feat: http.request v0.1.0 — generic HTTP client

First release. Pure-WASM HTTP client built on waki 0.5 for
F∆I flow steps that need to call REST APIs.

Capability: http.request@0.1.0

Inputs: method (GET/POST/PUT/PATCH/DELETE/HEAD/OPTIONS),
url, headers (JSON object string), body (UTF-8).

Outputs: status (decimal text), headers (JSON object), body
(UTF-8 lossy).

Permissions: net: *. The wildcard is deliberate — operators
clamp to specific hosts via their operator-policy ceiling.

6 unit tests on the headers-input parser (empty / strings /
numbers coerced / non-object rejected / nested rejected /
malformed JSON rejected).

Bundle: target/wasm32-wasip2/release/http_request.wasm
(~120 KiB stripped).

v0.2.0 candidates: http.request-bytes for binary payloads,
per-request timeout / retry inputs, cookie-jar.

Signed-off-by: flemming-it <sf@flemming.it>
This commit is contained in:
flemming-it 2026-05-25 14:16:09 +02:00
commit 4681d0bb2c
8 changed files with 1194 additions and 0 deletions

4
.gitignore vendored Normal file
View file

@ -0,0 +1,4 @@
target/
**/*.rs.bk
.DS_Store
module.wasm

637
Cargo.lock generated Normal file
View file

@ -0,0 +1,637 @@
# This file is automatically @generated by Cargo.
# It is not intended for manual editing.
version = 4
[[package]]
name = "ahash"
version = "0.8.12"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "5a15f179cd60c4584b8a8c596927aadc462e27f2ca70c04e0071964a73ba7a75"
dependencies = [
"cfg-if",
"once_cell",
"version_check",
"zerocopy",
]
[[package]]
name = "anyhow"
version = "1.0.102"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "7f202df86484c868dbad7eaa557ef785d5c66295e41b460ef922eca0723b842c"
[[package]]
name = "bitflags"
version = "2.11.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "c4512299f36f043ab09a583e57bceb5a5aab7a73db1805848e8fef3c9e8c78b3"
[[package]]
name = "bytes"
version = "1.11.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "1e748733b7cbc798e1434b6ac524f0c1ff2ab456fe201501e6497c8417a4fc33"
[[package]]
name = "cfg-if"
version = "1.0.4"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
[[package]]
name = "equivalent"
version = "1.0.2"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
[[package]]
name = "fai-module-sdk"
version = "0.1.2"
source = "git+https://git.flemming.ai/fai/module-sdk.git?branch=main#f209fbc86f531b53e576f3cdbdf75750eef3b07a"
dependencies = [
"fai-module-sdk-macros",
"serde",
"serde_json",
"thiserror",
"wit-bindgen 0.36.0",
]
[[package]]
name = "fai-module-sdk-macros"
version = "0.1.2"
source = "git+https://git.flemming.ai/fai/module-sdk.git?branch=main#f209fbc86f531b53e576f3cdbdf75750eef3b07a"
dependencies = [
"proc-macro2",
"quote",
"syn",
]
[[package]]
name = "form_urlencoded"
version = "1.2.2"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "cb4cb245038516f5f85277875cdaa4f7d2c9a0fa0468de06ed190163b1581fcf"
dependencies = [
"percent-encoding",
]
[[package]]
name = "hashbrown"
version = "0.14.5"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "e5274423e17b7c9fc20b6e7e208532f9b19825d82dfd615708b70edd83df41f1"
dependencies = [
"ahash",
]
[[package]]
name = "hashbrown"
version = "0.17.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "ed5909b6e89a2db4456e54cd5f673791d7eca6732202bbf2a9cc504fe2f9b84a"
[[package]]
name = "heck"
version = "0.5.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
[[package]]
name = "http"
version = "1.4.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "e3ba2a386d7f85a81f119ad7498ebe444d2e22c2af0b86b069416ace48b3311a"
dependencies = [
"bytes",
"itoa",
]
[[package]]
name = "http_request"
version = "0.1.0"
dependencies = [
"fai-module-sdk",
"serde",
"serde_json",
"waki",
]
[[package]]
name = "id-arena"
version = "2.3.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "3d3067d79b975e8844ca9eb072e16b31c3c1c36928edf9c6789548c524d0d954"
[[package]]
name = "indexmap"
version = "2.14.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "d466e9454f08e4a911e14806c24e16fba1b4c121d1ea474396f396069cf949d9"
dependencies = [
"equivalent",
"hashbrown 0.17.1",
"serde",
"serde_core",
]
[[package]]
name = "itoa"
version = "1.0.18"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
[[package]]
name = "leb128"
version = "0.2.6"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "6cc46bac87ef8093eed6f272babb833b6443374399985ac8ed28471ee0918545"
[[package]]
name = "log"
version = "0.4.30"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "616ec5685824bcc94416c6d4a7a446eea774a31efd7062c8480ba6fd06d7a6e5"
[[package]]
name = "memchr"
version = "2.8.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "f8ca58f447f06ed17d5fc4043ce1b10dd205e060fb3ce5b979b8ed8e59ff3f79"
[[package]]
name = "once_cell"
version = "1.21.4"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"
[[package]]
name = "percent-encoding"
