contract

Transport adapter contract primitives.

Types

AdapterError

Adapter-level errors shared by transport modules.

pub type AdapterError {
  AuthenticationFailed(String)
  ProtectionRejected(String)
  RateLimited(reason: String, retry_after_ms: Int)
  ProtocolDecodeFailed(protocol.DecodeError)
  UnsupportedClientFrame(String)
  UnsupportedClientEvent(String)
  InvalidAdapterState(String)
}

Constructors

```
AuthenticationFailed(String)
```
```
ProtectionRejected(String)
```

RateLimited(reason: String, retry_after_ms: Int)

ProtocolDecodeFailed(protocol.DecodeError)

```
UnsupportedClientFrame(String)
```
```
UnsupportedClientEvent(String)
```
```
InvalidAdapterState(String)
```

AuthContext

Connection context passed to authentication hooks.

pub type AuthContext {
  AuthContext(
    session_id: String,
    route: String,
    csrf_token: String,
    origin: String,
  )
}

Constructors

AuthContext(
  session_id: String,
  route: String,
  csrf_token: String,
  origin: String,
)

AuthHook

Authentication function wrapper used by adapters.

pub type AuthHook {
  AuthHook(run: fn(AuthContext) -> AuthResult)
}

Constructors

AuthHook(run: fn(AuthContext) -> AuthResult)

AuthResult

Authentication hook decision.

pub type AuthResult {
  Authorized(owner: String)
  Denied(reason: String)
}

Constructors

```
Authorized(owner: String)
```
```
Denied(reason: String)
```

ProtectionContext

Protection context passed to CSRF/session guard hooks.

pub type ProtectionContext {
  ProtectionContext(
    session_id: String,
    owner: String,
    route: String,
    csrf_token: String,
    origin: String,
  )
}

Constructors

ProtectionContext(
  session_id: String,
  owner: String,
  route: String,
  csrf_token: String,
  origin: String,
)

ProtectionHook

Protection hook wrapper.

pub type ProtectionHook {
  ProtectionHook(run: fn(ProtectionContext) -> ProtectionResult)
}

Constructors

ProtectionHook(run: fn(ProtectionContext) -> ProtectionResult)

ProtectionResult

Protection decision for session binding and CSRF checks.

pub type ProtectionResult {
  Protected
  Rejected(reason: String)
}

Constructors

```
Protected
```
```
Rejected(reason: String)
```

RateLimitContext

Rate-limit context passed before processing client events.

pub type RateLimitContext {
  RateLimitContext(
    session_id: String,
    owner: String,
    event_name: String,
    now_ms: Int,
  )
}

Constructors

RateLimitContext(
  session_id: String,
  owner: String,
  event_name: String,
  now_ms: Int,
)

RateLimitHook

Rate-limit hook wrapper.

pub type RateLimitHook {
  RateLimitHook(run: fn(RateLimitContext) -> RateLimitResult)
}

Constructors

RateLimitHook(run: fn(RateLimitContext) -> RateLimitResult)

RateLimitResult

Rate-limit decision.

pub type RateLimitResult {
  RateAllowed
  Limited(reason: String, retry_after_ms: Int)
}

Constructors

```
RateAllowed
```

Limited(reason: String, retry_after_ms: Int)

Values

allow_all

pub fn allow_all(owner: String) -> AuthHook

Accept every connection with the given owner id.

allow_protection

pub fn allow_protection() -> ProtectionHook

Allow every connection through protection checks.

allow_rate_limit

pub fn allow_rate_limit() -> RateLimitHook

Allow every event by rate-limit policy.

authenticate

pub fn authenticate(
  hook: AuthHook,
  context: AuthContext,
) -> AuthResult

Execute an auth hook.

deny_all

pub fn deny_all(reason: String) -> AuthHook

Reject every connection with a fixed reason.

deny_protection

pub fn deny_protection(reason: String) -> ProtectionHook

Deny every connection through protection checks.

deny_rate_limit

pub fn deny_rate_limit(
  reason: String,
  retry_after_ms: Int,
) -> RateLimitHook

Deny every event by rate-limit policy.

error_to_string

pub fn error_to_string(error: AdapterError) -> String

Stable adapter error string for logs and tests.

limit_rate

pub fn limit_rate(
  hook: RateLimitHook,
  context: RateLimitContext,
) -> RateLimitResult

Execute a rate-limit hook.

protect

pub fn protect(
  hook: ProtectionHook,
  context: ProtectionContext,
) -> ProtectionResult

Execute a protection hook.

require_csrf

pub fn require_csrf(expected_token: String) -> ProtectionHook

Require an exact CSRF token match.