Documentation
¶
Overview ¶
Code generated by apic; DO NOT EDIT.
Code generated by apic; DO NOT EDIT.
Code generated by apic; DO NOT EDIT.
Code generated by apic; DO NOT EDIT.
Index ¶
- func NewInProcessResolvers(api apic.ServerInterface, ws genws.WSServerInterface, ...) *gqlx.Schema
- func NewProxyResolvers(baseURL string, authAPIKey, authJWT func(*http.Request) error, ...) *gqlx.Schema
- func RegisterGeneratedGQL(mux *http.ServeMux, schema *gqlx.Schema, opts GQLOptions)
- type GQLOptions
- type HandlerCounter
- type ProxyOption
- type ResolverOption
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func NewInProcessResolvers ¶
func NewInProcessResolvers(api apic.ServerInterface, ws genws.WSServerInterface, authAPIKey, authJWT func(*http.Request) error, authMTLS func(*http.Request, securex.MTLSPolicy) error, opts ...ResolverOption) *gqlx.Schema
NewInProcessResolvers builds a schema wired to the given server implementations.
func NewProxyResolvers ¶
func NewProxyResolvers(baseURL string, authAPIKey, authJWT func(*http.Request) error, authMTLS func(*http.Request, securex.MTLSPolicy) error, opts ...ProxyOption) *gqlx.Schema
NewProxyResolvers builds a schema that proxies to REST endpoints.
N-1 (AppSec): every proxy resolver enforces the same per-field authorization gate as the in-process resolvers (authorizeGraphQLField), fail-closed on a nil verifier. The verifiers MUST be supplied — passing nil for a field's required mode denies that field. This closes the prior fail-open gap where the proxy forwarded privileged operations (e.g. admin mutations) to upstream REST with no GraphQL-layer auth.
SECURITY: this proxy forwards the caller's Authorization and Cookie headers to the configured baseURL; baseURL is a generated constant (not attacker-controlled). baseURL SHOULD use https:// — an http:// baseURL forwards the caller's bearer token / session cookie to the upstream in cleartext. For mtls/cac/piv composite fields the TLS client certificate identity does NOT survive the proxy hop — the operator MUST supply an mTLS-configured http.Client (via WithHTTPClient) and/or the upstream must independently authenticate. The upstream MUST NOT trust network position alone.
func RegisterGeneratedGQL ¶
func RegisterGeneratedGQL(mux *http.ServeMux, schema *gqlx.Schema, opts GQLOptions)
RegisterGeneratedGQL mounts the GraphQL handler on the given mux.
Types ¶
type GQLOptions ¶
type GQLOptions struct {
Timeout time.Duration
MaxQueryBytes int
MaxBatchSize int
MaxDepth int
MaxComplexity int
MaxAliases int
Auth func(*http.Request) error
AllowGET bool
WSPath string
WSOriginAllowlist []string
MaxSubscriptions int
// ShutdownContext, when non-nil, bounds every graphql-ws connection the
// WSPath endpoint accepts: once it is cancelled, each open connection is
// closed with status 1001 (going away) and every subscription it runs is
// cancelled. http.Server.Shutdown neither closes nor waits for these
// hijacked connections, so a server that mounts this handler should cancel
// it when it shuts down; the generated Serve does (SONNY-792). The
// WebSocket handler a subscription runs in-process ends with the
// subscription, and at shutdown through NewInProcessResolvers'
// WithShutdownContext. Nil leaves each connection open until the client
// closes it or its idle timeout reaps it.
ShutdownContext context.Context
}
GQLOptions configures the GraphQL handler.
type HandlerCounter ¶ added in v0.23.0
type HandlerCounter interface {
Enter() bool
Leave()
}
HandlerCounter counts running handlers so a server's shutdown can wait for them. The vendored WebSocket runtime's HandlerGroup implements it: Enter admits a handler, or reports false once the server has begun waiting; Leave marks an admitted one finished.
type ProxyOption ¶
type ProxyOption func(*proxyConfig)
ProxyOption configures the proxy resolver.
func WithHTTPClient ¶
func WithHTTPClient(c *http.Client) ProxyOption
WithHTTPClient sets the HTTP client for proxy requests.
func WithProxyMTLSRuntimes ¶ added in v0.18.3
func WithProxyMTLSRuntimes(rts map[string]securex.MTLSRuntime) ProxyOption
WithProxyMTLSRuntimes is the proxy-schema counterpart of WithMTLSRuntimes: it threads the boot-constructed per-route securex.MTLSRuntime map (keyed "METHOD /path", the same map APIOptions.MTLSRuntimes receives) into the proxy resolvers' composite mtls/cac/piv gates so they enforce the backing route's CRL/OCSP/CAC-PIV policy before forwarding (SEC-0078). Required -- NewProxyResolvers panics with securex.ErrMTLSRuntimeRequired otherwise -- whenever a composite mTLS field is backed by a route declaring mtls.crl/ocsp/cac_piv/principal_mapping.
type ResolverOption ¶ added in v0.18.3
type ResolverOption func(*resolverConfig)
ResolverOption configures NewInProcessResolvers.
func WithHandlerGroup ¶ added in v0.23.0
func WithHandlerGroup(g HandlerCounter) ResolverOption
WithHandlerGroup counts, in g, every WebSocket handler the subscription fields run in-process, from the subscribe until the handler returns, so a server's shutdown can wait for them. Once g refuses Enter (a HandlerGroup does once its Wait has begun), a new subscription is refused. The generated Serve passes the HandlerGroup it waits on under its shutdown deadline (SONNY-792). It has no effect on a schema with no subscription fields.
func WithMTLSRuntimes ¶ added in v0.18.3
func WithMTLSRuntimes(rts map[string]securex.MTLSRuntime) ResolverOption
WithMTLSRuntimes threads the boot-constructed per-route securex.MTLSRuntime map -- the SAME map server.Serve hands to APIOptions.MTLSRuntimes, keyed "METHOD /path" -- into the GraphQL composite mtls/cac/piv gates, so a GraphQL query/mutation enforces the CRL/OCSP revocation, CAC/PIV certificate policy, and principal resolution of the REST route it dispatches to (SEC-0078). server.Serve wires this automatically; a hand-built schema for a spec whose composite mTLS fields are backed by a route with mtls.crl/ocsp/cac_piv/principal_mapping MUST pass it, or NewInProcessResolvers panics with securex.ErrMTLSRuntimeRequired.
func WithShutdownContext ¶ added in v0.23.0
func WithShutdownContext(ctx context.Context) ResolverOption
WithShutdownContext bounds the WebSocket handlers the subscription fields run in-process: once ctx is cancelled -- the server is shutting down -- each running handler's ctx is cancelled and its in-process connection closed, exactly as when its subscription ends, so a handler parked in conn.ReadMessage returns. The generated Serve passes the shutdown context it gives its WebSocket routes (SONNY-792); a hand-built schema should pass the one it cancels when it shuts down. Without it such a handler runs until its subscription ends. It has no effect on a schema with no subscription fields.
Source Files