version = "2.3.2"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"
[[package]]
name = "prettyplease"
version = "0.2.37"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "479ca8adacdd7ce8f1fb39ce9ecccbfe93a3f1344b3d0d97f20bc0196208f62b"
dependencies = [
"proc-macro2",
"syn",
]
[[package]]
name = "proc-macro2"
version = "1.0.106"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "8fd00f0bb2e90d81d1044c2b32617f68fcb9fa3bb7640c23e9c748e53fb30934"
dependencies = [
"unicode-ident",
]
[[package]]
name = "quote"
version = "1.0.45"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "41f2619966050689382d2b44f664f4bc593e129785a36d6ee376ddf37259b924"
dependencies = [
"proc-macro2",
]
[[package]]
name = "semver"
version = "1.0.28"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "8a7852d02fc848982e0c167ef163aaff9cd91dc640ba85e263cb1ce46fae51cd"
[[package]]
name = "serde"
version = "1.0.228"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "9a8e94ea7f378bd32cbbd37198a4a91436180c5bb472411e48b5ec2e2124ae9e"
dependencies = [
"serde_core",
"serde_derive",
]
[[package]]
name = "serde_core"
version = "1.0.228"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "41d385c7d4ca58e59fc732af25c3983b67ac852c1a25000afe1175de458b67ad"
dependencies = [
"serde_derive",
]
[[package]]
name = "serde_derive"
version = "1.0.228"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79"
dependencies = [
"proc-macro2",
"quote",
"syn",
]
[[package]]
name = "serde_json"
version = "1.0.150"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "e8014e44b4736ed0538adeecded0fce2a272f22dc9578a7eb6b2d9993c74cfb9"
dependencies = [
"itoa",
"memchr",
"serde",
"serde_core",
"zmij",
]
[[package]]
name = "smallvec"
version = "1.15.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "67b1b7a3b5fe4f1376887184045fcf45c69e92af734b7aaddc05fb777b6fbd03"
[[package]]
name = "spdx"
version = "0.10.9"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "c3e17e880bafaeb362a7b751ec46bdc5b61445a188f80e0606e68167cd540fa3"
dependencies = [
"smallvec",
]
[[package]]
name = "syn"
version = "2.0.117"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "e665b8803e7b1d2a727f4023456bbbbe74da67099c585258af0ad9c5013b9b99"
dependencies = [
"proc-macro2",
"quote",
"unicode-ident",
]
[[package]]
name = "thiserror"
version = "2.0.18"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "4288b5bcbc7920c07a1149a35cf9590a2aa808e0bc1eafaade0b80947865fbc4"
dependencies = [
"thiserror-impl",
]
[[package]]
name = "thiserror-impl"
version = "2.0.18"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "ebc4ee7f67670e9b64d05fa4253e753e016c6c95ff35b89b7941d6b856dec1d5"
dependencies = [
"proc-macro2",
"quote",
"syn",
]
[[package]]
name = "unicode-ident"
version = "1.0.24"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
[[package]]
name = "unicode-xid"
version = "0.2.6"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "ebc1c04c71510c7f702b52b7c350734c9ff1295c464a03335b00bb84fc54f853"
[[package]]
name = "version_check"
version = "0.9.5"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
[[package]]
name = "waki"
version = "0.5.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "6e2db2daf1dfbadf228fd8b3c22b96a359135fd673b3d2c203274ee6a0df9c77"
dependencies = [
"anyhow",
"form_urlencoded",
"http",
"serde",
"waki-macros",
"wit-bindgen 0.34.0",
]
[[package]]
name = "waki-macros"
version = "0.5.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "a061143f321cc5eeb523f60bdbcd45cfc3ee8851f8cf24f7a4b963bddc5642eb"
dependencies = [
"proc-macro2",
"quote",
"syn",
]
[[package]]
name = "wasm-encoder"
version = "0.219.2"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "8aa79bcd666a043b58f5fa62b221b0b914dd901e6f620e8ab7371057a797f3e1"
dependencies = [
"leb128",
"wasmparser 0.219.2",
]
[[package]]
name = "wasm-encoder"
version = "0.220.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "e913f9242315ca39eff82aee0e19ee7a372155717ff0eb082c741e435ce25ed1"
dependencies = [
"leb128",
"wasmparser 0.220.1",
]
[[package]]
name = "wasm-metadata"
version = "0.219.2"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "b1ef51bd442042a2a7b562dddb6016ead52c4abab254c376dcffc83add2c9c34"
dependencies = [
"anyhow",
"indexmap",
"serde",
"serde_derive",
"serde_json",
"spdx",
"wasm-encoder 0.219.2",
"wasmparser 0.219.2",
]
[[package]]
name = "wasm-metadata"
version = "0.220.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "185dfcd27fa5db2e6a23906b54c28199935f71d9a27a1a27b3a88d6fee2afae7"
dependencies = [
"anyhow",
"indexmap",
"serde",
"serde_derive",
"serde_json",
"spdx",
"wasm-encoder 0.220.1",
"wasmparser 0.220.1",
]
[[package]]
name = "wasmparser"
version = "0.219.2"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "5220ee4c6ffcc0cb9d7c47398052203bc902c8ef3985b0c8134118440c0b2921"
dependencies = [
"ahash",
"bitflags",
"hashbrown 0.14.5",
"indexmap",
"semver",
