Skip to content

feat(middleware): validate HTTP session hooks with Git signing #2

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
pimlock wants to merge 1 commit into
base: 4359-http-session-validation-base/pimlock
Choose a base branch
from
+6,446 −0
Draft

feat(middleware): validate HTTP session hooks with Git signing #2

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions .github/workflows/branch-checks.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -220,6 +220,7 @@ jobs:
cargo fmt --manifest-path e2e/rust/Cargo.toml --all -- --check
cargo fmt --manifest-path examples/governance-interceptor/Cargo.toml --all -- --check
cargo fmt --manifest-path examples/supervisor-middleware-content-guard/Cargo.toml --all -- --check
cargo fmt --manifest-path examples/supervisor-middleware-git-signing/Cargo.toml --all -- --check
cargo fmt --manifest-path examples/isolation-backend-v8/Cargo.toml --all -- --check

cargo-lockfiles:
Expand Down Expand Up @@ -276,6 +277,7 @@ jobs:
cargo clippy --locked --manifest-path e2e/rust/Cargo.toml --all-targets -- -D warnings
cargo clippy --locked --manifest-path examples/governance-interceptor/Cargo.toml --all-targets -- -D warnings
cargo clippy --locked --manifest-path examples/supervisor-middleware-content-guard/Cargo.toml --all-targets -- -D warnings
cargo clippy --locked --manifest-path examples/supervisor-middleware-git-signing/Cargo.toml --all-targets -- -D warnings
cargo clippy --locked --manifest-path examples/isolation-backend-v8/Cargo.toml --all-targets -- -D warnings

rust-test:
Expand Down Expand Up @@ -325,6 +327,7 @@ jobs:
run: |
cargo nextest run --locked --profile ci --workspace --features openshell-server/test-support
cargo nextest run --locked --config-file .config/nextest.toml --profile ci --manifest-path examples/supervisor-middleware-content-guard/Cargo.toml
cargo nextest run --locked --config-file .config/nextest.toml --profile ci --manifest-path examples/supervisor-middleware-git-signing/Cargo.toml

rust-postgres-test:
name: Rust PostgreSQL tests
Expand Down
2 changes: 2 additions & 0 deletions docs/extensibility/supervisor-middleware/operations.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -61,6 +61,8 @@ OpenShell applies middleware changes before it injects provider credentials. Mid

Request output streams to the external service while the sandbox uploads. OpenShell instead buffers output when a stage selects BUFFERED, the route needs SigV4 signing or body credential rewriting, or the request uses the forward proxy, HTTP/1.0, or `Upgrade`. JSON-RPC, MCP, and GraphQL endpoints also buffer output so OpenShell can check the replaced body against policy. Buffered output can be up to 10 MiB for SigV4 signing, 256 KiB for body credential rewriting, and 4 MiB otherwise. The preflight reports this limit to STREAM stages as `limits.max_output_body_bytes`. Larger output fails with `body_over_limit`.

A STREAM stage can consume all input before sending `output_start`. The [Git-signing example](https://github.com/pimlock/OpenShell/tree/4359-git-signing-validation/pimlock/examples/supervisor-middleware-git-signing) uses this order to rewrite and sign a complete push without putting a signing key in the sandbox. It stores the push in a temporary file, then declares the replacement length and returns output chunks. Commit rewriting changes object IDs, so this prototype requires users to reconcile their local branches after pushing.

### Responses

Your service receives the response status, headers, and request context. It can return `continue_without_body` or choose a body mode with `inspect`.
Expand Down
Loading