Aaron D. Lee
83d827d350
X-Twilio-Signature is an HMAC over the URL as Twilio saw it; behind a TLS-terminating edge the FOB must rebuild that URL from X-Forwarded-Proto/Host — but ONLY from the operator-configured edge (CIDR list; empty default = headers IGNORED, fail-closed), or any internet peer chooses the URL its own forgery is checked against (spec §3.1 invariant 5). Scoped honestly: signature validation does not exist in the tree yet. This lands the trusted-proxy half — pure reconstruct_public_url in rutster-trunk (fail-closed Err contract, outermost-hop comma handling) with tests, the config.rs fail-fast parser, and the AppState access point — so the trunk slice consumes it instead of growing its own. New direct dep ipnet 2 (workspace-pinned; already in Cargo.lock via reqwest; MIT/Apache-2.0, cargo-deny clean). Signed-off-by: Aaron D. Lee <himself@adlee.work>
45 lines
1.7 KiB
TOML
45 lines
1.7 KiB
TOML
# crates/rutster-trunk/Cargo.toml
|
|
[package]
|
|
name = "rutster-trunk"
|
|
version = "0.0.0"
|
|
license.workspace = true
|
|
edition.workspace = true
|
|
repository.workspace = true
|
|
description = "Rented carrier transport — CPaaS media-leg ingress; no first-party SIP (spearhead step 5, ADR-0007)."
|
|
|
|
[dependencies]
|
|
# FOB-side (dev-c, T1/T3/T4/T5):
|
|
rutster-media = { path = "../rutster-media" }
|
|
rutster-call-model = { path = "../rutster-call-model" }
|
|
rutster-tap = { path = "../rutster-tap" }
|
|
tokio = { workspace = true, features = ["macros", "rt-multi-thread", "sync", "time"] }
|
|
axum = { workspace = true, features = ["ws"] }
|
|
serde = { workspace = true, features = ["derive"] }
|
|
serde_json = { workspace = true }
|
|
tracing = { workspace = true }
|
|
thiserror = { workspace = true }
|
|
base64 = { workspace = true }
|
|
|
|
# Green-zone (dev-b, T2/T6):
|
|
async-trait = { workspace = true }
|
|
url = { workspace = true }
|
|
ipnet = { workspace = true }
|
|
# reqwest is OPTIONAL — only pulled in when `twilio-live` is enabled (the
|
|
# live `TwilioCallControlClient`, T6). Keeps default CI build lean.
|
|
reqwest = { workspace = true, optional = true }
|
|
|
|
[dev-dependencies]
|
|
tower = { workspace = true }
|
|
futures-util = { workspace = true }
|
|
tokio-tungstenite = { workspace = true }
|
|
tracing-subscriber = { workspace = true }
|
|
rutster-brain-realtime = { path = "../rutster-brain-realtime", features = ["mock"] }
|
|
tokio = { workspace = true, features = ["macros", "rt-multi-thread", "sync", "time", "net"] }
|
|
|
|
[features]
|
|
default = []
|
|
# The live `TwilioCallControlClient` (T6) is feature-gated behind `twilio-live`.
|
|
# `MockCallControlClient` is the per-PR test surface; the maintainer runs
|
|
# `cargo test --features=twilio-live` manually pre-release (ADR-0009).
|
|
twilio-live = ["dep:reqwest"]
|