]
[[package]]
name = "wasmparser"
version = "0.220.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "8d07b6a3b550fefa1a914b6d54fc175dd11c3392da11eee604e6ffc759805d25"
dependencies = [
"ahash",
"bitflags",
"hashbrown 0.14.5",
"indexmap",
"semver",
]
[[package]]
name = "wit-bindgen"
version = "0.34.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "7e11ad55616555605a60a8b2d1d89e006c2076f46c465c892cc2c153b20d4b30"
dependencies = [
"wit-bindgen-rt 0.34.0",
"wit-bindgen-rust-macro 0.34.0",
]
[[package]]
name = "wit-bindgen"
version = "0.36.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "6a2b3e15cd6068f233926e7d8c7c588b2ec4fb7cc7bf3824115e7c7e2a8485a3"
dependencies = [
"wit-bindgen-rt 0.36.0",
"wit-bindgen-rust-macro 0.36.0",
]
[[package]]
name = "wit-bindgen-core"
version = "0.34.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "163cee59d3d5ceec0b256735f3ab0dccac434afb0ec38c406276de9c5a11e906"
dependencies = [
"anyhow",
"heck",
"wit-parser 0.219.2",
]
[[package]]
name = "wit-bindgen-core"
version = "0.36.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "b632a5a0fa2409489bd49c9e6d99fcc61bb3d4ce9d1907d44662e75a28c71172"
dependencies = [
"anyhow",
"heck",
"wit-parser 0.220.1",
]
[[package]]
name = "wit-bindgen-rt"
version = "0.34.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "744845cde309b8fa32408d6fb67456449278c66ea4dcd96de29797b302721f02"
dependencies = [
"bitflags",
]
[[package]]
name = "wit-bindgen-rt"
version = "0.36.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "7947d0131c7c9da3f01dfde0ab8bd4c4cf3c5bd49b6dba0ae640f1fa752572ea"
dependencies = [
"bitflags",
]
[[package]]
name = "wit-bindgen-rust"
version = "0.34.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "f6919521fc7807f927a739181db93100ca7ed03c29509b84d5f96b27b2e49a9a"
dependencies = [
"anyhow",
"heck",
"indexmap",
"prettyplease",
"syn",
"wasm-metadata 0.219.2",
"wit-bindgen-core 0.34.0",
"wit-component 0.219.2",
]
[[package]]
name = "wit-bindgen-rust"
version = "0.36.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "4329de4186ee30e2ef30a0533f9b3c123c019a237a7c82d692807bf1b3ee2697"
dependencies = [
"anyhow",
"heck",
"indexmap",
"prettyplease",
"syn",
"wasm-metadata 0.220.1",
"wit-bindgen-core 0.36.0",
"wit-component 0.220.1",
]
[[package]]
name = "wit-bindgen-rust-macro"
version = "0.34.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "c967731fc5d50244d7241ecfc9302a8929db508eea3c601fbc5371b196ba38a5"
dependencies = [
"anyhow",
"prettyplease",
"proc-macro2",
"quote",
"syn",
"wit-bindgen-core 0.34.0",
"wit-bindgen-rust 0.34.0",
]
[[package]]
name = "wit-bindgen-rust-macro"
version = "0.36.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "177fb7ee1484d113b4792cc480b1ba57664bbc951b42a4beebe573502135b1fc"
dependencies = [
"anyhow",
"prettyplease",
"proc-macro2",
"quote",
"syn",
"wit-bindgen-core 0.36.0",
"wit-bindgen-rust 0.36.0",
]
[[package]]
name = "wit-component"
version = "0.219.2"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "4b8479a29d81c063264c3ab89d496787ef78f8345317a2dcf6dece0f129e5fcd"
dependencies = [
"anyhow",
"bitflags",
"indexmap",
"log",
"serde",
"serde_derive",
"serde_json",
"wasm-encoder 0.219.2",
"wasm-metadata 0.219.2",
"wasmparser 0.219.2",
"wit-parser 0.219.2",
]
[[package]]
name = "wit-component"
version = "0.220.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "b505603761ed400c90ed30261f44a768317348e49f1864e82ecdc3b2744e5627"
dependencies = [
"anyhow",
"bitflags",
"indexmap",
"log",
"serde",
"serde_derive",
"serde_json",
"wasm-encoder 0.220.1",
"wasm-metadata 0.220.1",
"wasmparser 0.220.1",
"wit-parser 0.220.1",
]
[[package]]
name = "wit-parser"
version = "0.219.2"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "ca004bb251010fe956f4a5b9d4bf86b4e415064160dd6669569939e8cbf2504f"
dependencies = [
"anyhow",
"id-arena",
"indexmap",
"log",
"semver",
"serde",
"serde_derive",
"serde_json",
"unicode-xid",
"wasmparser 0.219.2",
]
[[package]]
name = "wit-parser"
version = "0.220.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "ae2a7999ed18efe59be8de2db9cb2b7f84d88b27818c79353dfc53131840fe1a"
dependencies = [
"anyhow",
"id-arena",
"indexmap",
"log",
"semver",
"serde",
"serde_derive",
"serde_json",
"unicode-xid",
"wasmparser 0.220.1",
]
[[package]]
name = "zerocopy"
version = "0.8.48"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "eed437bf9d6692032087e337407a86f04cd8d6a16a37199ed57949d415bd68e9"
dependencies = [
"zerocopy-derive",
]
[[package]]
name = "zerocopy-derive"
version = "0.8.48"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "70e3cd084b1788766f53af483dd21f93881ff30d7320490ec3ef7526d203bad4"
dependencies = [
"proc-macro2",
"quote",
"syn",
]
[[package]]
name = "zmij"
version = "1.0.21"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "b8848ee67ecc8aedbaf3e4122217aff892639231befc6a1b58d29fff4c2cabaa"

