adk_openapi_gun_transport (erlang_adk v0.8.0)

Production bounded OpenAPI HTTP transport backed by Gun.

The hostname is allow-listed before lookup, every resolved address is checked against the private/link-local policy, and Gun connects to the selected IP address directly. HTTPS keeps the original DNS name for SNI, hostname verification, and the Host header, avoiding a DNS-rebinding window between validation and connect. Responses are accumulated only up to the caller-supplied limit and redirects are never followed.

Summary

Functions

is_public_address(_)

Return whether an already parsed IP address is globally routable.

request(Handle, Request)

resolve_host(Host, AllowPrivate, Timeout)

Resolve a host inside a bounded, monitored worker and return one address only after every answer satisfies the private-address policy. Callers connect to this returned address while retaining the original host for TLS SNI, hostname verification, and the Host header.

Functions

is_public_address(_)

-spec is_public_address(inet:ip_address()) -> boolean().

Return whether an already parsed IP address is globally routable.

This is shared by other outbound transports so the repository has one fail-closed classification policy for OpenAPI tools, model APIs and OTLP. Hostname resolution and connect-to-the-validated-address are still the caller's responsibility.

request(Handle, Request)

-spec request(adk_openapi_http_transport:handle(), adk_openapi_http_transport:request()) ->
                 {ok, adk_openapi_http_transport:response()} | {error, term()}.

resolve_host(Host, AllowPrivate, Timeout)

-spec resolve_host(binary(), boolean(), pos_integer()) ->
                      {ok, inet:ip_address()} |
                      {error, timeout | dns_resolution_failed | private_address_rejected}.