Documentation
¶
Overview ¶
Package pkg contains the runtime dependencies that will be generated into the output directory.
Index ¶
Constants ¶
This section is empty.
Variables ¶
View Source
var FS embed.FS
Glob layers, from top-level to deeper:
*/*.go — pkg/<sub>/*.go (the original layout)
*/*/*.go — pkg/<sub>/<sub2>/*.go (FIPS 140-3 fipsx; mtls mtlsx;
cacpiv; sessionx; signerx; webauthnx; obsx/auditx)
*/*/*/*.go — pkg/securex/signerx/softfile/*.go and any future
three-deep subpackage (HSM/PKCS#11 backends, etc.)
Extending the glob keeps the generator's vendored output hermetic without forcing the runtime tree to be artificially flat.
Functions ¶
This section is empty.
Types ¶
This section is empty.
Source Files
Directories
¶
| Path | Synopsis |
|---|---|
|
Package configx defines the JSON configuration schema shared by the apic code generator and the generated servers, together with the validation and normalization that enforce a secure-by-default posture.
|
Package configx defines the JSON configuration schema shared by the apic code generator and the generated servers, together with the validation and normalization that enforce a secure-by-default posture. |
|
Package gen is a generic general use Go functions library which can be used throughout any project.
|
Package gen is a generic general use Go functions library which can be used throughout any project. |
|
Package gqlx is a self-contained GraphQL engine used by apic-generated services.
|
Package gqlx is a self-contained GraphQL engine used by apic-generated services. |
|
Package healthx is the generated control-plane health subsystem: the user hook API a service registers dependency checks against, plus the executor and HTTP dispatch behind /livez, /readyz, and /startupz.
|
Package healthx is the generated control-plane health subsystem: the user hook API a service registers dependency checks against, plus the executor and HTTP dispatch behind /livez, /readyz, and /startupz. |
|
Package htpx is the HTTP application toolkit that backs apic-generated services.
|
Package htpx is the HTTP application toolkit that backs apic-generated services. |
|
cmd/apimap
command
|
|
|
Package httpx provides net/http server building blocks and middleware for apic services: a TLS/mTLS listener with hardened timeouts and body-size limits, transparent gzip response compression (with BREACH-sensitive path exclusions), token-bucket rate limiting (a coarse per-IP abuse ceiling plus stricter per-path-prefix and per-peer buckets), CORS handling, and the default-deny security response-header set (CSP, COOP/COEP/CORP, Permissions-Policy).
|
Package httpx provides net/http server building blocks and middleware for apic services: a TLS/mTLS listener with hardened timeouts and body-size limits, transparent gzip response compression (with BREACH-sensitive path exclusions), token-bucket rate limiting (a coarse per-IP abuse ceiling plus stricter per-path-prefix and per-peer buckets), CORS handling, and the default-deny security response-header set (CSP, COOP/COEP/CORP, Permissions-Policy). |
|
internal
|
|
|
ratebucket
Package ratebucket is the canonical mutex-guarded token bucket shared by the rate-limiters that previously each carried a byte-identical private copy of this algorithm (securex.Bucket, mcpx's bucket, httpx's tokenBucket) — QG-046/QG-059/PERF-0044.
|
Package ratebucket is the canonical mutex-guarded token bucket shared by the rate-limiters that previously each carried a byte-identical private copy of this algorithm (securex.Bucket, mcpx's bucket, httpx's tokenBucket) — QG-046/QG-059/PERF-0044. |
|
Package mcpx implements a JSON-RPC 2.0 engine for the Model Context Protocol (MCP) over three transports: HTTP, WebSocket, and STDIO.
|
Package mcpx implements a JSON-RPC 2.0 engine for the Model Context Protocol (MCP) over three transports: HTTP, WebSocket, and STDIO. |
|
Package obsx is the observability layer for apic services, bundling structured logging, metrics, and tracing behind a small package-level API.
|
Package obsx is the observability layer for apic services, bundling structured logging, metrics, and tracing behind a small package-level API. |
|
auditx
Package auditx is the FedRAMP / NIST 800-53 audit logging layer for apic.
|
Package auditx is the FedRAMP / NIST 800-53 audit logging layer for apic. |
|
otelx
Package otelx bootstraps the OpenTelemetry SDK from the standard OTEL_* environment variables (https://opentelemetry.io/docs/specs/otel/configuration/sdk-environment-variables/) and delivers traces, metrics, and logs over OTLP/HTTP using the JSON encoding — stdlib + the already-vendored OTEL SDK only, no exporter module dependencies.