38
Cargo.toml Normal file
View file

@ -0,0 +1,38 @@
# Standalone Cargo.toml — targets wasm32-wasip2.
#
# Build with:
# cargo build --release --target wasm32-wasip2
[package]
name = "http_request"
version = "0.1.0"
edition = "2024"
authors = ["Dr. Stefan Flemming <platform@flemming.ai>"]
license = "Apache-2.0"
publish = false
description = "F∆I module — generic HTTP client (GET/POST/PUT/PATCH/DELETE/HEAD/OPTIONS)"
repository = "https://git.flemming.ai/fai-modules/http-request"
rust-version = "1.85"
[lib]
crate-type = ["cdylib", "rlib"]
[dependencies]
fai-module-sdk = { git = "https://git.flemming.ai/fai/module-sdk.git", branch = "main" }
serde = { version = "1", features = ["derive"] }
serde_json = "1"
# WASI-0.2 HTTP client — same one llm-chat / text-translate use.
# Only compiled into the wasm32-wasip2 build; the rlib target
# we don't actually link against on the host doesn't need it.
[target.'cfg(target_arch = "wasm32")'.dependencies]
waki = "0.5"
[dev-dependencies]
serde_json = "1"
[profile.release]
opt-level = "s"
lto = true
codegen-units = 1
strip = true

