PtcRunner.Kernel.MCPOAuth.NetworkPolicy (PtcRunner v0.14.0)

Copy Markdown View Source

Resolve-and-pin egress policy for MCP OAuth HTTP requests.

An endpoint must use an installed origin. Every candidate address is classified before connection; one denied address rejects the complete DNS answer. Callers race the returned addresses while preserving the original hostname and verify the connected peer against the same approved set before sending request bytes.

Summary

Types

address()

Functions

endpoint_allowed?(url, authority)

Returns whether an endpoint uses an origin installed for the authority.

peer_verifier(addresses)

Builds a connected-peer verifier for one approved DNS answer.

public_address?(address)
resolve(url, authority, opts \\ [])

Types

address()

@type address() :: :inet.ip_address()

Functions

endpoint_allowed?(url, authority)

@spec endpoint_allowed?(binary(), PtcRunner.Kernel.MCPOAuth.Authority.t()) ::
  boolean()

Returns whether an endpoint uses an origin installed for the authority.

peer_verifier(addresses)

@spec peer_verifier([address()]) :: (address() -> :ok | {:error, :peer_rejected})

Builds a connected-peer verifier for one approved DNS answer.

public_address?(address)

@spec public_address?(address()) :: boolean()

resolve(url, authority, opts \\ [])

@spec resolve(binary(), PtcRunner.Kernel.MCPOAuth.Authority.t(), keyword()) ::
  {:ok,
   %{
     addresses: [address()],
     hostname: binary(),
     port: :inet.port_number(),
     origin: binary()
   }}
  | {:error, :egress_denied | :name_not_resolved | :resolution_failed}