feat(http-callout): add praxis-http-callout filter crate

Cargo.toml

@@ -8,6 +8,7 @@ members = [
     "core",
     "filter",
     "filter/ext-proc",
+    "filter/http-callout",
     "filter/proto",
     "protocol",
     "tls",
@@ -56,6 +57,7 @@ pingora-http = { version = "0.8.2", package = "quixotic-plecostomus-http" }
 pingora-proxy = { version = "0.8.2", package = "quixotic-plecostomus-proxy", features = ["rustls"] }
 percent-encoding = "2.3.2"
 praxis-ext-proc = { version = "0.3.1", path = "filter/ext-proc", package = "praxis-proxy-ext-proc" }
+praxis-http-callout = { version = "0.3.1", path = "filter/http-callout", package = "praxis-proxy-http-callout" }
 praxis-proto = { version = "0.3.1", path = "filter/proto", package = "praxis-proxy-proto" }
 prost = "0.14.4"
 prost-build = "0.14.4"
@@ -74,6 +76,7 @@ praxis-test-utils = { path = "tests/utils" }
 secrecy = { version = "0.10.3", features = ["serde"] }
 serde = { version = "1.0.228", features = ["derive", "rc"] }
 serde_json = "1.0.150"
+serde_json_path = "0.7.2"
 rcgen = "0.14.8"
 regex = "1.12.4"
 reqwest = { version = "0.12.28", default-features = false, features = ["rustls-tls"] }

examples/README.md

@@ -31,6 +31,7 @@ page.
 | [unified-gateway.yaml](configs/ai/anthropic/unified-gateway.yaml) | Routes traffic by classifier-promoted headers so a single listener handles Anthropic Messages, OpenAI Chat Completions, and OpenAI Responses requests |
 | [credential-injection.yaml](configs/ai/credential-injection.yaml) | Injects per-cluster API credentials into upstream requests and strips client-provided credentials to prevent forwarding |
 | [json-rpc-routing.yaml](configs/ai/json-rpc-routing.yaml) | Routes JSON-RPC 2.0 requests to different backends based on the "method" field in the JSON request body |
+| [lakera-guard.yaml](configs/ai/lakera-guard.yaml) | Screens every request body through Lakera Guard for content moderation before forwarding to the upstream |
 | [mcp-classifier-routing.yaml](configs/ai/mcp-classifier-routing.yaml) | Routes MCP requests by body-derived method and tool name |
 | [model-to-header-routing.yaml](configs/ai/model-to-header-routing.yaml) | Routes LLM API requests to different backends based on the "model" field in the JSON request body |
 | [format-routing.yaml](configs/ai/openai/responses/format-routing.yaml) | Routes AI API traffic by detected body format |

examples/configs/ai/lakera-guard.yaml

@@ -0,0 +1,77 @@
+# Lakera Guard Content Safety
+#
+# Screens every request body through Lakera Guard for
+# content moderation before forwarding to the upstream.
+# Flagged requests are rejected with 403; clean requests
+# continue to the backend.
+#
+# The target.body option uses JSONPath to send only the
+# "messages" array to Lakera, stripping provider-specific
+# fields like "model" that Lakera rejects. The full
+# downstream body reaches the upstream untouched.
+#
+# Requires the LAKERA_API_KEY environment variable.
+#
+# Usage:
+#   LAKERA_API_KEY=... cargo run -p praxis-proxy -- -c examples/configs/ai/lakera-guard.yaml
+
+listeners:
+  - name: web
+    address: "0.0.0.0:8080"
+    filter_chains: [safety-check, routing]
+
+filter_chains:
+  - name: safety-check
+    filters:
+      - filter: http_callout
+        target:
+          url: "https://api.lakera.ai/v2/guard"
+          timeout: "2s"
+          headers:
+            - name: "Authorization"
+              value: "Bearer ${LAKERA_API_KEY}"
+            - name: "Content-Type"
+              value: "application/json"
+          body:
+            messages: "$.messages"
+        request:
+          phase: request_body
+          max_body_bytes: 1048576
+        response:
+          extract:
+            - json_path: "$.flagged"
+              result_key: "flagged"
+        on_failure: closed
+        status_on_error: 403
+        circuit_breaker:
+          failure_threshold: 5
+          recovery_timeout: "30s"
+        conditions:
+          - when:
+              methods: [POST]
+        branch_chains:
+          - name: block_flagged
+            on_result:
+              filter: http_callout
+              key: flagged
+              result: "true"
+            rejoin: terminal
+            chains:
+              - name: reject_flagged
+                filters:
+                  - filter: static_response
+                    status: 403
+                    body: "request blocked by content safety"
+
+  - name: routing
+    filters:
+      - filter: router
+        routes:
+          - path_prefix: "/"
+            cluster: backend
+
+      - filter: load_balancer
+        clusters:
+          - name: backend
+            endpoints:
+              - "127.0.0.1:3000"

filter/http-callout/Cargo.toml

@@ -0,0 +1,35 @@
+[package]
+name = "praxis-proxy-http-callout"
+version.workspace = true
+edition.workspace = true
+rust-version.workspace = true
+authors.workspace = true
+description = "HTTP callout filter for Praxis"
+license.workspace = true
+repository.workspace = true
+readme = "../../README.md"
+publish = false
+
+[lib]
+name = "praxis_http_callout"
+
+[lints]
+workspace = true
+
+[package.metadata.praxis-filters]
+
+[dependencies]
+async-trait = { workspace = true }
+bytes = { workspace = true }
+http = { workspace = true }
+praxis-core = { workspace = true, features = ["callout"] }
+praxis-filter = { workspace = true }
+serde = { workspace = true }
+serde_json = { workspace = true }
+serde_json_path = { workspace = true }
+serde_yaml = { workspace = true }
+tracing = { workspace = true }
+
+[dev-dependencies]
+tokio = { workspace = true, features = ["macros", "rt-multi-thread"] }
+wiremock = { workspace = true }