawDescGZIP(), []int{9}
return file_sandbox_proto_rawDescGZIP(), []int{10}
}
func (x *GraphqlOperation) GetOperationType() string {
@@ -1048,7 +1106,7 @@ type L7DenyRule struct {
func (x *L7DenyRule) Reset() {
*x = L7DenyRule{}
mi := &file_sandbox_proto_msgTypes[10]
mi := &file_sandbox_proto_msgTypes[11]
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
ms.StoreMessageInfo(mi)
}
@@ -1060,7 +1118,7 @@ func (x *L7DenyRule) String() string {
func (*L7DenyRule) ProtoMessage() {}
func (x *L7DenyRule) ProtoReflect() protoreflect.Message {
mi := &file_sandbox_proto_msgTypes[10]
mi := &file_sandbox_proto_msgTypes[11]
if x != nil {
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
if ms.LoadMessageInfo() == nil {
@@ -1073,7 +1131,7 @@ func (x *L7DenyRule) ProtoReflect() protoreflect.Message {
// Deprecated: Use L7DenyRule.ProtoReflect.Descriptor instead.
func (*L7DenyRule) Descriptor() ([]byte, []int) {
return file_sandbox_proto_rawDescGZIP(), []int{10}
return file_sandbox_proto_rawDescGZIP(), []int{11}
}
func (x *L7DenyRule) GetMethod() string {
@@ -1142,7 +1200,7 @@ type L7Rule struct {
func (x *L7Rule) Reset() {
*x = L7Rule{}
mi := &file_sandbox_proto_msgTypes[11]
mi := &file_sandbox_proto_msgTypes[12]
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
ms.StoreMessageInfo(mi)
}
@@ -1154,7 +1212,7 @@ func (x *L7Rule) String() string {
func (*L7Rule) ProtoMessage() {}
func (x *L7Rule) ProtoReflect() protoreflect.Message {
mi := &file_sandbox_proto_msgTypes[11]
mi := &file_sandbox_proto_msgTypes[12]
if x != nil {
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
if ms.LoadMessageInfo() == nil {
@@ -1167,7 +1225,7 @@ func (x *L7Rule) ProtoReflect() protoreflect.Message {
// Deprecated: Use L7Rule.ProtoReflect.Descriptor instead.
func (*L7Rule) Descriptor() ([]byte, []int) {
return file_sandbox_proto_rawDescGZIP(), []int{11}
return file_sandbox_proto_rawDescGZIP(), []int{12}
}
func (x *L7Rule) GetAllow() *L7Allow {
@@ -1207,7 +1265,7 @@ type L7Allow struct {
func (x *L7Allow) Reset() {
*x = L7Allow{}
mi := &file_sandbox_proto_msgTypes[12]
mi := &file_sandbox_proto_msgTypes[13]
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
ms.StoreMessageInfo(mi)
}
@@ -1219,7 +1277,7 @@ func (x *L7Allow) String() string {
func (*L7Allow) ProtoMessage() {}
func (x *L7Allow) ProtoReflect() protoreflect.Message {
mi := &file_sandbox_proto_msgTypes[12]
mi := &file_sandbox_proto_msgTypes[13]
if x != nil {
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
if ms.LoadMessageInfo() == nil {
@@ -1232,7 +1290,7 @@ func (x *L7Allow) ProtoReflect() protoreflect.Message {
// Deprecated: Use L7Allow.ProtoReflect.Descriptor instead.
func (*L7Allow) Descriptor() ([]byte, []int) {
return file_sandbox_proto_rawDescGZIP(), []int{12}
return file_sandbox_proto_rawDescGZIP(), []int{13}
}
func (x *L7Allow) GetMethod() string {
@@ -1304,7 +1362,7 @@ type L7QueryMatcher struct {
func (x *L7QueryMatcher) Reset() {
*x = L7QueryMatcher{}
mi := &file_sandbox_proto_msgTypes[13]
mi := &file_sandbox_proto_msgTypes[14]
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
ms.StoreMessageInfo(mi)
}
@@ -1316,7 +1374,7 @@ func (x *L7QueryMatcher) String() string {
func (*L7QueryMatcher) ProtoMessage() {}
func (x *L7QueryMatcher) ProtoReflect() protoreflect.Message {
mi := &file_sandbox_proto_msgTypes[13]
mi := &file_sandbox_proto_msgTypes[14]
if x != nil {
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
if ms.LoadMessageInfo() == nil {
@@ -1329,7 +1387,7 @@ func (x *L7QueryMatcher) ProtoReflect() protoreflect.Message {
// Deprecated: Use L7QueryMatcher.ProtoReflect.Descriptor instead.
