Module address 

The one list of address blocks this workspace will not fetch from, and the resolution that enforces it.

Every outbound GET aimed by something this process did not write – a client_id a stranger posted, an OIDC issuer a token names, the service endpoint inside a DID document – is a request this server makes into whatever network it is deployed in, aimed by somebody else. Resolving the host first and refusing the whole set unless every address is public is what keeps that from reaching this deployment’s own network.

Enums

AddressError

Why an address check did not let a fetch proceed.

PrivateAddresses

Whether a caller accepts a host that resolves into REFUSED_BLOCKS.

Constants

REFUSED_BLOCKS

The address blocks an outbound fetch is refused for.

Statics

REFUSED 🔒

REFUSED_BLOCKS, parsed once.

Functions

is_loopback

Whether url names this machine and nowhere else.

is_public_address

Whether an outbound fetch may reach address: true unless it falls in REFUSED_BLOCKS.

pinned_client

A client for url: its host resolved once through resolve_public, pinned to what it resolved to so the connection cannot land elsewhere, and following no redirect, which would land it elsewhere all the same.

refuse_private_host

resolve_public for a caller holding its URL as text, when nothing past the refusal is wanted.

resolve_public

Every address url’s host answers to, refused unless every one of them is public.