Enforce outbound policy at each HTTP connection

crates/remora-outbound/src/lib.rs

@@ -0,0 +1,35 @@
+mod policy;
+mod resolver;
+mod transport;
+mod url;
+
+pub use policy::{AllowedEndpoint, OutboundPolicy, OutboundPolicyBuilder};
+pub use resolver::{Resolver, SystemResolver};
+pub use transport::{OutboundClient, OutboundClientBuilder, OutboundRequest, OutboundResponse};
+pub use url::{CanonicalUrl, Origin};
+
+use thiserror::Error;
+
+#[derive(Clone, Copy, Debug, Eq, Error, PartialEq)]
+pub enum OutboundError {
+    #[error("outbound URL is invalid")]
+    InvalidUrl,
+    #[error("outbound scheme and port are denied")]
+    SchemePortDenied,
+    #[error("outbound name resolution failed")]
+    ResolutionFailed,
+    #[error("outbound name resolution returned no addresses")]
+    EmptyResolution,
+    #[error("outbound name resolution contains a denied address")]
+    AddressDenied,
+    #[error("outbound request headers are invalid")]
+    InvalidHeaders,
+    #[error("outbound redirect is invalid")]
+    InvalidRedirect,
+    #[error("outbound redirect limit exceeded")]
+    RedirectLimit,
+    #[error("outbound HTTPS downgrade is denied")]
+    HttpsDowngrade,
+    #[error("outbound transport failed")]
+    Transport,
+}