Namespace Kuestenlogik.Bowire.Proxy

Classes

BowireProxyCertificateAuthority

Self-signed CA that bowire proxy uses to mint leaf certificates for HTTPS interception (Tier-3 Stage B in the security-testing ADR). On first use the CA generates an RSA-2048 self-signed root with a 5-year validity, persists it to ~/.bowire/proxy-ca.pfx (private key) and exports a trust-installable ~/.bowire/proxy-ca.crt beside it. Every CONNECT target host gets a leaf cert minted on-the-fly: same algorithm, 90-day validity, SAN populated with the requested hostname (and an IP:127.0.0.1 alt-name when intercepting loopback traffic). Leaf certs are cached per-host so re-visited targets reuse the same fingerprint.

BowireProxyServer

Tier-3 intercepting proxy. Plain HTTP requests are parsed, forwarded to the upstream identified by the absolute-form request line (or by the Host header), and recorded into CapturedFlowStore. HTTPS interception (Stage B) is driven by a CONNECT-tunnel TLS termination: the proxy mints a leaf certificate for the requested host via BowireProxyCertificateAuthority, presents it on the client side of the tunnel, and then re-issues each request over real TLS to the upstream — so the captured flow has the decrypted request + response body, not opaque encrypted bytes.

CapturedFlow

One captured request/response pair flowing through the bowire proxy intercepting proxy. Records the wire-level shape (method / URL / headers / body) on both sides so the workbench can replay any captured flow as a Bowire recording — the Tier-3 anchor in docs/architecture/security-testing.md.

CapturedFlowStore

In-memory ring buffer of CapturedFlows plus a fan-out channel for live subscribers (Workbench Proxy tab over SSE). Bounded so a long-running bowire proxy session does not eat unbounded memory — once Capacity flows are stored the oldest one is evicted before the new one is added.