refactor(workspace): enforce layered crate boundaries

apps/aether-gateway/src/tunnel/embedded/mod.rs

@@ -6,6 +6,9 @@ mod proxy_conn;
 
 use std::sync::Arc;
 
+use aether_gateway_tunnel::{
+    resolve_proxy_max_streams, resolve_proxy_node_name, resolve_proxy_protocol_version,
+};
 use aether_runtime::{
     hold_admission_permit_until, prometheus_response, service_up_sample, AdmissionPermit,
     ConcurrencyError, ConcurrencyGate, ConcurrencySnapshot, MetricKind, MetricLabel, MetricSample,
@@ -17,7 +20,6 @@ use axum::http::HeaderMap;
 use axum::response::{IntoResponse, Json};
 use axum::routing::{get, post};
 use axum::Router;
-use base64::Engine as _;
 use dashmap::DashMap;
 use tracing::warn;
 
@@ -335,121 +337,3 @@ pub async fn ws_proxy(
         })
         .into_response()
 }
-
-fn resolve_proxy_max_streams(headers: &HeaderMap, fallback: usize) -> usize {
-    headers
-        .get("x-tunnel-max-streams")
-        .and_then(|value| value.to_str().ok())
-        .and_then(|value| value.parse::<usize>().ok())
-        .unwrap_or(fallback)
-        .clamp(1, 2048)
-}
-
-fn resolve_proxy_node_name(headers: &HeaderMap, node_id: &str) -> String {
-    if let Some(decoded) = headers
-        .get(aether_contracts::tunnel::TUNNEL_NODE_NAME_B64_HEADER)
-        .and_then(|value| value.to_str().ok())
-        .and_then(|value| {
-            base64::engine::general_purpose::URL_SAFE_NO_PAD
-                .decode(value.trim())
-                .ok()
-        })
-        .and_then(|bytes| String::from_utf8(bytes).ok())
-        .map(|value| value.trim().to_string())
-        .filter(|value| !value.is_empty() && value.chars().count() <= 100)
-    {
-        return decoded;
-    }
-
-    headers
-        .get("x-node-name")
-        .and_then(|value| value.to_str().ok())
-        .map(str::trim)
-        .filter(|value| !value.is_empty())
-        .unwrap_or(node_id)
-        .to_string()
-}
-
-fn resolve_proxy_protocol_version(headers: &HeaderMap) -> u8 {
-    headers
-        .get(aether_contracts::tunnel::TUNNEL_PROTOCOL_VERSION_HEADER)
-        .and_then(|value| value.to_str().ok())
-        .and_then(|value| value.parse::<u8>().ok())
-        .filter(|value| *value >= 1)
-        .map(|value| value.min(aether_contracts::tunnel::CURRENT_TUNNEL_PROTOCOL_VERSION))
-        .unwrap_or(1)
-}
-
-#[cfg(test)]
-mod tests {
-    use axum::http::{HeaderMap, HeaderValue};
-    use base64::Engine as _;
-
-    use super::{
-        resolve_proxy_max_streams, resolve_proxy_node_name, resolve_proxy_protocol_version,
-    };
-
-    #[test]
-    fn proxy_max_streams_honors_small_advertised_capacity() {
-        let mut headers = HeaderMap::new();
-        headers.insert("x-tunnel-max-streams", HeaderValue::from_static("8"));
-
-        assert_eq!(resolve_proxy_max_streams(&headers, 128), 8);
-    }
-
-    #[test]
-    fn proxy_max_streams_caps_unreasonably_large_capacity() {
-        let mut headers = HeaderMap::new();
-        headers.insert("x-tunnel-max-streams", HeaderValue::from_static("9999"));
-
-        assert_eq!(resolve_proxy_max_streams(&headers, 128), 2048);
-    }
-
-    #[test]
-    fn proxy_protocol_version_defaults_to_v1_when_header_missing() {
-        let headers = HeaderMap::new();
-        assert_eq!(resolve_proxy_protocol_version(&headers), 1);
-    }
-
-    #[test]
-    fn proxy_protocol_version_reads_advertised_version() {
-        let mut headers = HeaderMap::new();
-        headers.insert(
-            aether_contracts::tunnel::TUNNEL_PROTOCOL_VERSION_HEADER,
-            HeaderValue::from_static("2"),
-        );
-
-        assert_eq!(resolve_proxy_protocol_version(&headers), 2);
-    }
-
-    #[test]
-    fn proxy_node_name_reads_legacy_ascii_header() {
-        let mut headers = HeaderMap::new();
-        headers.insert("x-node-name", HeaderValue::from_static("edge-1"));
-
-        assert_eq!(resolve_proxy_node_name(&headers, "node-1"), "edge-1");
-    }
-
-    #[test]
-    fn proxy_node_name_decodes_base64_header() {
-        let mut headers = HeaderMap::new();
-        let encoded = base64::engine::general_purpose::URL_SAFE_NO_PAD.encode("日本节点");
-        headers.insert(
-            aether_contracts::tunnel::TUNNEL_NODE_NAME_B64_HEADER,
-            HeaderValue::from_str(&encoded).expect("encoded header value should parse"),
-        );
-
-        assert_eq!(resolve_proxy_node_name(&headers, "node-1"), "日本节点");
-    }
-
-    #[test]
-    fn proxy_node_name_falls_back_to_node_id_for_invalid_base64() {
-        let mut headers = HeaderMap::new();
-        headers.insert(
-            aether_contracts::tunnel::TUNNEL_NODE_NAME_B64_HEADER,
-            HeaderValue::from_static("not valid"),
-        );
-
-        assert_eq!(resolve_proxy_node_name(&headers, "node-1"), "node-1");
-    }
-}