96
MODULE.de.md Normal file
View file

@ -0,0 +1,96 @@
# http.request
Generischer HTTP-Client für Flow-Steps. GET / POST / PUT /
PATCH / DELETE / HEAD / OPTIONS mit beliebigen Headern und
einem UTF-8-Body. Die audit-freundliche Alternative zu Flows,
die ihren eigenen HTTP-Client mitbringen.
## Capability
- `http.request@0.1.0`
## Eingaben
| Name | Typ | Beschreibung |
| --------- | ---- | ---------------------------------------------------------------------------------- |
| `method` | text | HTTP-Verb in Großbuchstaben (`GET`, `POST`, `PUT`, `PATCH`, `DELETE`, `HEAD`, `OPTIONS`). |
| `url` | text | Vollständige URL inklusive Scheme. |
| `headers` | text | Optional. JSON-Objekt-String mit zusätzlichen Headern. Leer = keine. |
| `body` | text | Optional. UTF-8-Request-Body. Leer = kein Body. |
Beispiel-`headers`:
```json
{"Accept":"application/json","X-Tenant":"acme","Content-Length":42}
```
String-, Zahl- und Boolean-Werte werden akzeptiert (Zahlen und
Booleans werden zu Strings koerziert). Verschachtelte
Arrays/Objekte werden beim Parsen mit einem klaren Fehler
abgelehnt.
## Ausgaben
| Name | Typ | Beschreibung |
| --------- | ---- | ------------------------------------------------------------------ |
| `status` | text | Dezimal-Statuscode als Text (z.B. `"200"`, `"404"`). |
| `headers` | text | Antwort-Header als JSON-Objekt (Schlüssel kleingeschrieben). |
| `body` | text | Antwort-Body als UTF-8. Ersatzzeichen bei nicht-UTF-8-Daten. |
Status als Text, damit der Audit-Log-Eintrag ohne JSON-
Reparsing operator-lesbar bleibt.
## Berechtigungen
```yaml
permissions:
- "net: *"
```
Der Wildcard macht explizit, dass dieses Modul absichtlich
beliebige HTTP-Endpunkte aufrufen kann. Operator:innen
beschränken den Spielraum über das Policy-Ceiling
(`~/.fai/config.yaml#security.max_permissions.net`) — eine
Installation gegen eine Policy ohne Wildcards schlägt zur
Install-Zeit fehl.
## Warum ein generisches Primitiv statt API-spezifischer Module
Gleiche Antwort wie bei `llm.chat`: ein einzelnes explizites
Egress-Modul bedeutet, dass Operator:innen `net: *` genau
einmal auditieren statt versteckt in jedem Flow-YAML. Die
Permission-Posture bleibt sichtbar.
## Grenzen in v0.1.0
- Nur UTF-8-Body. Binäre Up-/Downloads kommen über ein
separates `http.request-bytes` (v0.2.0).
- Keine pro-Request-Timeout-/Retry-Inputs (waki-Defaults
gelten).
- Kein Cookie-Jar / Session-Keeping.
## Beispiel-Flow
```yaml
name: post-to-webhook
inputs:
payload: text
steps:
- id: notify
use: http.request@^0
with:
method: "POST"
url: "https://example.org/webhook"
headers: '{"Content-Type":"application/json"}'
body: $inputs.payload
outputs:
status: $notify.status
echo: $notify.body
```
## Build
```bash
cargo build --release --target wasm32-wasip2
# Ausgabe: target/wasm32-wasip2/release/http_request.wasm
```

