rest

type CtxAuthKey ¶

type CtxAuthKey string

type NoopPodTokenValidator ¶

type NoopPodTokenValidator struct{}

NoopPodTokenValidator trusts an explicit `X-Akash-Pod-Namespace` header instead of validating a token. Only wired when the operator explicitly opts out of TokenReview via the `--insecure-pod-metadata-auth` flag (PodMetadataConfig.InsecureAuth). Must never be used in production — RegisterPodMetadataRoutes emits an Error-level startup warning whenever it is active.

func (NoopPodTokenValidator) ValidatePodToken(_ context.Context, _ string, hint string) (string, error)

type PeersProxier ¶

type PeersProxier interface {
	// QueryContractSmart calls the contract `contractAddr` with the
	// supplied JSON-encoded smart query (e.g. `{"peers":{}}`) and
	// returns the raw `.data` JSON bytes from the chain.
	QueryContractSmart(ctx context.Context, contractAddr string, queryJSON []byte) ([]byte, error)
}

PeersProxier is the chain-query side of the metadata API. A production provider wires this up via its existing chain client (e.g. `cosmwasm/wasm/v1/contract/<addr>/smart`); the gateway only needs the abstract interface so it stays decoupled from any specific cosmos client SDK version.

type PodMetadataConfig ¶

type PodMetadataConfig struct {
	ClusterRead    cluster.ReadClient
	Peers          PeersProxier
	TokenValidator PodTokenValidator

	// InsecureAuth switches the API to NoopPodTokenValidator, which
	// trusts the caller-supplied X-Akash-Pod-Namespace header without
	// any TokenReview. Lab-only escape hatch behind the explicit
	// `--insecure-pod-metadata-auth` provider flag; the default (and
	// only safe production value) is false. Phase 3.2: this field is
	// the ONLY way to disable auth — the legacy
	// AKASH_PROVIDER_METADATA_TOKEN_REVIEW_DISABLED env var is
	// ignored except for a migration warning.
	InsecureAuth bool
}

PodMetadataConfig wires the pod-metadata sub-router. The three dependencies are optional; missing pieces degrade gracefully:

• nil ClusterRead → /metadata returns lease coords only, no services/ports.
• nil PeersProxier → /peers returns 501.
• nil TokenValidator → the API FAILS CLOSED (every request is rejected) unless InsecureAuth is explicitly set.

type PodMetadataForwardedPort ¶

type PodMetadataForwardedPort struct {
	Service      string `json:"service"`
	ExternalPort int32  `json:"external_port"`
	InternalPort int32  `json:"internal_port"`
	Protocol     string `json:"protocol"`
	Host         string `json:"host"`
}

PodMetadataForwardedPort is one row of the cluster's forwarded port table flattened into the wire shape pods expect.

type PodMetadataResponse ¶

type PodMetadataResponse struct {
	Owner          string                     `json:"owner"`
	DSeq           uint64                     `json:"dseq"`
	GSeq           uint32                     `json:"gseq"`
	OSeq           uint32                     `json:"oseq"`
	Provider       string                     `json:"provider"`
	Services       []string                   `json:"services,omitempty"`
	ForwardedPorts []PodMetadataForwardedPort `json:"forwarded_ports,omitempty"`
	Namespace      string                     `json:"namespace"`
}

PodMetadataResponse is the JSON returned by GET .../metadata.

Pods use `Owner` as their `AKASH_HA_CONTRACT_ADDR` (for contract-owned leases) and `ForwardedPorts` to compose connection strings without going through the chain.

type PodPeersResponse ¶

type PodPeersResponse struct {
	Contract string          `json:"contract"`
	Query    string          `json:"query"`
	Data     json.RawMessage `json:"data"`
}

PodPeersResponse wraps the proxied contract response so the pod-facing contract is stable even if the wasm side changes shape. `Data` is the raw JSON from the contract; pods decode it the same way they would today decoding the validator's `cosmwasm/wasm/v1/contract/.../smart/<base64-payload>` response.

type PodTokenValidator ¶

type PodTokenValidator interface {
	// ValidatePodToken returns the namespace claim from the token
	// (typically the pod's k8s namespace). Implementations must
	// return an error if the token is invalid, expired, or not
	// bound to a pod ServiceAccount.
	ValidatePodToken(ctx context.Context, bearerToken string, hint string) (namespace string, err error)
}

PodTokenValidator validates a pod-provided Bearer token and returns the namespace the pod is running in. Implementations typically wrap k8s `TokenReview`; the lab/dev path uses `NewNoopPodTokenValidator` which accepts any token and trusts the URL's `X-Akash-Pod-Namespace` header.