|
Package otelx bootstraps the OpenTelemetry SDK from the standard OTEL_* environment variables (https://opentelemetry.io/docs/specs/otel/configuration/sdk-environment-variables/) and delivers traces, metrics, and logs over OTLP/HTTP using the JSON encoding — stdlib + the already-vendored OTEL SDK only, no exporter module dependencies. |
|
promx
Package promx implements obsx.MetricsProvider on top of prometheus/client_golang, preserving labels (the expvar default discards them) with a per-metric series-cardinality cap, and exposes the scrape handler mounted by generated servers at the authenticated /metrics endpoint.
|
Package promx implements obsx.MetricsProvider on top of prometheus/client_golang, preserving labels (the expvar default discards them) with a per-metric series-cardinality cap, and exposes the scrape handler mounted by generated servers at the authenticated /metrics endpoint. |
|
Package oidcx provides an auto-refreshing JWK Set cache that survives IdP key rotation without restarting the host process.
|
Package oidcx provides an auto-refreshing JWK Set cache that survives IdP key rotation without restarting the host process. |
|
Package opt provides a small generic implementation of the functional options pattern.
|
Package opt provides a small generic implementation of the functional options pattern. |
|
Package securex — OIDC asymmetric verifier.
|
Package securex — OIDC asymmetric verifier. |
|
cacpiv
Package cacpiv extends mtlsx.Principal with DOD CAC and federal PIV identity extraction per FIPS 201-3 and the X.509 Certificate Policy for the U.S. Federal PKI Common Policy Framework.
|
Package cacpiv extends mtlsx.Principal with DOD CAC and federal PIV identity extraction per FIPS 201-3 and the X.509 Certificate Policy for the U.S. Federal PKI Common Policy Framework. |
|
csrfx
Package csrfx implements stateless, HMAC-signed, session-bound CSRF tokens using the signed double-submit pattern (OWASP).
|
Package csrfx implements stateless, HMAC-signed, session-bound CSRF tokens using the signed double-submit pattern (OWASP). |
|
fipsx
Package fipsx exposes a tiny façade over crypto/fips140 so the rest of apic can gate behavior on FIPS 140-3 mode without importing crypto/fips140 directly (keeping the import boundary tight makes FIPS-disabled callers easy to audit).
|
Package fipsx exposes a tiny façade over crypto/fips140 so the rest of apic can gate behavior on FIPS 140-3 mode without importing crypto/fips140 directly (keeping the import boundary tight makes FIPS-disabled callers easy to audit). |
|
harness
Package harness provides RBAC/ABAC test helpers for downstream services that consume the generated API.
|
Package harness provides RBAC/ABAC test helpers for downstream services that consume the generated API. |
|
harness/cmd/mint
command
Command mint prints a standard RFC 7519 HS256 JWT to stdout, signed with the supplied shared secret, so non-Go test stacks (pytest/PyJWT, curl, etc.) can obtain a harness-minted token without linking any Go code.
|
Command mint prints a standard RFC 7519 HS256 JWT to stdout, signed with the supplied shared secret, so non-Go test stacks (pytest/PyJWT, curl, etc.) can obtain a harness-minted token without linking any Go code. |
|
hashx
pkg/securex/hashx/algorithm.go Package hashx implements salted, self-describing, FIPS-140-3-aware one-way hashing and constant-time verification for passwords and other authentication material.
|
pkg/securex/hashx/algorithm.go Package hashx implements salted, self-describing, FIPS-140-3-aware one-way hashing and constant-time verification for passwords and other authentication material. |
|
mtlsx
Package mtlsx implements the per-route mTLS verification pipeline used by apic-generated handlers: trust store loading, issuer-label enforcement, CRL/OCSP revocation checks, and principal extraction.
|
Package mtlsx implements the per-route mTLS verification pipeline used by apic-generated handlers: trust store loading, issuer-label enforcement, CRL/OCSP revocation checks, and principal extraction. |
|
sessionx
Package sessionx implements FedRAMP AC-7 account lockout, AC-11 inactivity timeout, and AC-12 session termination tracking.
|
Package sessionx implements FedRAMP AC-7 account lockout, AC-11 inactivity timeout, and AC-12 session termination tracking. |
|
signerx
Package signerx is the apic abstraction over hardware- and KMS-backed crypto.Signer providers (PKCS#11 HSMs, AWS KMS, Azure Key Vault, etc.).
|
Package signerx is the apic abstraction over hardware- and KMS-backed crypto.Signer providers (PKCS#11 HSMs, AWS KMS, Azure Key Vault, etc.). |
|
webauthnx
Package webauthnx wraps github.com/go-webauthn/webauthn with the apic-specific identity binding, FedRAMP-compatible attestation policy (AAGUID allow-list), and ceremony orchestration.
|
Package webauthnx wraps github.com/go-webauthn/webauthn with the apic-specific identity binding, FedRAMP-compatible attestation policy (AAGUID allow-list), and ceremony orchestration. |
Click to show internal directories.
Click to hide internal directories.