mirror of
https://github.com/openai/codex.git
synced 2026-10-22 17:58:46 +00:00
acrognale-oai
973ec2942c
## What changed - Add `NetworkPolicyController` and `NetworkPolicy` APIs for publishing destination policies, checking access, and observing policy changes. Restricted policies permit only `https` and `wss` URLs with exact allowed hosts. - Add revocable `NetworkPermit` values with cancellation support. Reject stale policy publications, revoke permits when access is removed, and prevent account-bound policy handles from regaining access after invalidation. - Provide a permit API for SDK transports without destination enforcement that denies access under restricted policies. - Let `HttpClientFactory` carry a network policy, defaulting to unmanaged access, and include policy identity in factory equality. ## Testing Add tests for secure host matching, invalidation, stale publication, recovery after policy load failure, account isolation, and SDK permit revocation. Make accepted sockets blocking in redirect test servers to handle macOS socket inheritance, and add a missing read timeout. GitOrigin-RevId: c79231527bc5e6954cda6581c0b9f43c90335755
73 lines
2.9 KiB
Rust
73 lines
2.9 KiB
Rust
mod chatgpt_cloudflare_cookies;
|
|
mod chatgpt_hosts;
|
|
mod client;
|
|
mod client_builder;
|
|
mod custom_ca;
|
|
mod error;
|
|
mod network_policy;
|
|
mod outbound_proxy;
|
|
mod request;
|
|
mod route_aware_client_pool;
|
|
mod route_aware_redirect;
|
|
mod tls_backend_fallback;
|
|
mod transport;
|
|
|
|
pub use crate::chatgpt_cloudflare_cookies::with_chatgpt_cloudflare_cookie_store;
|
|
pub use crate::chatgpt_hosts::is_allowed_chatgpt_host;
|
|
pub use crate::client::HttpClient;
|
|
pub use crate::client::HttpError;
|
|
pub use crate::client::HttpResponse;
|
|
pub use crate::client::RequestBuilder;
|
|
pub use crate::client_builder::HttpClientBuilder;
|
|
pub use crate::custom_ca::BuildCustomCaTransportError;
|
|
/// Test-only subprocess hook for custom CA coverage.
|
|
///
|
|
/// This stays public only so the `custom_ca_probe` binary target can reuse the shared helper. It
|
|
/// is hidden from normal docs because ordinary callers should use
|
|
/// [`build_reqwest_client_with_custom_ca`] instead.
|
|
#[doc(hidden)]
|
|
pub use crate::custom_ca::build_reqwest_client_for_subprocess_tests;
|
|
pub use crate::custom_ca::build_reqwest_client_with_custom_ca;
|
|
pub use crate::custom_ca::build_rustls_client_config_with_custom_ca;
|
|
pub use crate::custom_ca::maybe_build_rustls_client_config_with_custom_ca;
|
|
pub use crate::error::StreamError;
|
|
pub use crate::error::TransportError;
|
|
pub use crate::network_policy::DestinationPolicy;
|
|
pub use crate::network_policy::NetworkPermit;
|
|
pub use crate::network_policy::NetworkPolicy;
|
|
pub use crate::network_policy::NetworkPolicyController;
|
|
pub use crate::network_policy::NetworkPolicyDenied;
|
|
pub use crate::network_policy::NetworkPolicyRevision;
|
|
pub use crate::outbound_proxy::BuildRouteAwareHttpClientError;
|
|
pub use crate::outbound_proxy::ClientRouteClass;
|
|
pub use crate::outbound_proxy::HttpClientFactory;
|
|
#[cfg(target_os = "macos")]
|
|
pub use crate::outbound_proxy::MacosSystemProxyConfiguration;
|
|
pub use crate::outbound_proxy::OutboundProxyPolicy;
|
|
pub use crate::outbound_proxy::OutboundProxyRoute;
|
|
pub use crate::outbound_proxy::RouteFailureClass;
|
|
#[doc(hidden)]
|
|
pub use crate::outbound_proxy::cache_system_proxy_route_for_test;
|
|
#[cfg(target_os = "macos")]
|
|
pub use crate::outbound_proxy::macos_system_proxy_configuration;
|
|
pub use crate::request::EncodedJsonBody;
|
|
pub use crate::request::PreparedRequestBody;
|
|
pub use crate::request::Request;
|
|
pub use crate::request::RequestBody;
|
|
pub use crate::request::RequestCompression;
|
|
pub use crate::request::Response;
|
|
pub use crate::route_aware_client_pool::RouteAwareClientPool;
|
|
pub use crate::route_aware_client_pool::RouteAwareClientPoolError;
|
|
pub use crate::route_aware_client_pool::RouteAwareRequestBuilder;
|
|
pub use crate::route_aware_client_pool::RouteAwareRequestError;
|
|
pub use crate::transport::ByteStream;
|
|
pub use crate::transport::HttpTransport;
|
|
pub use crate::transport::ReqwestTransport;
|
|
pub use crate::transport::StreamResponse;
|
|
|
|
#[cfg(windows)]
|
|
mod windows_tls;
|
|
|
|
#[cfg(windows)]
|
|
pub use crate::windows_tls::build_windows_platform_tls_config;
|