GithubBackup/MoviePilot
1
0
Fork 0
mirror of https://github.com/jxxghp/MoviePilot.git synced 2026-09-06 16:07:01 +08:00
Code Issues Packages Projects Releases Wiki Activity

test(architecture): govern direct egress

Browse Source
This commit is contained in:
jxxghp
2026-08-27 07:28:42 +08:00
parent 3b7f8c357d
commit 47f0de745c
19 changed files with 3598 additions and 38 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/rules/09-external-response.md
+11 -3
View File
@@ -2,11 +2,19 @@
## HTTP Client Conventions
**Rule:** Host outbound HTTP transport implementations must go through `RequestUtils` from
**Rule:** Host-authored ordinary outbound HTTP must go through `RequestUtils` from
`app/adapters/network/http.py`. This transport rule does not authorize Application or Chain to
import the concrete Adapter; they own/use a Port and receive its implementation from startup.
Plugins import the curated facade from `app.sdk.network`. Do not use `requests`, `httpx`, or
`aiohttp` directly outside a separately reviewed SDK, streaming, or vendored transport boundary.
Plugins import the curated facade from `app.sdk.network`.
Direct `requests`/`httpx` clients, SDK transports, product streaming protocols, contained vendor
code, diagnostics and control-plane access are governed by the exact `direct_egress` facts and
manual policy. An approved fingerprint is containment for that exact source/binding/use identity
only; `owner: "$source"` names that source module and does not authorize another caller or
operation. New SDK roots must be added to the registry and receive explicit policy review.
Ordinary direct HTTP, RequestUtils Session bridges and Application-owned DNS I/O remain
`temporary_debt` with an empty target state. Runtime wildcard imports from registered egress roots
are forbidden.
`RequestUtils` handles:
- Proxy configuration (from `settings.PROXY_*`)