feat(middleware): add a hook to inspect HTTP responses - #3074
Conversation
|
Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually. Contributors can view more details about this message here. |
e676146 to
b4aded6
Compare
b4aded6 to
cf6faa7
Compare
Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com>
cf6faa7 to
bdfa18c
Compare
|
🌿 Preview your docs: https://nvidia-preview-pr-3074.docs.buildwithfern.com/openshell |
Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com>
Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com>
Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com>
Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com>
Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com>
Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com>
|
Label |
pimlock
left a comment
There was a problem hiding this comment.
gator-agent
PR Review Status
This implementation is project-valid under accepted issue #2691, and the initial full-diff review found one blocking fail-open correctness issue. The response middleware, relay coverage, and Fern documentation otherwise align with the intended response-hook path.
Action required: update the response fallback so valid but middleware-unrepresentable responses obey each selected stage's on_error policy, then push a new head for a delta review.
Blocking findings:
GATOR-150ae32b-01: valid responses can become unconditional 502 failures even when every selected response stage isfail_open.
Carried findings:
- None
Non-blocking suggestions:
- None
Gator metadata
- Validation: Implements the accepted HTTP response middleware work in #2691 and builds on merged #3072 and #3073.
- Docs: Relevant Fern documentation and operator-facing skill guidance are updated.
- Checks: DCO and currently dispatched standard checks are green; required E2E has not run for this head.
- E2E:
test:e2eis applied, but the label-help workflow requires a maintainer to re-run all jobs after review feedback is resolved. - Head SHA:
150ae32b4293654b34ab83f71fd01c3e647490aa - Base SHA:
48c449d8c80b8ad0201d24bef5c2ece3be233580 - Merge base SHA:
48c449d8c80b8ad0201d24bef5c2ece3be233580 - Patch ID:
274606ce582cd5701da75ddda5ae6c71452240d2 - Gator payload:
8 - Review mode:
initial - Previous reviewed SHA: none
- Review budget exhausted: no
- Maintainer decision required: no
- Next state:
gator:in-review
…ence Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com>
Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com>
Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com>
|
Hey
This part has been extracted as a separate PR: #3262 |
pimlock
left a comment
There was a problem hiding this comment.
gator-agent
Re-check After Author Update
Thanks @pimlock. I checked your note that the staging fix was extracted to #3262 and reviewed the latest refactor delta in critical-only mode. PR #3262 contains the targeted Cargo target_directory lookup, and this delta introduces no new Critical findings. However, #3074 still documents and exercises CARGO_TARGET_DIR while its current merge tree stages from the hard-coded repository target/ directory, so the carried obligation remains until #3262 lands.
Action required: merge #3262 before #3074, or bring its staging fix into #3074, then update this branch so Gator can confirm the effective merge tree.
Blocking findings:
- No new Critical findings.
Carried findings:
GATOR-c6022c32-01: unresolved in #3074's current merge tree; the fix is pending in #3262.GATOR-150ae32b-01: remains resolved.
Gator metadata
- Validation: Implements accepted issue #2691 and builds on merged #3072 and #3073.
- Docs: Fern middleware documentation is present; the documented custom Cargo target path depends on #3262.
- Checks: Current-head standard checks are running; required E2E is not yet present for this head.
- E2E:
test:e2eis applied, but pipeline handoff waits for the carried obligation and current-head workflow dispatch. - Head SHA:
22a7e8ce1fba824d605ac5ff1e701e4fc452b4d9 - Base SHA:
48c449d8c80b8ad0201d24bef5c2ece3be233580 - Merge base SHA:
48c449d8c80b8ad0201d24bef5c2ece3be233580 - Patch ID:
c79d89da73e345ce0c0c9d40a608e76d9f140868 - Gator payload:
8 - Review mode:
critical_only - Previous reviewed SHA:
c6022c323158f0ff8f92757f80365aae22be885d - Review budget exhausted: yes
- Maintainer decision required: no — @pimlock selected separate PR #3262; that dependency must land before this PR.