func (*L7QueryMatcher) Descriptor() ([]byte, []int) {
return file_sandbox_proto_rawDescGZIP(), []int{13}
return file_sandbox_proto_rawDescGZIP(), []int{14}
}
func (x *L7QueryMatcher) GetGlob() string {
@@ -1360,7 +1418,7 @@ type NetworkBinary struct {
func (x *NetworkBinary) Reset() {
*x = NetworkBinary{}
mi := &file_sandbox_proto_msgTypes[14]
mi := &file_sandbox_proto_msgTypes[15]
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
ms.StoreMessageInfo(mi)
}
@@ -1372,7 +1430,7 @@ func (x *NetworkBinary) String() string {
func (*NetworkBinary) ProtoMessage() {}
func (x *NetworkBinary) ProtoReflect() protoreflect.Message {
mi := &file_sandbox_proto_msgTypes[14]
mi := &file_sandbox_proto_msgTypes[15]
if x != nil {
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
if ms.LoadMessageInfo() == nil {
@@ -1385,7 +1443,7 @@ func (x *NetworkBinary) ProtoReflect() protoreflect.Message {
// Deprecated: Use NetworkBinary.ProtoReflect.Descriptor instead.
func (*NetworkBinary) Descriptor() ([]byte, []int) {
return file_sandbox_proto_rawDescGZIP(), []int{14}
return file_sandbox_proto_rawDescGZIP(), []int{15}
}
func (x *NetworkBinary) GetPath() string {
@@ -1414,7 +1472,7 @@ type GetSandboxConfigRequest struct {
func (x *GetSandboxConfigRequest) Reset() {
*x = GetSandboxConfigRequest{}
mi := &file_sandbox_proto_msgTypes[15]
mi := &file_sandbox_proto_msgTypes[16]
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
ms.StoreMessageInfo(mi)
}
@@ -1426,7 +1484,7 @@ func (x *GetSandboxConfigRequest) String() string {
func (*GetSandboxConfigRequest) ProtoMessage() {}
func (x *GetSandboxConfigRequest) ProtoReflect() protoreflect.Message {
mi := &file_sandbox_proto_msgTypes[15]
mi := &file_sandbox_proto_msgTypes[16]
if x != nil {
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
if ms.LoadMessageInfo() == nil {
@@ -1439,7 +1497,7 @@ func (x *GetSandboxConfigRequest) ProtoReflect() protoreflect.Message {
// Deprecated: Use GetSandboxConfigRequest.ProtoReflect.Descriptor instead.
func (*GetSandboxConfigRequest) Descriptor() ([]byte, []int) {
return file_sandbox_proto_rawDescGZIP(), []int{15}
return file_sandbox_proto_rawDescGZIP(), []int{16}
}
func (x *GetSandboxConfigRequest) GetSandboxId() string {
@@ -1458,7 +1516,7 @@ type GetGatewayConfigRequest struct {
func (x *GetGatewayConfigRequest) Reset() {
*x = GetGatewayConfigRequest{}
mi := &file_sandbox_proto_msgTypes[16]
mi := &file_sandbox_proto_msgTypes[17]
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
ms.StoreMessageInfo(mi)
}
@@ -1470,7 +1528,7 @@ func (x *GetGatewayConfigRequest) String() string {
func (*GetGatewayConfigRequest) ProtoMessage() {}
func (x *GetGatewayConfigRequest) ProtoReflect() protoreflect.Message {
mi := &file_sandbox_proto_msgTypes[16]
mi := &file_sandbox_proto_msgTypes[17]
if x != nil {
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
if ms.LoadMessageInfo() == nil {
@@ -1483,7 +1541,7 @@ func (x *GetGatewayConfigRequest) ProtoReflect() protoreflect.Message {
// Deprecated: Use GetGatewayConfigRequest.ProtoReflect.Descriptor instead.
func (*GetGatewayConfigRequest) Descriptor() ([]byte, []int) {
return file_sandbox_proto_rawDescGZIP(), []int{16}
return file_sandbox_proto_rawDescGZIP(), []int{17}
}
// Response containing gateway-global settings.