93
MODULE.md Normal file
View file

@ -0,0 +1,93 @@
# http.request
Generic HTTP client for flow steps. GET / POST / PUT / PATCH /
DELETE / HEAD / OPTIONS with arbitrary headers and a UTF-8
body. The audit-friendly alternative to flows rolling their
own HTTP clients.
## Capability
- `http.request@0.1.0`
## Inputs
| Name | Type | Description |
| --------- | ---- | --------------------------------------------------------------------------------- |
| `method` | text | Uppercase HTTP verb (`GET`, `POST`, `PUT`, `PATCH`, `DELETE`, `HEAD`, `OPTIONS`). |
| `url` | text | Full URL including scheme. |
| `headers` | text | Optional JSON-object string of extra headers. Empty = none. |
| `body` | text | Optional UTF-8 request body. Empty = no body. |
Example `headers` input:
```json
{"Accept":"application/json","X-Tenant":"acme","Content-Length":42}
```
String, numeric, and boolean values are accepted (numbers and
bools are coerced to strings). Nested arrays / objects are
rejected at parse time with a clear error.
## Outputs
| Name | Type | Description |
| --------- | ---- | -------------------------------------------------------------------- |
| `status` | text | Decimal status code as text (e.g. `"200"`, `"404"`). |
| `headers` | text | Response headers serialised as a JSON object (lowercased keys). |
| `body` | text | Response body as UTF-8. Replacement chars on non-UTF-8. |
Status is text rather than number so the audit-log entry stays
operator-readable without JSON re-parsing.
## Permissions
```yaml
permissions:
- "net: *"
```
The wildcard makes it explicit that this module can call any
HTTP endpoint by design. Operators clamp the surface in their
policy ceiling (`~/.fai/config.yaml#security.max_permissions.net`)
— installing http.request against a policy that disallows
wildcards fails at install time.
## Why a generic primitive instead of per-API modules
Same answer as `llm.chat`: a single explicit egress module
means operators audit `net: *` exactly once, not in every flow
YAML. The permission posture stays observable.
## Limits in v0.1.0
- UTF-8 body only. Binary upload / download is a separate
`http.request-bytes` capability (v0.2.0).
- No per-request timeout / retry inputs (waki's default
timeouts apply).
- No cookie-jar or session-keeping inputs.
## Example flow
```yaml
name: post-to-webhook
inputs:
payload: text
steps:
- id: notify
use: http.request@^0
with:
method: "POST"
url: "https://example.org/webhook"
headers: '{"Content-Type":"application/json"}'
body: $inputs.payload
outputs:
status: $notify.status
echo: $notify.body
```
## Build
```bash
cargo build --release --target wasm32-wasip2
# Output: target/wasm32-wasip2/release/http_request.wasm
```

51
module.yaml Normal file
View file

@ -0,0 +1,51 @@
schema_version: 1
name: http-request
version: 0.1.0
# Capability provided by this module.
provides:
- capability: http.request
version: 0.1.0
# Inputs the invoke function accepts.
inputs:
# HTTP method as uppercase string. Supported: GET, POST,
# PUT, PATCH, DELETE, HEAD, OPTIONS.
method: text
# Full URL including scheme. Must be https:// for production
# use; http:// is permitted so loopback and air-gapped
# internal services work, but operator policy can clamp it.
url: text
# Optional headers as JSON object string, e.g.
# '{"Accept":"application/json","X-Tenant":"acme"}'. Empty
# string means no extra headers (Content-Type is auto-set
# when `body` is non-empty and the input is not already a
# JSON-shaped string).
headers: text
# Optional request body. Treated as UTF-8 text — binary
# payloads should use a future `http.request-bytes` variant.
body: text
# Outputs produced.
outputs:
# HTTP status code as decimal text (e.g. "200", "404").
# Text rather than number so the audit-log entry stays
# operator-readable without JSON re-parsing.
status: text
# Response headers serialised as a JSON object (same shape
# as the input format) so downstream flow steps can pluck
# values like Content-Type or rate-limit headers.
headers: text
# Response body as UTF-8 text. Non-UTF-8 responses come
# through with replacement characters; that's acceptable
# for v0.1.0 since the bytes-shaped variant covers binary.
body: text
# Permissions required.
#
# v0.1.0 declares the broadest net: permission needed to call
# arbitrary URLs. Operators clamp this per-host via their
# operator-policy ceiling — installing http.request against a
# policy that disallows wildcards fails fast at install time.
permissions:
- "net: *"

4
rust-toolchain.toml Normal file
View file

@ -0,0 +1,4 @@
[toolchain]
channel = "1.86"
targets = ["wasm32-wasip2"]
components = ["rustfmt", "clippy"]

