Intercept and authorize wasi:http calls

.github/workflows/ci.yaml

@@ -19,6 +19,10 @@ jobs:
         uses: cargo-bins/cargo-binstall@main
       - name: Install wasmtime
         run: cargo binstall --force wasmtime-cli
+      - name: Install static-config
+        run: cargo binstall --force static-config
+      - name: Install wac
+        run: cargo binstall --force wac-cli
       - name: Install wkg
         run: cargo binstall --force wkg
       - name: Install wasm-tools

Cargo.toml

@@ -2,12 +2,15 @@
 resolver = "2"
 members = [
     "components/*",
+    "crates/*",
 ]
 exclude = [
+    "components/gate",
+    "components/latch-method-readonly",
+    "components/latch-method-readonly-config",
     "components/wit",
 ]
 
 [workspace.dependencies]
-serde = { version = "1.0", features = ["derive"] }
-serde_json = "1.0"
+latch-n = { path = "./crates/latch-n" }
 wit-bindgen = "0.61.0"

Makefile

@@ -3,7 +3,10 @@ SHELL := /bin/bash
 export RUST_BACKTRACE ?= 1
 export WASMTIME_BACKTRACE_DETAILS ?= 1
 
-COMPONENTS = $(sort $(notdir $(patsubst %/,%,$(dir $(wildcard  components/*/Cargo.toml)))))
+CARGO_COMPONENTS = $(sort $(notdir $(patsubst %/,%,$(dir $(wildcard  components/*/Cargo.toml)))))
+CONFIG_COMPONENTS = $(sort $(notdir $(patsubst %/,%,$(dir $(wildcard  components/*/*.properties)))))
+WAC_COMPONENTS = $(sort $(notdir $(patsubst %/,%,$(dir $(wildcard  components/*/*.wac)))))
+COMPONENTS = $(CARGO_COMPONENTS) $(CONFIG_COMPONENTS) $(WAC_COMPONENTS)
 
 .PHONY: all
 all: components
@@ -19,13 +22,15 @@ test:
 	@echo "TODO add tests"
 
 .PHONY: components
-components: lib/interface.wasm $(foreach component,$(COMPONENTS),lib/$(component).wasm $(foreach component,$(COMPONENTS),lib/$(component).debug.wasm))
+components: lib/interface.wasm $(foreach component,$(COMPONENTS),lib/$(component).wasm) $(foreach component,$(COMPONENTS),lib/$(component).debug.wasm)
 
 define BUILD_COMPONENT
 
 .PHONY: components/$1
 components/$1: lib/$1.wasm lib/$1.debug.wasm
 
+ifneq ($(wildcard components/$1/Cargo.toml),)
+
 lib/$1.wasm: Cargo.toml Cargo.lock components/wit/deps $(shell find components/$1 -type f)
 	cargo build -p $1 --target wasm32-unknown-unknown --release
 	wasm-tools component new target/wasm32-unknown-unknown/release/$(subst -,_,$1).wasm -o lib/$1.wasm
@@ -36,6 +41,28 @@ lib/$1.debug.wasm: Cargo.toml Cargo.lock components/wit/deps $(shell find compon
 	wasm-tools component new target/wasm32-unknown-unknown/debug/$(subst -,_,$1).wasm -o lib/$1.debug.wasm
 	cp components/$1/README.md lib/$1.debug.wasm.md
 
+else ifneq ($(wildcard components/$1/$1.properties),)
+
+lib/$1.wasm: components/$1/$1.properties components/$1/README.md
+	static-config -f components/$1/$1.properties -o lib/$1.wasm
+	cp components/$1/README.md lib/$1.wasm.md
+
+lib/$1.debug.wasm: components/$1/$1.properties components/$1/README.md
+	static-config -f components/$1/$1.properties -o lib/$1.debug.wasm
+	cp components/$1/README.md lib/$1.debug.wasm.md
+
+else ifneq ($(wildcard components/$1/$1.wac),)
+
+lib/$1.wasm: components/$1/$1.wac components/$1/README.md $(foreach component,$(CARGO_COMPONENTS),lib/$(component).wasm) $(foreach component,$(CONFIG_COMPONENTS),lib/$(component).wasm)
+	wac compose $(foreach component,$(COMPONENTS),-d local:$(component)=lib/$(component).wasm) -o lib/$1.wasm components/$1/$1.wac
+	cp components/$1/README.md lib/$1.wasm.md
+
+lib/$1.debug.wasm: components/$1/$1.wac components/$1/README.md $(foreach component,$(CARGO_COMPONENTS),lib/$(component).debug.wasm) $(foreach component,$(CONFIG_COMPONENTS),lib/$(component).debug.wasm)
+	wac compose $(foreach component,$(COMPONENTS),-d local:$(component)=lib/$(component).debug.wasm) -o lib/$1.debug.wasm components/$1/$1.wac
+	cp components/$1/README.md lib/$1.debug.wasm.md
+
+endif
+
 endef
 
 $(foreach component,$(COMPONENTS),$(eval $(call BUILD_COMPONENT,$(component))))

