Documentation
¶
Overview ¶
Code generated by apic; DO NOT EDIT.
Code generated by apic; DO NOT EDIT.
Code generated by apic; DO NOT EDIT.
Code generated by apic; DO NOT EDIT.
Index ¶
- func NewInProcessResolvers(api apic.GeneratedServerInterface, ws genws.WSServerInterface, ...) *gqlx.Schema
- func NewProxyResolvers(baseURL string, authAPIKey, authJWT func(*http.Request) error, ...) *gqlx.Schema
- func RegisterGeneratedGQL(mux *http.ServeMux, schema *gqlx.Schema, opts GQLOptions)
- type GQLOptions
- type ProxyOption
- type ResolverOption
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func NewInProcessResolvers ¶
func NewInProcessResolvers(api apic.GeneratedServerInterface, ws genws.WSServerInterface, authAPIKey, authJWT func(*http.Request) error, authMTLS func(*http.Request, securex.MTLSPolicy) error, opts ...ResolverOption) *gqlx.Schema
NewInProcessResolvers builds a schema wired to the given server implementations.
func NewProxyResolvers ¶
func NewProxyResolvers(baseURL string, authAPIKey, authJWT func(*http.Request) error, authMTLS func(*http.Request, securex.MTLSPolicy) error, opts ...ProxyOption) *gqlx.Schema
NewProxyResolvers builds a schema that proxies to REST endpoints.
N-1 (AppSec): every proxy resolver enforces the same per-field authorization gate as the in-process resolvers (authorizeGraphQLField), fail-closed on a nil verifier. The verifiers MUST be supplied — passing nil for a field's required mode denies that field. This closes the prior fail-open gap where the proxy forwarded privileged operations (e.g. admin mutations) to upstream REST with no GraphQL-layer auth.
SECURITY: this proxy forwards the caller's Authorization and Cookie headers to the configured baseURL; baseURL is a generated constant (not attacker-controlled). baseURL SHOULD use https:// — an http:// baseURL forwards the caller's bearer token / session cookie to the upstream in cleartext. For mtls/cac/piv composite fields the TLS client certificate identity does NOT survive the proxy hop — the operator MUST supply an mTLS-configured http.Client (via WithHTTPClient) and/or the upstream must independently authenticate. The upstream MUST NOT trust network position alone.
func RegisterGeneratedGQL ¶
func RegisterGeneratedGQL(mux *http.ServeMux, schema *gqlx.Schema, opts GQLOptions)
RegisterGeneratedGQL mounts the GraphQL handler on the given mux.
Types ¶
type GQLOptions ¶
type GQLOptions struct {
Timeout time.Duration
MaxQueryBytes int
MaxBatchSize int
MaxDepth int
MaxComplexity int
MaxAliases int
Auth func(*http.Request) error
AllowGET bool
WSPath string
WSOriginAllowlist []string
MaxSubscriptions int
}
GQLOptions configures the GraphQL handler.
type ProxyOption ¶
type ProxyOption func(*proxyConfig)
ProxyOption configures the proxy resolver.
func WithHTTPClient ¶
func WithHTTPClient(c *http.Client) ProxyOption
WithHTTPClient sets the HTTP client for proxy requests.
func WithProxyMTLSRuntimes ¶ added in v0.18.3
func WithProxyMTLSRuntimes(rts map[string]securex.MTLSRuntime) ProxyOption
WithProxyMTLSRuntimes is the proxy-schema counterpart of WithMTLSRuntimes: it threads the boot-constructed per-route securex.MTLSRuntime map (keyed "METHOD /path", the same map APIOptions.MTLSRuntimes receives) into the proxy resolvers' composite mtls/cac/piv gates so they enforce the backing route's CRL/OCSP/CAC-PIV policy before forwarding (SEC-0078). Required -- NewProxyResolvers panics with securex.ErrMTLSRuntimeRequired otherwise -- whenever a composite mTLS field is backed by a route declaring mtls.crl/ocsp/cac_piv/principal_mapping.
type ResolverOption ¶ added in v0.18.3
type ResolverOption func(*resolverConfig)
ResolverOption configures NewInProcessResolvers.
func WithMTLSRuntimes ¶ added in v0.18.3
func WithMTLSRuntimes(rts map[string]securex.MTLSRuntime) ResolverOption
WithMTLSRuntimes threads the boot-constructed per-route securex.MTLSRuntime map -- the SAME map server.Serve hands to APIOptions.MTLSRuntimes, keyed "METHOD /path" -- into the GraphQL composite mtls/cac/piv gates, so a GraphQL query/mutation enforces the CRL/OCSP revocation, CAC/PIV certificate policy, and principal resolution of the REST route it dispatches to (SEC-0078). server.Serve wires this automatically; a hand-built schema for a spec whose composite mTLS fields are backed by a route with mtls.crl/ocsp/cac_piv/principal_mapping MUST pass it, or NewInProcessResolvers panics with securex.ErrMTLSRuntimeRequired.
Source Files