Merge remote-tracking branch 'origin/tinnus/eyre-https-redirect' into philip/agent-clay

pkg/arvo/sys/vane/eyre.hoon

@@ -551,6 +551,18 @@
       (easy ~)
     ==
   ==
+::  +host-sans-port: strip the :<port> from a host string
+::
+++  host-sans-port
+  ;~  sfix
+    %+  cook  crip
+    %-  star
+    ;~  less
+      ;~(plug col (punt dem) ;~(less next (easy ~)))
+      next
+    ==
+    (star next)
+  ==
 ::  +per-server-event: per-event server core
 ::
 ++  per-server-event
@@ -602,6 +614,31 @@
       [action [authenticated secure address request] ~ 0]
     =.  connections.state
       (~(put by connections.state) duct connection)
+    ::  redirect to https if insecure, redirects enabled
+    ::  and secure port live
+    ::
+    ?:  ?&  !secure
+            redirect.http-config.state
+            ?=(^ secure.ports.state)
+        ==
+      =/  location=@t
+        %+  rap  3
+        :~  'https://'
+            (rash (fall host '') host-sans-port)
+            ?:  =(443 u.secure.ports.state)
+              ''
+            (crip ":{(a-co:co u.secure.ports.state)}")
+            ?:  ?=([[~ ~] ~] (parse-request-line url.request))
+              '/'
+            url.request
+        ==
+      %-  handle-response
+      :*  %start
+          :-  status-code=301
+          headers=['location' location]~
+          data=~
+          complete=%.y
+      ==
     ::  figure out whether this is a cors request,
     ::  whether the origin is approved or not,
     ::  and maybe add it to the "pending approval" set
@@ -2272,6 +2309,10 @@
       ::
       %live
     =.  ports.server-state.ax  +.task
+    ::  enable http redirects if https port live and cert set
+    ::
+    =.  redirect.http-config.server-state.ax
+      &(?=(^ secure.task) ?=(^ secure.http-config.server-state.ax))
     [~ http-server-gate]
       ::  %rule: updates our http configuration
       ::
@@ -2284,6 +2325,10 @@
       ?:  =(secure.config cert.http-rule.task)
         [~ http-server-gate]
       =.  secure.config  cert.http-rule.task
+      =.  redirect.config
+        ?&  ?=(^ secure.ports.server-state.ax)
+            ?=(^ cert.http-rule.task)
+        ==
       :_  http-server-gate
       =*  out-duct  outgoing-duct.server-state.ax
       ?~  out-duct  ~
@@ -2534,6 +2579,12 @@
 ++  load
   |=  old=axle
   ^+  ..^$
+  ::  enable https redirects if certificate configured
+  ::
+  =.  redirect.http-config.server-state.old
+    ?&  ?=(^ secure.ports.server-state.old)
+        ?=(^ secure.http-config.server-state.old)
+    ==
   ..^$(ax old)
 ::  +stay: produce current state
 ::