prisma-risk / tsoracle / 26272116796

95%

push

github

fix(client): reject plaintext leader-hint under tls_config (#108)

Closes a downgrade gap where a TLS-configured client could be redirected
onto an `http://` endpoint by a `tsoracle-leader-hint-bin` trailer from
a contacted peer. The retry loop now drops such hints when the client
was built with `ClientBuilder::tls_config`, while operator-supplied
`http://` entries in `endpoints` are still honored ("explicit beats
configured" remains true for caller-controlled config).

The filter lives in `retry::issue_rpc`, scoped to wire input, so the
TLS-aware connector stays a pure URI→Channel function. A
`channel_connector` closure replaces the policy entirely and is
responsible for whatever scheme rule it wants to enforce; calling
`channel_connector` after `tls_config` clears the flag accordingly.

Integration test in `client_tls.rs` boots a real plaintext leader plus
a TLS follower that hints `http://<plaintext-leader>`; the client must
refuse the redirect and surface `FAILED_PRECONDITION` instead of
dialing plaintext. Scheme matrix and leader-hint subsystem docs updated
to reflect the new wire-input rule.

43 of 49 new or added lines in 3 files covered. (87.76%)

6503 of 6757 relevant lines covered (96.24%)

81769.07 hits per line