Documentation
¶
Overview ¶
Code generated by apic; DO NOT EDIT.
Code generated by apic; DO NOT EDIT.
Code generated by apic; DO NOT EDIT.
Code generated by apic; DO NOT EDIT.
Index ¶
- func NewInProcessResolvers(api apic.GeneratedServerInterface, ws genws.WSServerInterface, ...) *gqlx.Schema
- func NewProxyResolvers(baseURL string, authAPIKey, authJWT func(*http.Request) error, ...) *gqlx.Schema
- func RegisterGeneratedGQL(mux *http.ServeMux, schema *gqlx.Schema, opts GQLOptions)
- type GQLOptions
- type ProxyOption
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func NewInProcessResolvers ¶
func NewInProcessResolvers(api apic.GeneratedServerInterface, ws genws.WSServerInterface, authAPIKey, authJWT func(*http.Request) error, authMTLS func(*http.Request, securex.MTLSPolicy) error) *gqlx.Schema
NewInProcessResolvers builds a schema wired to the given server implementations.
func NewProxyResolvers ¶
func NewProxyResolvers(baseURL string, authAPIKey, authJWT func(*http.Request) error, authMTLS func(*http.Request, securex.MTLSPolicy) error, opts ...ProxyOption) *gqlx.Schema
NewProxyResolvers builds a schema that proxies to REST endpoints.
N-1 (AppSec): every proxy resolver enforces the same per-field authorization gate as the in-process resolvers (authorizeGraphQLField), fail-closed on a nil verifier. The verifiers MUST be supplied — passing nil for a field's required mode denies that field. This closes the prior fail-open gap where the proxy forwarded privileged operations (e.g. admin mutations) to upstream REST with no GraphQL-layer auth.
SECURITY: this proxy forwards the caller's Authorization and Cookie headers to the configured baseURL; baseURL is a generated constant (not attacker-controlled). baseURL SHOULD use https:// — an http:// baseURL forwards the caller's bearer token / session cookie to the upstream in cleartext. For mtls/cac/piv composite fields the TLS client certificate identity does NOT survive the proxy hop — the operator MUST supply an mTLS-configured http.Client (via WithHTTPClient) and/or the upstream must independently authenticate. The upstream MUST NOT trust network position alone.
func RegisterGeneratedGQL ¶
func RegisterGeneratedGQL(mux *http.ServeMux, schema *gqlx.Schema, opts GQLOptions)
RegisterGeneratedGQL mounts the GraphQL handler on the given mux.
Types ¶
type GQLOptions ¶
type GQLOptions struct {
Timeout time.Duration
MaxQueryBytes int
MaxBatchSize int
MaxDepth int
MaxComplexity int
MaxAliases int
Auth func(*http.Request) error
AllowGET bool
WSPath string
WSOriginAllowlist []string
MaxSubscriptions int
}
GQLOptions configures the GraphQL handler.
type ProxyOption ¶
type ProxyOption func(*proxyConfig)
ProxyOption configures the proxy resolver.
func WithHTTPClient ¶
func WithHTTPClient(c *http.Client) ProxyOption
WithHTTPClient sets the HTTP client for proxy requests.
Source Files