feat(drivers): host.http_request with a per-driver cookie jar

[frahlg]

Problem

The VW Group EU Data Act portal session lasts about an hour. vag_vehicle needs a pasted Cookie header each time, so the car's SoC disappears every hour until the owner pastes a new one (srcfl/device-drivers#143).

The driver could sign in itself, as evcc does, but the Lua host prevents it:

• http_get/http_post turn 4xx into errors and follow redirects.
• Lua sees no status, no Location and no response headers.
• There is no cookie jar.
• A signed read-only driver may POST to one exact sign-in path. The VW login posts two forms.

Change

host.http_request{method, url, headers, body} returns {status, headers, location, body}.

• It never follows a redirect. The driver reads location and makes the next call, so Core checks every hop against allowed_hosts.
• GET and POST only, https only, and only with a non-empty allowed_hosts.
• POST goes through the same gate as http_post (allowWrite, or a declared sign-in path for a read-only driver).
• Same TLS pinning, 15 s timeout and 1 MiB response cap as the other verbs.
• Header names are lowercase. A driver without a wall clock can read the server time from headers.date.

Cookie jar per driver.

• Held in memory only, so a driver restart starts a clean session.
• Only http_request uses it.
• It stores and sends cookies only for allowed hosts over https.
• Set-Cookie is left out of the headers Lua sees, so session cookies stay out of Lua and logs.
• host.http_cookies_clear() empties the jar before a fresh sign-in.

auth_post_paths in signed read-only metadata adds further exact sign-in paths next to auth_post_path. It flows through the catalog, driverrepo and RuntimePolicy. Each path matches exactly, as before.

Unchanged: http_get, http_post and http_patch. Drivers that do not call the new functions behave exactly as before. host_api stays at 1. The driver checks if host.http_request then and falls back to a pasted cookie on an older Core.

Paired PR

srcfl/device-drivers#156: vag_vehicle 0.2.0 signs in with email and password, renews the session, and reports SoC age from VW's clocks. The channel builder publishes auth_post_paths and guards POST through http_request. Merge this Core PR first; the driver works on an older Core in cookie mode.

Related

• fix(ev): anchor older car SoC with energy delivered since #1500 anchors older car SoC readings with the energy delivered since. With this PR the VW driver can also report how old a reading is.

Validation

• New lua_http_request_test.go, against a TLS test server reached through the pin:
  • sign-in with the jar
  • 4xx returned, not raised
  • redirect returned with location resolved
  • Set-Cookie hidden
  • Date readable
  • http_get does not use the jar
  • http_cookies_clear
  • an off-host next hop is refused
• Refusal tests: empty allowlist, plain http, other host, unsupported method.
• A read-only POST through http_request reaches only declared paths.
• The jar drops other hosts and plain http.
• Catalog test for auth_post_paths. Persist-secret test with only a path list.
• Ran vag_vehicle 0.2.0 in this host's gopher-lua against a scripted VW portal: sign-in, a SoC read and a 300 s age all came through.
• make verify: vet, test and build clean.
• Not yet run against the live VW portal.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-03T05:30:08.861255Z	c30adb5	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.