|
| 1 | +#ifndef FASTLY_SECURITY_H |
| 2 | +#define FASTLY_SECURITY_H |
| 3 | + |
| 4 | +#include <fastly/detail/access_bridge_internals.h> |
| 5 | +#include <fastly/expected.h> |
| 6 | +#include <fastly/http/body.h> |
| 7 | +#include <fastly/http/request.h> |
| 8 | +#include <optional> |
| 9 | + |
| 10 | +namespace fastly::security { |
| 11 | +/// Configuration for inspecting a `Request` using Security. |
| 12 | +class InspectConfig { |
| 13 | +public: |
| 14 | + /// Create a new default `InspectConfig` |
| 15 | + InspectConfig() = default; |
| 16 | + |
| 17 | + /// Specify an explicity client IP address to inspect. |
| 18 | + /// By default, inspect will use the IP address that made the request to the |
| 19 | + /// running Compute service, but you may want to use a different IP when |
| 20 | + /// service chaining or if requests are proxied from outside of Fastly’s |
| 21 | + /// network. |
| 22 | + InspectConfig with_client_ip(std::string ip) && { |
| 23 | + this->client_ip_ = std::move(ip); |
| 24 | + return std::move(*this); |
| 25 | + } |
| 26 | + |
| 27 | + /// Set a corp name for the configuration. |
| 28 | + InspectConfig with_corp(std::string name) && { |
| 29 | + this->corp_ = std::move(name); |
| 30 | + return std::move(*this); |
| 31 | + } |
| 32 | + |
| 33 | + /// Set a workspace name for the configuration. |
| 34 | + InspectConfig with_workspace(std::string name) && { |
| 35 | + this->workspace_ = std::move(name); |
| 36 | + return std::move(*this); |
| 37 | + } |
| 38 | + |
| 39 | + /// Set a buffer size for the response. |
| 40 | + InspectConfig with_buffer_size(std::size_t size) && { |
| 41 | + this->buffer_size_ = size; |
| 42 | + return std::move(*this); |
| 43 | + } |
| 44 | + |
| 45 | + const std::optional<std::string> &client_ip() const { return client_ip_; } |
| 46 | + const std::optional<std::string> &corp() const { return corp_; } |
| 47 | + const std::optional<std::string> &workspace() const { return workspace_; } |
| 48 | + const std::optional<std::size_t> &buffer_size() const { return buffer_size_; } |
| 49 | + |
| 50 | +private: |
| 51 | + std::optional<std::string> client_ip_; |
| 52 | + std::optional<std::string> corp_; |
| 53 | + std::optional<std::string> workspace_; |
| 54 | + std::optional<std::size_t> buffer_size_; |
| 55 | +}; |
| 56 | +using fastly::sys::security::InspectErrorCode; |
| 57 | +using fastly::sys::security::InspectVerdict; |
| 58 | +class InspectError { |
| 59 | +public: |
| 60 | + InspectError(fastly::sys::security::InspectError *e) |
| 61 | + : err_(rust::Box<fastly::sys::security::InspectError>::from_raw(e)) {}; |
| 62 | + InspectError(rust::Box<fastly::sys::security::InspectError> e) |
| 63 | + : err_(std::move(e)) {}; |
| 64 | + InspectErrorCode error_code(); |
| 65 | + std::string error_msg(); |
| 66 | + /// When getting `InspectErrorCode::BufferSizeError`, this can be used to get |
| 67 | + /// the required size of the buffer before re-attempting the call. |
| 68 | + std::optional<std::size_t> required_buffer_size(); |
| 69 | + |
| 70 | +private: |
| 71 | + rust::Box<fastly::sys::security::InspectError> err_; |
| 72 | +}; |
| 73 | + |
| 74 | +/// Results of asking Security to inspect a `Request` |
| 75 | +class InspectResponse { |
| 76 | + friend detail::AccessBridgeInternals; |
| 77 | + |
| 78 | +public: |
| 79 | + /// Security status code. |
| 80 | + std::int16_t status() const; |
| 81 | + /// A redirect URL returned from Security |
| 82 | + std::optional<std::string> redirect_url() const; |
| 83 | + /// Tags returned by Security |
| 84 | + std::vector<std::string> tags() const; |
| 85 | + /// Get Security's verdict on how to handle this request. |
| 86 | + InspectVerdict verdict() const; |
| 87 | + /// Get additional information for verdicts where `this->verdict()` is |
| 88 | + /// `Other`. |
| 89 | + std::optional<std::string> unrecognized_verdict_info() const; |
| 90 | + /// How long Security spent determining its verdict. |
| 91 | + std::chrono::milliseconds decision_ms() const; |
| 92 | + /// A redirect URI returned by Security. |
| 93 | + bool is_redirect() const; |
| 94 | + /// Convert a redirect URI returned by Security into a `Response`. |
| 95 | + std::optional<Response> into_redirect(); |
| 96 | + |
| 97 | +private: |
| 98 | + rust::Box<fastly::sys::security::InspectResponse> ir_; |
| 99 | + InspectResponse(rust::Box<fastly::sys::security::InspectResponse> ir) |
| 100 | + : ir_(std::move(ir)) {}; |
| 101 | +}; |
| 102 | + |
| 103 | +/// Inspect a `Request` using the [Fastly Next-Gen |
| 104 | +/// WAF](https://docs.fastly.com/en/ngwaf/). |
| 105 | +tl::expected<InspectResponse, InspectError> |
| 106 | +inspect(fastly::http::Request &request, InspectConfig config); |
| 107 | + |
| 108 | +} // namespace fastly::security |
| 109 | + |
| 110 | +#endif |
0 commit comments