@@ -1500,7 +1558,7 @@ type GetGatewayConfigResponse struct {
func (x *GetGatewayConfigResponse) Reset() {
*x = GetGatewayConfigResponse{}
mi := &file_sandbox_proto_msgTypes[17]
mi := &file_sandbox_proto_msgTypes[18]
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
ms.StoreMessageInfo(mi)
}
@@ -1512,7 +1570,7 @@ func (x *GetGatewayConfigResponse) String() string {
func (*GetGatewayConfigResponse) ProtoMessage() {}
func (x *GetGatewayConfigResponse) ProtoReflect() protoreflect.Message {
mi := &file_sandbox_proto_msgTypes[17]
mi := &file_sandbox_proto_msgTypes[18]
if x != nil {
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
if ms.LoadMessageInfo() == nil {
@@ -1525,7 +1583,7 @@ func (x *GetGatewayConfigResponse) ProtoReflect() protoreflect.Message {
// Deprecated: Use GetGatewayConfigResponse.ProtoReflect.Descriptor instead.
func (*GetGatewayConfigResponse) Descriptor() ([]byte, []int) {
return file_sandbox_proto_rawDescGZIP(), []int{17}
return file_sandbox_proto_rawDescGZIP(), []int{18}
}
func (x *GetGatewayConfigResponse) GetSettings() map[string]*SettingValue {
@@ -1558,7 +1616,7 @@ type SettingValue struct {
func (x *SettingValue) Reset() {
*x = SettingValue{}
mi := &file_sandbox_proto_msgTypes[18]
mi := &file_sandbox_proto_msgTypes[19]
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
ms.StoreMessageInfo(mi)
}
@@ -1570,7 +1628,7 @@ func (x *SettingValue) String() string {
func (*SettingValue) ProtoMessage() {}
func (x *SettingValue) ProtoReflect() protoreflect.Message {
mi := &file_sandbox_proto_msgTypes[18]
mi := &file_sandbox_proto_msgTypes[19]
if x != nil {
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
if ms.LoadMessageInfo() == nil {
@@ -1583,7 +1641,7 @@ func (x *SettingValue) ProtoReflect() protoreflect.Message {
// Deprecated: Use SettingValue.ProtoReflect.Descriptor instead.
func (*SettingValue) Descriptor() ([]byte, []int) {
return file_sandbox_proto_rawDescGZIP(), []int{18}
return file_sandbox_proto_rawDescGZIP(), []int{19}
}
func (x *SettingValue) GetValue() isSettingValue_Value {
@@ -1668,7 +1726,7 @@ type EffectiveSetting struct {
func (x *EffectiveSetting) Reset() {
*x = EffectiveSetting{}
mi := &file_sandbox_proto_msgTypes[19]
mi := &file_sandbox_proto_msgTypes[20]
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
ms.StoreMessageInfo(mi)
}
@@ -1680,7 +1738,7 @@ func (x *EffectiveSetting) String() string {
func (*EffectiveSetting) ProtoMessage() {}
func (x *EffectiveSetting) ProtoReflect() protoreflect.Message {
mi := &file_sandbox_proto_msgTypes[19]
mi := &file_sandbox_proto_msgTypes[20]
if x != nil {
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
if ms.LoadMessageInfo() == nil {
@@ -1693,7 +1751,7 @@ func (x *EffectiveSetting) ProtoReflect() protoreflect.Message {
// Deprecated: Use EffectiveSetting.ProtoReflect.Descriptor instead.
func (*EffectiveSetting) Descriptor() ([]byte, []int) {
return file_sandbox_proto_rawDescGZIP(), []int{19}
return file_sandbox_proto_rawDescGZIP(), []int{20}
}
func (x *EffectiveSetting) GetValue() *SettingValue {
@@ -1748,7 +1806,7 @@ type GetSandboxConfigResponse struct {
func (x *GetSandboxConfigResponse) Reset() {
*x = GetSandboxConfigResponse{}
mi := &file_sandbox_proto_msgTypes[20]
mi := &file_sandbox_proto_msgTypes[21]
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
ms.StoreMessageInfo(mi)
}
@@ -1760,7 +1818,7 @@ func (x *GetSandboxConfigResponse) String() string {
func (*GetSandboxConfigResponse) ProtoMessage() {}
func (x *GetSandboxConfigResponse) ProtoReflect() protoreflect.Message {
mi := &file_sandbox_proto_msgTypes[20]
mi := &file_sandbox_proto_msgTypes[21]
if x != nil {
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
if ms.LoadMessageInfo() == nil {
@@ -1773,7 +1831,7 @@ func (x *GetSandboxConfigResponse) ProtoReflect() protoreflect.Message {
// Deprecated: Use GetSandboxConfigResponse.ProtoReflect.Descriptor instead.
