Channels: HTTP proxy with observability for Lightning

[stuartc]

Summary

Channels adds lightweight reverse-proxy functionality with observability to Lightning. Deploy a Channel between two systems and get instant visibility into requests and responses, with full audit trail.

• Source: Authenticates inbound requests (API key / Basic Auth via project credentials)
• Sink: Forwards to target system with credential injection
• Observability: Every proxied request logged with headers, body preview, SHA256 hash, timing
• Snapshots: Channel config captured at request time for auditable history

Streaming proxy powered by philter — constant memory regardless of payload size.

Closes #4322 | Go-live target: 26 Feb 2026

Stories

Phase 1 — Foundation

• Channels: Schema and context setup #4399 — Schema and context setup
• Channels: Audit trail integration #4400 — Audit trail integration

Phase 2 — Core Proxy

• Channels: Routing and proxy plug #4401 — Routing and proxy plug (no auth, no observation)
• Channels: Source authentication #4403 — Source authentication
• Channels: Sink authentication #4404 — Sink authentication

Phase 3 — Observability

• Channels: Handler implementation and persistence #4405 — Observer implementation and persistence
• Channels: Channel snapshots #4406 — Channel snapshots

Phase 4 — UI

• Channels: CRUD LiveViews #4407 — Channel CRUD LiveViews
• Channels: MVP Channels Requests Log Page #4408 — History page integration (cut line: standalone list page if too expensive)

Phase 5 — Performance Confidence

• Channels: Mock sink server #4409 — Mock sink server
• Channels: Load test scenarios #4410 — K6 load test scenarios

Dependency Graph

#4399 Schema ──┬──→ #4401 Proxy ──→ #4403 Source auth
               │       │           #4404 Sink auth (parallel)
               │       │
               ├───────┤──→ #4405 Observer ──→ #4406 Snapshots
               │       │
               ├──→ #4400 Audit trail
               ├──→ #4407 Channel UI
               └───────┴──→ #4408 History page

#4409 Mock sink ──┐
                  ├──→ #4410 K6 load tests
#4401 Proxy ──────┘

[codecov]

Codecov Report

❌ Patch coverage is 91.51235% with 55 lines in your changes missing coverage. Please review.
✅ Project coverage is 89.55%. Comparing base (bdec4c8) to head (60b287a).
⚠️ Report is 1 commits behind head on main.

Files with missing lines	Patch %	Lines
lib/lightning_web/live/channel_live/index.ex	90.22%	13 Missing ⚠️
lib/lightning_web/plugs/channel_proxy_plug.ex	87.12%	13 Missing ⚠️
lib/lightning/channels/handler.ex	83.63%	9 Missing ⚠️
...htning_web/live/run_live/channel_logs_component.ex	88.70%	7 Missing ⚠️
lib/lightning/channels.ex	91.04%	6 Missing ⚠️
lib/lightning_web/live/run_live/index.ex	33.33%	4 Missing ⚠️
.../lightning_web/live/channel_live/form_component.ex	97.84%	2 Missing ⚠️
lib/lightning_web/live/channel_live/helpers.ex	94.44%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #4419      +/-   ##
==========================================
+ Coverage   89.49%   89.55%   +0.06%     
==========================================
  Files         425      441      +16     
  Lines       20373    20993     +620     
==========================================
+ Hits        18232    18800     +568     
- Misses       2141     2193      +52     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[stuartc]

We've found a critical bug in the philter proxy library. It incorrectly folds in the host header into outgoing request. While this is 'fixable' in Lightning, the proxy library has no business blindly merging host and other headers in like this.

The effect is that any site that has more than one domain/site being served (i.e. most servers) will reject the request because the host/site requested gets set as whatever the host for Lightning is.

A fix is underway.