proxy

Documentation

Index

• Constants
• func DefaultLogPath() (string, error)
• func Inject(req *http.Request, cred string, inj Injection) error
• type AuditEvent
• type AuditLogger
  • func NewAuditLogger(dbPath string) (*AuditLogger, error)
  • func (a *AuditLogger) Close() error
  • func (a *AuditLogger) DB() *sql.DB
  • func (a *AuditLogger) Log(event AuditEvent) error
  • func (a *AuditLogger) SyncUnpushedLogs() error
• type CallRequest
• type CallResult
• type Engine
  • func NewEngine(projectID string) (*Engine, error)
  • func (e *Engine) Execute(req CallRequest) (*CallResult, error)
  • func (e *Engine) GetState() (time.Time, []string)
  • func (e *Engine) Sync()
• type ForwardResult
  • func Forward(client *http.Client, req *http.Request) (*ForwardResult, error)
• type Injection
• type SecretResolver
• type Server
  • func NewServer(port int, engine *Engine) *Server
  • func (s *Server) Start() error

Constants

const DefaultTimeout = 30 * time.Second

DefaultTimeout for outbound HTTP requests.

Functions

func DefaultLogPath

func DefaultLogPath() (string, error)

DefaultLogPath returns the default audit database path: ~/.agentsecrets/audit.db

func Inject

func Inject(req *http.Request, cred string, inj Injection) error

Inject applies a single credential injection to the outbound request. Dispatches to the appropriate injection function based on style.

Types

type AuditEvent

type AuditEvent struct {
	ID             string    `json:"id"`
	Timestamp      time.Time `json:"timestamp"`
	Environment    string    `json:"environment,omitempty"` // "development", "staging", "production"
	SecretKeys     []string  `json:"secret_keys"`           // KEY NAMES e.g. ["STRIPE_SECRET_KEY"]
	AgentID        string    `json:"agent_id,omitempty"`    // from agent identification
	IdentityLevel  string    `json:"identity_level"`        // "anonymous", "declared", "issued"
	Method         string    `json:"method"`
	TargetURL      string    `json:"target_url"`
	Domain         string    `json:"domain,omitempty"` // Target domain (e.g. "api.stripe.com")
	AuthStyles     []string  `json:"auth_styles"`      // e.g. ["bearer"]
	StatusCode     int       `json:"status_code"`
	DurationMs     int64     `json:"duration_ms"`
	Status         string    `json:"status"`           // "OK" or "BLOCKED"
	Reason         string    `json:"reason,omitempty"` // "domain_not_in_allowlist" or "-"
	Redacted       bool      `json:"redacted"`
	ResolutionPath string    `json:"resolution_path"`       // e.g. "local proxy", "cloud"
	CallerRole     string    `json:"caller_role,omitempty"` // e.g. "member"
	WorkspaceID    string    `json:"workspace_id,omitempty"`
	ProjectID      string    `json:"project_id,omitempty"`
	TokenID        string    `json:"token_id,omitempty"`
}

AuditEvent records a single proxied API call. Secret KEY NAMES are logged. Secret VALUES are NEVER logged.

type AuditLogger

type AuditLogger struct {
	APIClient *api.Client
	// contains filtered or unexported fields
}

AuditLogger writes AuditEvents to a local SQLite database and syncs them to the cloud.

func NewAuditLogger

func NewAuditLogger(dbPath string) (*AuditLogger, error)

NewAuditLogger creates an audit logger that connects to a local SQLite database.

func (*AuditLogger) Close

func (a *AuditLogger) Close() error

Close closes the underlying database connection.

func (*AuditLogger) DB

func (a *AuditLogger) DB() *sql.DB

DB returns the underlying database for querying.

func (*AuditLogger) Log

func (a *AuditLogger) Log(event AuditEvent) error

Log writes a single audit event to the SQLite database.

func (*AuditLogger) SyncUnpushedLogs

func (a *AuditLogger) SyncUnpushedLogs() error

SyncUnpushedLogs reads unsynced events from the database, pushes them to the cloud API, and marks them as synced if successful.

type CallRequest

type CallRequest struct {
	TargetURL     string            // full URL e.g. https://api.stripe.com/v1/charges
	Method        string            // GET, POST, PUT, PATCH, DELETE
	Headers       map[string]string // extra headers to forward (non-auth)
	Body          []byte            // raw request body (optional)
	Injections    []Injection       // what to inject and where
	AgentID       string            // optional, for audit logging
	IdentityLevel string            // "anonymous", "declared", "issued"
	TokenID       string            // optional token ID if issued
}

CallRequest is the input to the engine — used by both MCP and HTTP paths.

type CallResult

type CallResult struct {
	StatusCode int
	Headers    map[string][]string
	Body       []byte
}

CallResult is the output from the engine.

type Engine

type Engine struct {
	ProjectID     string
	WorkspaceID   string
	Audit         *AuditLogger
	Client        *http.Client
	ResolveSecret SecretResolver
	SkipAllowlist bool

	// Live State
	LastSync   time.Time
	RevokedIDs []string
	// contains filtered or unexported fields
}

Engine coordinates keyring lookup, injection, forwarding, and auditing.

func NewEngine

func NewEngine(projectID string) (*Engine, error)

NewEngine creates an engine wired to the real keyring for the given project.

func (*Engine) Execute

func (e *Engine) Execute(req CallRequest) (*CallResult, error)

Execute runs the full proxy pipeline: resolve secrets → inject → forward → audit.

func (*Engine) GetState

func (e *Engine) GetState() (time.Time, []string)

GetState returns the current live state of the proxy engine.

func (*Engine) Sync

func (e *Engine) Sync()

Sync triggers a manual revocation list sync.

type ForwardResult

type ForwardResult struct {
	StatusCode int
	Headers    http.Header
	Body       []byte
	Duration   time.Duration
}

ForwardResult holds the raw response from the upstream API.

func Forward

func Forward(client *http.Client, req *http.Request) (*ForwardResult, error)

Forward sends the outbound request and returns the result. The caller is responsible for building the request (URL, method, headers, body). This function reads and closes the upstream response body.

type Injection

type Injection struct {
	Style     string // "bearer", "basic", "header", "query", "body", "form"
	Target    string // header name, query param (depends on style)
	SecretKey string // keyring key name e.g. "STRIPE_SECRET_KEY"
}

Injection describes one credential to inject.

type SecretResolver

type SecretResolver func(key string) (string, error)

SecretResolver is a function that retrieves a secret value by key name. This allows the engine to be tested with a mock keyring.

type Server

type Server struct {
	Port   int
	Engine *Engine
	// contains filtered or unexported fields
}

Server is the HTTP proxy server that wraps the Engine. It listens for incoming requests with X-AS-* headers, builds CallRequests, executes them through the engine, and returns responses.

func NewServer

func NewServer(port int, engine *Engine) *Server

NewServer creates a proxy server bound to the given port and engine.

func (*Server) Start

func (s *Server) Start() error

Start begins listening and serving. This blocks until the server is stopped.