271
src/lib.rs Normal file
View file

@ -0,0 +1,271 @@
//! `http.request` module — generic HTTP client for flow steps.
//!
//! # Capability
//!
//! - **Inputs:**
//! * `method` — uppercase HTTP method (GET / POST / PUT /
//! PATCH / DELETE / HEAD / OPTIONS).
//! * `url` — full URL including scheme.
//! * `headers` — optional JSON-object string of extra
//! request headers. Empty = none.
//! * `body` — optional UTF-8 request body. Empty = no body.
//! - **Outputs:**
//! * `status` — decimal status code as text.
//! * `headers` — response headers serialised as a JSON
//! object string.
//! * `body` — response body as UTF-8 (replacement chars on
//! non-UTF-8 bytes — bytes-shaped variant is a follow-up).
//!
//! # Why a generic primitive rather than per-API modules
//!
//! Same reasoning that `llm.chat` uses: flows that need a
//! one-shot HTTP call shouldn't ship their own client. The
//! permission system + audit log apply uniformly when every
//! HTTP egress goes through this module, and operators see
//! exactly one `net: *` entry in their installed-modules
//! list instead of N hidden in flow YAML.
//!
//! # Stability
//!
//! v0.1.0 ships as `alpha`. Wire-format (method/url/headers/
//! body in, status/headers/body out) is the public contract.
//! Future additions:
//! * `http.request-bytes` capability for binary bodies.
//! * Per-request timeout / retry inputs.
//! * Cookie-jar input for session-following flows.
#![allow(clippy::result_large_err)]
use fai_module_sdk::prelude::*;
use fai_module_sdk::Payload;
use serde_json::{Map, Value};
/// Pull an optional text input out of [`Inputs`]. Mirrors the
/// helper text-summarize / text-anonymize use — kept private
/// per module so each crate is self-contained.
fn payload_text(p: &Payload) -> Option<String> {
match p {
Payload::Text(s) => Some(s.clone()),
_ => None,
}
}
#[fai_module]
pub fn invoke(_ctx: Context, inputs: Inputs) -> Result<Outputs, ModuleError> {
let method = inputs.require_text("method")?.to_string();
let url = inputs.require_text("url")?.to_string();
let headers_raw = inputs
.get("headers")
.and_then(payload_text)
.unwrap_or_default();
let body = inputs
.get("body")
.and_then(payload_text)
.unwrap_or_default();
// Validate method early so a typo doesn't reach the
// network. Same set the proto / capability docs list —
// adding a method here is a v0.2.0 minor bump.
match method.as_str() {
"GET" | "POST" | "PUT" | "PATCH" | "DELETE" | "HEAD" | "OPTIONS" => {}
other => {
return Err(ModuleError::invalid_input(format!(
"unsupported HTTP method: '{other}' \
(allowed: GET, POST, PUT, PATCH, DELETE, HEAD, OPTIONS)"
)));
}
}
// Parse the headers JSON now, before any network call —
// a malformed headers input is a caller bug and should
// fail with a clear error.
let header_pairs = parse_headers(&headers_raw)?;
perform_request(&method, &url, &header_pairs, &body)
}
#[cfg(target_arch = "wasm32")]
fn perform_request(
method: &str,
url: &str,
headers: &[(String, String)],
body: &str,
) -> Result<Outputs, ModuleError> {
let client = waki::Client::new();
// waki::Client exposes per-method builders for GET/POST/
// PUT/PATCH/DELETE/HEAD and a generic `request(Method,
// url)` for everything else. OPTIONS goes through the
// generic path.
let mut request = match method {
"GET" => client.get(url),
"POST" => client.post(url),
"PUT" => client.put(url),
"PATCH" => client.patch(url),
"DELETE" => client.delete(url),
"HEAD" => client.head(url),
"OPTIONS" => client.request(waki::Method::Options, url),
// Unreachable: invoke() already validates the method.
_ => unreachable!("method already validated upstream"),
};
// RequestBuilder::header takes IntoHeaderName, which is
// implemented for &'static str + HeaderName but not for
// String. We convert each (k, v) into HeaderName +
// HeaderValue first; malformed names / values become a
// ModuleError instead of a panic.
for (k, v) in headers {
let name = waki::header::HeaderName::from_bytes(k.as_bytes())
.map_err(|e| {
ModuleError::invalid_input(format!(
"invalid header name '{k}': {e}"
))
})?;
let value = waki::header::HeaderValue::from_str(v)
.map_err(|e| {