README.md

@@ -20,14 +20,28 @@ Prereqs:
 - a rust toolchain
 - [`wasm-tools`](https://github.com/bytecodealliance/wasm-tools)
 - [`wkg`](https://github.com/bytecodealliance/wasm-pkg-tools)
+- [`wac`](https://github.com/bytecodealliance/wac)
+- [`static-config`](https://github.com/componentized/static-config/)
 
 ```sh
 make components
 ```
 
 ### Components
 
+- [`gate`](./components/gate/)
+- [`gate-client`](./components/gate-client/)
+- [`gate-handler`](./components/gate-handler/)
 - [`http-client`](./components/http-client/)
+- [`latch-abstain-all`](./components/latch-abstain-all/)
+- [`latch-deny-all`](./components/latch-deny-all/)
+- [`latch-method`](./components/latch-method/)
+- [`latch-method-readonly`](./components/latch-method-readonly/)
+- [`latch-method-readonly-config`](./components/latch-method-readonly-config/)
+- [`latch-n2`](./components/latch-n2/)
+- [`latch-n3`](./components/latch-n3/)
+- [`latch-n4`](./components/latch-n4/)
+- [`latch-n5`](./components/latch-n5/)
 
 ## Community
 

components/gate-client/Cargo.toml

@@ -0,0 +1,11 @@
+[package]
+name = "gate-client"
+version = "0.1.0"
+edition = "2021"
+license = "Apache-2.0"
+
+[lib]
+crate-type = ["cdylib"]
+
+[dependencies]
+wit-bindgen = { workspace = true }

components/gate-client/README.md

@@ -0,0 +1,9 @@
+# `gate-client`
+
+HTTP client gate access control.
+
+## The `gate-client` World
+
+- exports `wasi:http/client@0.3`
+- imports `componentized:http/latch`
+- imports `wasi:http/client@0.3`

components/gate-client/src/lib.rs

@@ -0,0 +1,92 @@
+#![no_main]
+
+use std::fmt::Display;
+
+use crate::{
+    componentized::http::latch::{
+        self, authorize, ClientOperation,
+        Decision::{Abstained, Denied},
+        Operation, SendArgs,
+    },
+    exports::wasi::http::client::{ErrorCode, Guest, Request, Response},
+    wasi::{
+        http::{client, types},
+        logging::logging::{log, Level},
+    },
+};
+
+macro_rules! warn {
+    ($dst:expr, $($arg:tt)*) => {
+        log(Level::Warn, "componentized-gate", &format!($dst, $($arg)*));
+    };
+    ($dst:expr) => {
+        log(Level::Warn, "componentized-gate", &format!($dst));
+    };
+}
+
+struct GatedHttpClient {}
+
+impl Guest for GatedHttpClient {
+    #[doc = "/ This function may be used to either send an outgoing request over the"]
+    #[doc = "/ network or to forward it to another component."]
+    #[allow(async_fn_in_trait)]
+    async fn send(request: Request) -> Result<Response, ErrorCode> {
+        match authorize(&Operation::Client(ClientOperation::Send(SendArgs {
+            request: &request,
+        })))? {
+            Denied(reason) => {
+                warn!(
+                    "Denied REASON={reason} OPERATION=wasi:http/client#send METHOD={} PATH={}",
+                    request.get_method(),
+                    request.get_path_with_query().unwrap_or("/".to_string())
+                );
+                Err(reason)
+            }
+            Abstained => client::send(request).await,
+        }
+    }
+}
+
+impl Display for types::Request {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        let method = self.get_method();
+        let url = self.get_path_with_query().unwrap_or("/".to_string());
+        f.write_fmt(format_args!("{method} {url}"))
+    }
+}
+
+impl Display for types::Method {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        let method = match self {
+            types::Method::Get => "GET",
+            types::Method::Head => "HEAD",
+            types::Method::Post => "POST",
+            types::Method::Put => "PUT",
+            types::Method::Delete => "DELETE",
+            types::Method::Connect => "CONNECT",
+            types::Method::Options => "OPTIONS",
+            types::Method::Trace => "TRACE",
+            types::Method::Patch => "PATCH",
+            types::Method::Other(method) => &method.to_uppercase(),
+        };
+        f.write_str(method)
+    }
+}
+
+impl From<latch::ErrorCode> for ErrorCode {
+    fn from(value: latch::ErrorCode) -> Self {
+        match value {
+            latch::ErrorCode::Http(error_code) => error_code,
+            latch::ErrorCode::Other(error_code) => Self::InternalError(error_code),
+        }
+    }
+}
+
+wit_bindgen::generate!({
+    path: "../wit",
+    world: "gate-client",
+    merge_structurally_equal_types: true,
+    generate_all
+});
+
+export!(GatedHttpClient);

components/gate-handler/Cargo.toml

@@ -0,0 +1,11 @@
+[package]
+name = "gate-handler"
+version = "0.1.0"
+edition = "2021"
+license = "Apache-2.0"
+
+[lib]
+crate-type = ["cdylib"]
+
+[dependencies]
+wit-bindgen = { workspace = true }

components/gate-handler/README.md

@@ -0,0 +1,9 @@
+# `gate-handler`
+
+HTTP handler gate access control.
+
+## The `gate-handler` World
+
+- exports `wasi:http/hander@0.3`
+- imports `componentized:http/latch`
+- imports `wasi:http/hander@0.3`