- Next state:
gator:blocked - Blocked reason:
dependent_pr_pending
Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com>
Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com>
Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com>
pimlock
left a comment
There was a problem hiding this comment.
gator-agent
Maintainer Approval Needed
Thanks @pimlock. I verified that the staging fix you extracted to #3262 has merged and is present in this head's effective tree: staging now resolves Cargo's effective target_directory. I also reviewed the two new middleware commits in critical-only mode; they introduce no new Critical findings.
Review: no blocking findings remain. GATOR-150ae32b-01 remains resolved, and GATOR-c6022c32-01 is resolved by merged #3262.
Human maintainer approval is now required.
Gator metadata
- Validation: Implements accepted issue #2691 and builds on merged #3072 and #3073.
- Docs: Relevant Fern middleware documentation and operator guidance are present.
- Checks: Required current-head Branch Checks, Helm Lint, Trivy Changes, and E2E gates are green.
- E2E:
test:e2eis applied andOpenShell / E2Eis green. - Head SHA:
155f1d62aed843ded09365a2ee68f8580b56ccbc - Base SHA:
1860010850d3c1520d4f5d82f7c30b6a366bb747 - Merge base SHA:
1860010850d3c1520d4f5d82f7c30b6a366bb747 - Patch ID:
0f757a76cb8826cdbc771155c6aae91d9dd13aaa - Gator payload:
8 - Review mode:
critical_only - Previous reviewed SHA:
22a7e8ce1fba824d605ac5ff1e701e4fc452b4d9 - Review budget exhausted: yes
- Maintainer decision required: no
- Next state:
gator:approval-needed
Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com>
pimlock
left a comment
There was a problem hiding this comment.
gator-agent
PR Review Status
The documentation-only delta after the approval handoff removes hard wrapping without changing the published middleware contract. The critical-only review found no new Critical defects. The carried staging dependency is satisfied by merged #3262, and both prior Gator findings remain resolved.
Blocking findings:
- No blocking findings remain
Carried findings:
GATOR-150ae32b-01: remains resolved; this prose-only delta does not affect the fail-open response behavior.GATOR-c6022c32-01: remains resolved by merged #3262, whose Cargo target-directory staging fix is present in the effective tree.
Gator metadata
- Validation: Implements accepted issue #2691 and builds on merged #3072 and #3073.
- Docs: Relevant Fern middleware documentation and operator guidance are present; this delta only removes hard-wrapped prose.
- Checks: Current-head Branch Checks and E2E are running; Helm Lint and Trivy Changes are green.
- E2E:
test:e2eis applied andOpenShell / E2Eis running for this head. - Head SHA:
2d79bde84ec999d20330ffda2fd3220fd6d934c9 - Base SHA:
1860010850d3c1520d4f5d82f7c30b6a366bb747 - Merge base SHA:
1860010850d3c1520d4f5d82f7c30b6a366bb747 - Patch ID:
5f99b889d67fabfba6459dee121fe3dcee44d6a9 - Gator payload:
8 - Review mode:
critical_only - Previous reviewed SHA:
22a7e8ce1fba824d605ac5ff1e701e4fc452b4d9 - Review budget exhausted: yes
- Maintainer decision required: no
- Next state:
gator:watch-pipeline
Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com>
Summary
Let configured middleware inspect, transform, or block upstream HTTP responses before they reach the sandbox. This implements the response hook defined in #3073, including whole-body inspection that can withhold a response and streaming inspection that can stop further delivery.
State-machine walkthrough: diagrams and transition tables explain middleware channel lifetime, fail-open/fail-closed behavior,
skip_remaining, and the HTTP commitment boundary.Related Issue
Part of #2691. Builds on merged #3072 and #3073.
Changes
skip_remainingand fail-open disable only the current stage while later stages continue. A valid block stops the response regardless of failure policy.Testing
Live middleware test results and performance measurements: single-stage and mixed-mode chains, body modes and actions, measured overhead, and Content-Length fix validation.
Validation reported for the implementation:
mise run pre-commitpassed.cargo test --manifest-path examples/supervisor-middleware-content-guard/Cargo.toml --offline.mise run testandmise run ci.Checklist