func (*GetSandboxConfigResponse) Descriptor() ([]byte, []int) {
return file_sandbox_proto_rawDescGZIP(), []int{20}
return file_sandbox_proto_rawDescGZIP(), []int{21}
}
func (x *GetSandboxConfigResponse) GetPolicy() *SandboxPolicy {
@@ -1873,7 +1931,7 @@ type SupervisorMiddlewareService struct {
func (x *SupervisorMiddlewareService) Reset() {
*x = SupervisorMiddlewareService{}
mi := &file_sandbox_proto_msgTypes[21]
mi := &file_sandbox_proto_msgTypes[22]
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
ms.StoreMessageInfo(mi)
}
@@ -1885,7 +1943,7 @@ func (x *SupervisorMiddlewareService) String() string {
func (*SupervisorMiddlewareService) ProtoMessage() {}
func (x *SupervisorMiddlewareService) ProtoReflect() protoreflect.Message {
mi := &file_sandbox_proto_msgTypes[21]
mi := &file_sandbox_proto_msgTypes[22]
if x != nil {
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
if ms.LoadMessageInfo() == nil {
@@ -1898,7 +1956,7 @@ func (x *SupervisorMiddlewareService) ProtoReflect() protoreflect.Message {
// Deprecated: Use SupervisorMiddlewareService.ProtoReflect.Descriptor instead.
func (*SupervisorMiddlewareService) Descriptor() ([]byte, []int) {
return file_sandbox_proto_rawDescGZIP(), []int{21}
return file_sandbox_proto_rawDescGZIP(), []int{22}
}
func (x *SupervisorMiddlewareService) GetName() string {
@@ -1975,7 +2033,9 @@ const file_sandbox_proto_rawDesc = "" +
"\x05order\x18\x06 \x01(\x05R\x05order\"P\n" +
"\x1aMiddlewareEndpointSelector\x12\x18\n" +
"\ainclude\x18\x01 \x03(\tR\ainclude\x12\x18\n" +
"\aexclude\x18\x02 \x03(\tR\aexclude\"\x84\t\n" +
"\aexclude\x18\x02 \x03(\tR\aexclude\"6\n" +
"\x18NetworkCredentialBinding\x12\x1a\n" +
"\bprovider\x18\x01 \x01(\tR\bprovider\"\xe3\t\n" +
"\x0fNetworkEndpoint\x12\x12\n" +
"\x04host\x18\x01 \x01(\tR\x04host\x12\x12\n" +
"\x04port\x18\x02 \x01(\rR\x04port\x12\x1a\n" +
@@ -2002,7 +2062,8 @@ const file_sandbox_proto_rawDesc = "" +
"\x0fsigning_service\x18\x14 \x01(\tR\x0esigningService\x12%\n" +
"\x0esigning_region\x18\x15 \x01(\tR\rsigningRegion\x124\n" +
"\x17json_rpc_max_body_bytes\x18\x16 \x01(\rR\x13jsonRpcMaxBodyBytes\x122\n" +
"\x03mcp\x18\x17 \x01(\v2 .openshell.sandbox.v1.McpOptionsR\x03mcp\x1ar\n" +
"\x03mcp\x18\x17 \x01(\v2 .openshell.sandbox.v1.McpOptionsR\x03mcp\x12]\n" +
"\x12credential_binding\x18\x18 \x01(\v2..openshell.sandbox.v1.NetworkCredentialBindingR\x11credentialBinding\x1ar\n" +
"\x1cGraphqlPersistedQueriesEntry\x12\x10\n" +
"\x03key\x18\x01 \x01(\tR\x03key\x12<\n" +
"\x05value\x18\x02 \x01(\v2&.openshell.sandbox.v1.GraphqlOperationR\x05value:\x028\x01\"\xb6\x01\n" +
@@ -2122,7 +2183,7 @@ func file_sandbox_proto_rawDescGZIP() []byte {
}
var file_sandbox_proto_enumTypes = make([]protoimpl.EnumInfo, 2)
var file_sandbox_proto_msgTypes = make([]protoimpl.MessageInfo, 31)
var file_sandbox_proto_msgTypes = make([]protoimpl.MessageInfo, 32)
var file_sandbox_proto_goTypes = []any{
(SettingScope)(0), // 0: openshell.sandbox.v1.SettingScope
(PolicySource)(0), // 1: openshell.sandbox.v1.PolicySource
@@ -2133,72 +2194,74 @@ var file_sandbox_proto_goTypes = []any{
(*NetworkPolicyRule)(nil), // 6: openshell.sandbox.v1.NetworkPolicyRule