ModuleError::invalid_input(format!(
"invalid header value for '{k}': {e}"
))
})?;
request = request.header(name, value);
}
if !body.is_empty() {
request = request.body(body.to_string());
}
let response = request
.send()
.map_err(|e| ModuleError::internal(format!("send failed: {e}")))?;
let status = response.status_code();
// Serialize response headers back into the same JSON-object
// shape we accept on input, so flow YAML stays symmetric.
let mut hdr_map: Map<String, Value> = Map::new();
for (k, v) in response.headers().iter() {
let value = v.to_str().unwrap_or("").to_string();
hdr_map.insert(k.as_str().to_lowercase(), Value::String(value));
}
let headers_json = Value::Object(hdr_map).to_string();
let body_bytes = response
.body()
.map_err(|e| ModuleError::internal(format!("body read failed: {e}")))?;
// Lossy UTF-8 — binary bodies are out-of-scope for v0.1.0.
let body_text = String::from_utf8_lossy(&body_bytes).into_owned();
Ok(Outputs::new()
.with_text("status", status.to_string())
.with_text("headers", headers_json)
.with_text("body", body_text))
}
/// Host-side stub. Lets `cargo test --release` (no wasm
/// target) link against the rlib without pulling waki. The
/// real path is the `target_arch = "wasm32"` variant above.
#[cfg(not(target_arch = "wasm32"))]
fn perform_request(
_method: &str,
_url: &str,
_headers: &[(String, String)],
_body: &str,
) -> Result<Outputs, ModuleError> {
Err(ModuleError::internal(
"http.request can only execute under the WASM runtime",
))
}
/// Parse the `headers` input from its JSON-object string form
/// into a flat `(name, value)` list. Empty input → empty list.
/// Malformed JSON → invalid_input ModuleError.
fn parse_headers(raw: &str) -> Result<Vec<(String, String)>, ModuleError> {
let trimmed = raw.trim();
if trimmed.is_empty() {
return Ok(Vec::new());
}
let value: Value = serde_json::from_str(trimmed).map_err(|e| {
ModuleError::invalid_input(format!(
"headers must be a JSON object string (e.g. '{{\"Accept\":\"\"}}'); got: {e}"
))
})?;
let Value::Object(map) = value else {
return Err(ModuleError::invalid_input(format!(
"headers must be a JSON object, got {}",
type_name(&value)
)));
};
let mut out = Vec::with_capacity(map.len());
for (k, v) in map {
let s = match v {
Value::String(s) => s,
Value::Number(n) => n.to_string(),
Value::Bool(b) => b.to_string(),
// Arrays / objects don't fit the HTTP-header line
// shape — refuse rather than silently flatten.
other => {
return Err(ModuleError::invalid_input(format!(
"header '{k}' has unsupported value type ({})",
type_name(&other)
)));
}
};
out.push((k, s));
}
Ok(out)
}
fn type_name(v: &Value) -> &'static str {
match v {
Value::Null => "null",
Value::Bool(_) => "bool",
Value::Number(_) => "number",
Value::String(_) => "string",
Value::Array(_) => "array",
Value::Object(_) => "object",
}
}
#[cfg(test)]
mod tests {
use super::*;
#[test]
fn parse_headers_empty_input_yields_empty() {
let h = parse_headers("").unwrap();
assert!(h.is_empty());
let h = parse_headers(" ").unwrap();
assert!(h.is_empty());
}
#[test]
fn parse_headers_accepts_string_values() {
let h = parse_headers(r#"{"Accept":"application/json","X-Tenant":"acme"}"#).unwrap();
assert_eq!(h.len(), 2);
assert!(h.iter().any(|(k, v)| k == "Accept" && v == "application/json"));
assert!(h.iter().any(|(k, v)| k == "X-Tenant" && v == "acme"));
}
#[test]
fn parse_headers_coerces_numeric_and_bool() {
let h = parse_headers(r#"{"Content-Length":42,"X-Force":true}"#).unwrap();
assert!(h.iter().any(|(k, v)| k == "Content-Length" && v == "42"));
assert!(h.iter().any(|(k, v)| k == "X-Force" && v == "true"));
}
#[test]
fn parse_headers_rejects_non_object() {
let err = parse_headers("[1,2,3]").unwrap_err();
let s = err.to_string();
assert!(s.contains("object"), "got: {s}");
}
#[test]
fn parse_headers_rejects_nested_object_value() {
let err = parse_headers(r#"{"X-Nope":{"deep":1}}"#).unwrap_err();
assert!(err.to_string().contains("unsupported value type"));
}
#[test]
fn parse_headers_rejects_malformed_json() {
let err = parse_headers("not json").unwrap_err();
assert!(err.to_string().contains("must be a JSON object string"));
}
}