Shiju 374c035962 fix(network): refuse protocol upgrades on GraphQL endpoints (#3841) ...

* fix(network): refuse protocol upgrades on GraphQL endpoints

Refuse Upgrade headers before forwarding GraphQL-over-HTTP requests.
Share the protocol refusal table with JSON-RPC and MCP, and close
unexpected protocol switches before relaying frames.

Keep GraphQL-over-WebSocket inspection on separate WebSocket endpoints.
Cover upgrade refusal, audit mode, subscription handshakes, and ordinary
HTTP and WebSocket controls. Update the current policy documentation.

Signed-off-by: Shiju <shiju@nvidia.com>

* fix(network): refuse GraphQL upgrades before reading bodies

Validate the HTTP head and endpoint authority before upgrade refusal, then inspect ordinary GraphQL bodies. Preserve missing-authority credential rejection after body inspection.

Signed-off-by: Shiju <shiju@nvidia.com>

---------

Signed-off-by: Shiju <shiju@nvidia.com>

2026-09-30 20:10:04 +00:00

..

data

fix(mcp): explain revision-scoped policy and rejections (#3850)

2026-09-29 21:50:35 +00:00

src

fix(network): refuse protocol upgrades on GraphQL endpoints (#3841)

2026-09-30 20:10:04 +00:00

testdata

refactor(openshell-sandbox): Split sandbox into process and network subcrates. (#1650)

2026-06-15 15:16:23 -04:00

tests

refactor(inference): remove managed inference routes (#3195)

2026-09-09 18:47:22 +00:00

Cargo.toml

fix(policy): validate raw OPA settings and redact startup errors (#3788)

2026-09-30 05:59:31 +00:00