(*NetworkMiddlewareConfig)(nil), // 7: openshell.sandbox.v1.NetworkMiddlewareConfig
(*MiddlewareEndpointSelector)(nil), // 8: openshell.sandbox.v1.MiddlewareEndpointSelector
(*NetworkEndpoint)(nil), // 9: openshell.sandbox.v1.NetworkEndpoint
(*McpOptions)(nil), // 10: openshell.sandbox.v1.McpOptions
(*GraphqlOperation)(nil), // 11: openshell.sandbox.v1.GraphqlOperation
(*L7DenyRule)(nil), // 12: openshell.sandbox.v1.L7DenyRule
(*L7Rule)(nil), // 13: openshell.sandbox.v1.L7Rule
(*L7Allow)(nil), // 14: openshell.sandbox.v1.L7Allow
(*L7QueryMatcher)(nil), // 15: openshell.sandbox.v1.L7QueryMatcher
(*NetworkBinary)(nil), // 16: openshell.sandbox.v1.NetworkBinary
(*GetSandboxConfigRequest)(nil), // 17: openshell.sandbox.v1.GetSandboxConfigRequest
(*GetGatewayConfigRequest)(nil), // 18: openshell.sandbox.v1.GetGatewayConfigRequest
(*GetGatewayConfigResponse)(nil), // 19: openshell.sandbox.v1.GetGatewayConfigResponse
(*SettingValue)(nil), // 20: openshell.sandbox.v1.SettingValue
(*EffectiveSetting)(nil), // 21: openshell.sandbox.v1.EffectiveSetting
(*GetSandboxConfigResponse)(nil), // 22: openshell.sandbox.v1.GetSandboxConfigResponse
(*SupervisorMiddlewareService)(nil), // 23: openshell.sandbox.v1.SupervisorMiddlewareService
nil, // 24: openshell.sandbox.v1.SandboxPolicy.NetworkPoliciesEntry
nil, // 25: openshell.sandbox.v1.SandboxPolicy.NetworkMiddlewaresEntry
nil, // 26: openshell.sandbox.v1.NetworkEndpoint.GraphqlPersistedQueriesEntry
nil, // 27: openshell.sandbox.v1.L7DenyRule.QueryEntry
nil, // 28: openshell.sandbox.v1.L7DenyRule.ParamsEntry
nil, // 29: openshell.sandbox.v1.L7Allow.QueryEntry
nil, // 30: openshell.sandbox.v1.L7Allow.ParamsEntry
nil, // 31: openshell.sandbox.v1.GetGatewayConfigResponse.SettingsEntry
nil, // 32: openshell.sandbox.v1.GetSandboxConfigResponse.SettingsEntry
(*structpb.Struct)(nil), // 33: google.protobuf.Struct
(*NetworkCredentialBinding)(nil), // 9: openshell.sandbox.v1.NetworkCredentialBinding
(*NetworkEndpoint)(nil), // 10: openshell.sandbox.v1.NetworkEndpoint
(*McpOptions)(nil), // 11: openshell.sandbox.v1.McpOptions
(*GraphqlOperation)(nil), // 12: openshell.sandbox.v1.GraphqlOperation
(*L7DenyRule)(nil), // 13: openshell.sandbox.v1.L7DenyRule
(*L7Rule)(nil), // 14: openshell.sandbox.v1.L7Rule
(*L7Allow)(nil), // 15: openshell.sandbox.v1.L7Allow
(*L7QueryMatcher)(nil), // 16: openshell.sandbox.v1.L7QueryMatcher
(*NetworkBinary)(nil), // 17: openshell.sandbox.v1.NetworkBinary
(*GetSandboxConfigRequest)(nil), // 18: openshell.sandbox.v1.GetSandboxConfigRequest
(*GetGatewayConfigRequest)(nil), // 19: openshell.sandbox.v1.GetGatewayConfigRequest
(*GetGatewayConfigResponse)(nil), // 20: openshell.sandbox.v1.GetGatewayConfigResponse
(*SettingValue)(nil), // 21: openshell.sandbox.v1.SettingValue
(*EffectiveSetting)(nil), // 22: openshell.sandbox.v1.EffectiveSetting
(*GetSandboxConfigResponse)(nil), // 23: openshell.sandbox.v1.GetSandboxConfigResponse
(*SupervisorMiddlewareService)(nil), // 24: openshell.sandbox.v1.SupervisorMiddlewareService
nil, // 25: openshell.sandbox.v1.SandboxPolicy.NetworkPoliciesEntry
nil, // 26: openshell.sandbox.v1.SandboxPolicy.NetworkMiddlewaresEntry
nil, // 27: openshell.sandbox.v1.NetworkEndpoint.GraphqlPersistedQueriesEntry
