Repository navigation
feat(egress): classify local provider endpoints - #19
Merged
senamakel merged 9 commits intoOct 25, 2026
Merged
Conversation
Add a local_provider module and re-export classify_provider_endpoint so callers can determine whether an endpoint belongs to a locally hosted provider. Auto-committed-on: cuttlefish Co-authored-by: Medulla <medulla@tinyhumans.ai>
Add a ClassifyProviderEndpoint2 bus method and contract version 1.32 so LocalOnly privacy mode can decide whether a configured provider host is on-device. Only loopback and unspecified IP literals plus localhost names count as on-device; LAN addresses stay external and unrecognized hosts fail closed. Auto-committed-on: cuttlefish Co-authored-by: Medulla <medulla@tinyhumans.ai>
…1.32 Adds a ClassifyProviderEndpoint2 method that validates a host-only provider endpoint request, rejecting empty, oversized, control-character, and whitespace-bearing hosts. The contract version moves to 1.32 so older 1.31 peers are no longer considered compatible, and the new member is advertised alongside the existing method constants. Auto-committed-on: cuttlefish Co-authored-by: Medulla <medulla@tinyhumans.ai>
The local provider was classifying same-machine endpoints using the wrong locality variant, so loopback and link-local addresses could be reported as remote. The classification now uses the correct endpoint type and the associated tests were updated to match. Auto-committed-on: cuttlefish Co-authored-by: Medulla <medulla@tinyhumans.ai>
Hostnames ending in a dot, such as "localhost." or "worker.localhost.", were not recognised as on-device because the trailing dot was stripped before the suffix check but the rsplit_once branch matched the wrong segment. The classification now strips a single trailing dot and relies on the existing suffix check, and tests cover trailing-dot hosts, IPv4-mapped IPv6 addresses, and the resulting privacy verdicts. Auto-committed-on: cuttlefish Co-authored-by: Medulla <medulla@tinyhumans.ai>
Add a test asserting the JSON encoding and decoding of the provider endpoint request and response types, pinning their field names and the on_device locality value so accidental wire format changes are caught. Auto-committed-on: cuttlefish Co-authored-by: Medulla <medulla@tinyhumans.ai>
Reformatted the provider endpoint locality test to satisfy rustfmt line width limits. The assertions and privacy request setup are unchanged in behaviour, only wrapped across lines. Auto-committed-on: cuttlefish Co-authored-by: Medulla <medulla@tinyhumans.ai>
Convert the provider endpoint wire-shape and locality tests to return `Result` instead of unwrapping, so serialization failures surface as test errors rather than panics. Also wrap `LocalOnly` in backticks in the module and field docs. Auto-committed-on: cuttlefish Co-authored-by: Medulla <medulla@tinyhumans.ai>
Wrap `LocalOnly` in backticks throughout the local provider module docs so rustdoc renders it as code. The IPv6 locality check was also rewritten to use `map_or_else`, which is behaviourally identical but avoids the intermediate `Option` closure. Auto-committed-on: cuttlefish Co-authored-by: Medulla <medulla@tinyhumans.ai>
senamakel
merged commit Oct 25, 2026
6d98d3d
into
epic/8369-security-migration
14 of 16 checks passed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds the contract 1.32
ClassifyProviderEndpoint2method and native endpoint classifier for host provider URLs. Only loopback, unspecified, and localhost names count as on-device; private LAN, link-local, and IPv6 ULA addresses remain external because LocalOnly means same-machine. The classification uses the parsed host only, performs no DNS lookup, and treats malformed hosts as external. It also documents the existing stricter Sensitive rule for unassessed external user content.Validation run:
cargo fmt --all -- --checkcargo clippy --all-targets --all-features -- -D warningscargo build --all-targets --all-featurescargo test --all-featurescargo testCloses #11
Part of tinyhumansai/openhuman#8369