ownerguard

Overview ¶

Command ownerguard is the SEC-0027 post-gen helper. It scans the OpenAPI spec for the `x-apic-owner-param` extension on operations and emits api/ownerguard.gen.go: a gin middleware (OwnershipGuard) that enforces object-level ownership (OWASP API1:2023 BOLA) by requiring the verified JWT subject to equal the named routed path parameter, with an optional privileged-role bypass (x-apic-owner-bypass-roles).

It follows the same structure as helpers/wsgen and helpers/mcpgen: it takes (specPath, outPath) positional args, loads the spec with kin-openapi, and runs format.Source + a go/parser self-check before writing the file 0o600.