nil, // 28: openshell.sandbox.v1.L7DenyRule.QueryEntry
nil, // 29: openshell.sandbox.v1.L7DenyRule.ParamsEntry
nil, // 30: openshell.sandbox.v1.L7Allow.QueryEntry
nil, // 31: openshell.sandbox.v1.L7Allow.ParamsEntry
nil, // 32: openshell.sandbox.v1.GetGatewayConfigResponse.SettingsEntry
nil, // 33: openshell.sandbox.v1.GetSandboxConfigResponse.SettingsEntry
(*structpb.Struct)(nil), // 34: google.protobuf.Struct
}
var file_sandbox_proto_depIdxs = []int32{
3, // 0: openshell.sandbox.v1.SandboxPolicy.filesystem:type_name -> openshell.sandbox.v1.FilesystemPolicy
4, // 1: openshell.sandbox.v1.SandboxPolicy.landlock:type_name -> openshell.sandbox.v1.LandlockPolicy
5, // 2: openshell.sandbox.v1.SandboxPolicy.process:type_name -> openshell.sandbox.v1.ProcessPolicy
24, // 3: openshell.sandbox.v1.SandboxPolicy.network_policies:type_name -> openshell.sandbox.v1.SandboxPolicy.NetworkPoliciesEntry
25, // 4: openshell.sandbox.v1.SandboxPolicy.network_middlewares:type_name -> openshell.sandbox.v1.SandboxPolicy.NetworkMiddlewaresEntry
9, // 5: openshell.sandbox.v1.NetworkPolicyRule.endpoints:type_name -> openshell.sandbox.v1.NetworkEndpoint
16, // 6: openshell.sandbox.v1.NetworkPolicyRule.binaries:type_name -> openshell.sandbox.v1.NetworkBinary
33, // 7: openshell.sandbox.v1.NetworkMiddlewareConfig.config:type_name -> google.protobuf.Struct
25, // 3: openshell.sandbox.v1.SandboxPolicy.network_policies:type_name -> openshell.sandbox.v1.SandboxPolicy.NetworkPoliciesEntry
26, // 4: openshell.sandbox.v1.SandboxPolicy.network_middlewares:type_name -> openshell.sandbox.v1.SandboxPolicy.NetworkMiddlewaresEntry
10, // 5: openshell.sandbox.v1.NetworkPolicyRule.endpoints:type_name -> openshell.sandbox.v1.NetworkEndpoint
17, // 6: openshell.sandbox.v1.NetworkPolicyRule.binaries:type_name -> openshell.sandbox.v1.NetworkBinary
34, // 7: openshell.sandbox.v1.NetworkMiddlewareConfig.config:type_name -> google.protobuf.Struct
8, // 8: openshell.sandbox.v1.NetworkMiddlewareConfig.endpoints:type_name -> openshell.sandbox.v1.MiddlewareEndpointSelector
13, // 9: openshell.sandbox.v1.NetworkEndpoint.rules:type_name -> openshell.sandbox.v1.L7Rule
12, // 10: openshell.sandbox.v1.NetworkEndpoint.deny_rules:type_name -> openshell.sandbox.v1.L7DenyRule
26, // 11: openshell.sandbox.v1.NetworkEndpoint.graphql_persisted_queries:type_name -> openshell.sandbox.v1.NetworkEndpoint.GraphqlPersistedQueriesEntry
10, // 12: openshell.sandbox.v1.NetworkEndpoint.mcp:type_name -> openshell.sandbox.v1.McpOptions
27, // 13: openshell.sandbox.v1.L7DenyRule.query:type_name -> openshell.sandbox.v1.L7DenyRule.QueryEntry
28, // 14: openshell.sandbox.v1.L7DenyRule.params:type_name -> openshell.sandbox.v1.L7DenyRule.ParamsEntry
14, // 15: openshell.sandbox.v1.L7Rule.allow:type_name -> openshell.sandbox.v1.L7Allow
29, // 16: openshell.sandbox.v1.L7Allow.query:type_name -> openshell.sandbox.v1.L7Allow.QueryEntry
30, // 17: openshell.sandbox.v1.L7Allow.params:type_name -> openshell.sandbox.v1.L7Allow.ParamsEntry
31, // 18: openshell.sandbox.v1.GetGatewayConfigResponse.settings:type_name -> openshell.sandbox.v1.GetGatewayConfigResponse.SettingsEntry
20, // 19: openshell.sandbox.v1.EffectiveSetting.value:type_name -> openshell.sandbox.v1.SettingValue
0, // 20: openshell.sandbox.v1.EffectiveSetting.scope:type_name -> openshell.sandbox.v1.SettingScope
2, // 21: openshell.sandbox.v1.GetSandboxConfigResponse.policy:type_name -> openshell.sandbox.v1.SandboxPolicy
32, // 22: openshell.sandbox.v1.GetSandboxConfigResponse.settings:type_name -> openshell.sandbox.v1.GetSandboxConfigResponse.SettingsEntry
1, // 23: openshell.sandbox.v1.GetSandboxConfigResponse.policy_source:type_name -> openshell.sandbox.v1.PolicySource
23, // 24: openshell.sandbox.v1.GetSandboxConfigResponse.supervisor_middleware_services:type_name -> openshell.sandbox.v1.SupervisorMiddlewareService
6, // 25: openshell.sandbox.v1.SandboxPolicy.NetworkPoliciesEntry.value:type_name -> openshell.sandbox.v1.NetworkPolicyRule
7, // 26: openshell.sandbox.v1.SandboxPolicy.NetworkMiddlewaresEntry.value:type_name -> openshell.sandbox.v1.NetworkMiddlewareConfig
11, // 27: openshell.sandbox.v1.NetworkEndpoint.GraphqlPersistedQueriesEntry.value:type_name -> openshell.sandbox.v1.GraphqlOperation
15, // 28: openshell.sandbox.v1.L7DenyRule.QueryEntry.value:type_name -> openshell.sandbox.v1.L7QueryMatcher
15, // 29: openshell.sandbox.v1.L7DenyRule.ParamsEntry.value:type_name -> openshell.sandbox.v1.L7QueryMatcher
15, // 30: openshell.sandbox.v1.L7Allow.QueryEntry.value:type_name -> openshell.sandbox.v1.L7QueryMatcher
15, // 31: openshell.sandbox.v1.L7Allow.ParamsEntry.value:type_name -> openshell.sandbox.v1.L7QueryMatcher
20, // 32: openshell.sandbox.v1.GetGatewayConfigResponse.SettingsEntry.value:type_name -> openshell.sandbox.v1.SettingValue
21, // 33: openshell.sandbox.v1.GetSandboxConfigResponse.SettingsEntry.value:type_name -> openshell.sandbox.v1.EffectiveSetting
34, // [34:34] is the sub-list for method output_type
34, // [34:34] is the sub-list for method input_type
34, // [34:34] is the sub-list for extension type_name
34, // [34:34] is the sub-list for extension extendee
0, // [0:34] is the sub-list for field type_name
14, // 9: openshell.sandbox.v1.NetworkEndpoint.rules:type_name -> openshell.sandbox.v1.L7Rule
13, // 10: openshell.sandbox.v1.NetworkEndpoint.deny_rules:type_name -> openshell.sandbox.v1.L7DenyRule
27, // 11: openshell.sandbox.v1.NetworkEndpoint.graphql_persisted_queries:type_name -> openshell.sandbox.v1.NetworkEndpoint.GraphqlPersistedQueriesEntry
11, // 12: openshell.sandbox.v1.NetworkEndpoint.mcp:type_name -> openshell.sandbox.v1.McpOptions
9, // 13: openshell.sandbox.v1.NetworkEndpoint.credential_binding:type_name -> openshell.sandbox.v1.NetworkCredentialBinding
28, // 14: openshell.sandbox.v1.L7DenyRule.query:type_name -> openshell.sandbox.v1.L7DenyRule.QueryEntry
29, // 15: openshell.sandbox.v1.L7DenyRule.params:type_name -> openshell.sandbox.v1.L7DenyRule.ParamsEntry
15, // 16: openshell.sandbox.v1.L7Rule.allow:type_name -> openshell.sandbox.v1.L7Allow
30, // 17: openshell.sandbox.v1.L7Allow.query:type_name -> openshell.sandbox.v1.L7Allow.QueryEntry
31, // 18: openshell.sandbox.v1.L7Allow.params:type_name -> openshell.sandbox.v1.L7Allow.ParamsEntry
32, // 19: openshell.sandbox.v1.GetGatewayConfigResponse.settings:type_name -> openshell.sandbox.v1.GetGatewayConfigResponse.SettingsEntry
21, // 20: openshell.sandbox.v1.EffectiveSetting.value:type_name -> openshell.sandbox.v1.SettingValue
0, // 21: openshell.sandbox.v1.EffectiveSetting.scope:type_name -> openshell.sandbox.v1.SettingScope
2, // 22: openshell.sandbox.v1.GetSandboxConfigResponse.policy:type_name -> openshell.sandbox.v1.SandboxPolicy
33, // 23: openshell.sandbox.v1.GetSandboxConfigResponse.settings:type_name -> openshell.sandbox.v1.GetSandboxConfigResponse.SettingsEntry
1, // 24: openshell.sandbox.v1.GetSandboxConfigResponse.policy_source:type_name -> openshell.sandbox.v1.PolicySource
24, // 25: openshell.sandbox.v1.GetSandboxConfigResponse.supervisor_middleware_services:type_name -> openshell.sandbox.v1.SupervisorMiddlewareService
6, // 26: openshell.sandbox.v1.SandboxPolicy.NetworkPoliciesEntry.value:type_name -> openshell.sandbox.v1.NetworkPolicyRule
7, // 27: openshell.sandbox.v1.SandboxPolicy.NetworkMiddlewaresEntry.value:type_name -> openshell.sandbox.v1.NetworkMiddlewareConfig
12, // 28: openshell.sandbox.v1.NetworkEndpoint.GraphqlPersistedQueriesEntry.value:type_name -> openshell.sandbox.v1.GraphqlOperation
16, // 29: openshell.sandbox.v1.L7DenyRule.QueryEntry.value:type_name -> openshell.sandbox.v1.L7QueryMatcher
16, // 30: openshell.sandbox.v1.L7DenyRule.ParamsEntry.value:type_name -> openshell.sandbox.v1.L7QueryMatcher
16, // 31: openshell.sandbox.v1.L7Allow.QueryEntry.value:type_name -> openshell.sandbox.v1.L7QueryMatcher
16, // 32: openshell.sandbox.v1.L7Allow.ParamsEntry.value:type_name -> openshell.sandbox.v1.L7QueryMatcher
21, // 33: openshell.sandbox.v1.GetGatewayConfigResponse.SettingsEntry.value:type_name -> openshell.sandbox.v1.SettingValue
22, // 34: openshell.sandbox.v1.GetSandboxConfigResponse.SettingsEntry.value:type_name -> openshell.sandbox.v1.EffectiveSetting
35, // [35:35] is the sub-list for method output_type
35, // [35:35] is the sub-list for method input_type
35, // [35:35] is the sub-list for extension type_name
35, // [35:35] is the sub-list for extension extendee
0, // [0:35] is the sub-list for field type_name
}
func init() { file_sandbox_proto_init() }
@@ -2206,8 +2269,8 @@ func file_sandbox_proto_init() {
if File_sandbox_proto != nil {
return
}
file_sandbox_proto_msgTypes[8].OneofWrappers = []any{}
file_sandbox_proto_msgTypes[18].OneofWrappers = []any{
file_sandbox_proto_msgTypes[9].OneofWrappers = []any{}
file_sandbox_proto_msgTypes[19].OneofWrappers = []any{
(*SettingValue_StringValue)(nil),
(*SettingValue_BoolValue)(nil),
(*SettingValue_IntValue)(nil),
@@ -2219,7 +2282,7 @@ func file_sandbox_proto_init() {
GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
RawDescriptor: unsafe.Slice(unsafe.StringData(file_sandbox_proto_rawDesc), len(file_sandbox_proto_rawDesc)),
NumEnums: 2,
NumMessages: 31,
NumMessages: 32,
NumExtensions: 0,
NumServices: 0,
},
tasks/test.toml
+1
View File
@@ -51,6 +51,7 @@ run = "bash tasks/scripts/e2e-gpu-build-images.sh"
["test:rust"]
description = "Run Rust tests"
env = { OPENSHELL_TELEMETRY_ENABLED = "false" }
run = [
# Run the workspace once without openshell-server so we can run that crate
# with test-only helpers enabled.