httpapi

package
v0.1.8 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 15, 2026 License: Apache-2.0 Imports: 112 Imported by: 0

Documentation

Overview

Package httpapi is the HTTP driving adapter: it maps routes to use case services.

Index

Constants

View Source 
const DefaultFleetTenant = shared.DefaultTenant

DefaultFleetTenant is the non-empty tenant id used when the principal is on the empty-string default tenant (single-tenant deployments). RLS-protected fleet tables cannot use the empty string, because under the 0057 policy the empty string is DENY, not a tenant. Mapping the empty default to a real, non-empty tenant here is what lets the fleet asset model work in a single-tenant deployment while still being isolated at the database. Migration 0058 seeds this tenant row so the fleet_assets FK to tenants is satisfied. It aliases shared.DefaultTenant (the inner-layer canonical value) so the two cannot drift.

View Source 
const FleetProtoVersion = "1"

FleetProtoVersion is the only agent protocol version this server supports. An agent must send it in X-Synapse-Fleet-Proto; a different value is refused rather than handled best-effort.

View Source 
const PrincipalOperator = "operator"

PrincipalOperator is the fallback principal id (the bootstrap admin also uses it, so historical "operator" attribution stays coherent). Once auth is wired, the real authenticated user is stamped into the context per request.

Variables

This section is empty.

Functions

func PrincipalFrom 

func PrincipalFrom(ctx context.Context) string

PrincipalFrom returns the authenticated principal's id from ctx (the value used as the actor on every attributable action), defaulting to operator if unset.

func TenantFrom 

func TenantFrom(ctx context.Context) string

TenantFrom returns the authenticated principal's tenant from ctx – the tenant that scopes the request's data and stamps new records. Empty = the single default tenant (single-tenant mode).

Types

type Authenticator 

type Authenticator struct {
	// contains filtered or unexported fields
}

Authenticator validates the bearer token on each request via the Resolver and stamps the resolved principal into the request context for attribution.

func NewAuthenticator 

func NewAuthenticator(resolve Resolver) *Authenticator

NewAuthenticator builds an authenticator from a token resolver.

func (*Authenticator) Middleware 

func (a *Authenticator) Middleware(publicPaths map[string]bool, next http.Handler) http.Handler

Middleware enforces a valid bearer token on every route except publicPaths (no anonymous access) and stamps the authenticated principal into the context.

type Principal 

type Principal struct {
	ID   string
	Name string
	Role string
	// TenantID is the tenant the principal belongs to – it scopes the request's data and stamps
	// new records. Empty = the single default tenant (single-tenant mode).
	TenantID string
}

Principal is the authenticated subject for a request.

type Resolver 

type Resolver func(ctx context.Context, token string) (Principal, bool)

Resolver maps a presented bearer token to a Principal. ok=false means the token is unknown/disabled (→ 401). Implemented over the users service in the wiring.

type Router 

type Router struct {
	// contains filtered or unexported fields
}

Router wires HTTP routes to use case services.

func NewRouter 

func NewRouter(log *slog.Logger, auth *Authenticator, eng *enguc.Service, sca *scauc.Service, aup *aupuc.Service, findings *findingsuc.Service, export *exportuc.Service, report *reportuc.Service, evidence *evidenceuc.Service, recon *reconuc.Service, logs ports.LogStream, transfer *transferuc.Service, audit *audituc.Service, vex *vexuc.Service, users *usersuc.Service, credentials *credentialsuc.Service) *Router

NewRouter builds the HTTP router.

func (*Router) EnableAgent 

func (rt *Router) EnableAgent(orch *orchestrator.Orchestrator, sessions ports.AgentSessionStore, approvals *approval.Service, approvalStore ports.ApprovalStore, queue ports.JobQueue, concurrency, queueDepth int)

EnableAgent wires the AI agent routes. concurrency bounds inline (non-durable) runs; queueDepth bounds the DURABLE path – the max number of not-yet-terminal agent jobs admitted before the API returns 503 (with Retry-After), so a flood / retry-storm / dead-letter re-drive cannot grow the jobs table without bound. Call after NewRouter; if never called the agent endpoints are not registered (fail-safe: SYNAPSE_AGENT_ENABLED=false leaves off).

func (*Router) Handler 

func (rt *Router) Handler() http.Handler

Handler returns the root http.Handler. Middleware chain (outermost first): normalize-path → auth → AUP gate → routes. Per-route RBAC is applied at registration via authz(perm, …) – not a path-set. Normalizing first ensures the public/AUP-exempt path-sets (matched on the request path) see exactly the path the ServeMux will route on (closes the raw-vs-cleaned path mismatch).

func (*Router) SetAITriageReviews added in v0.1.8 

func (rt *Router) SetAITriageReviews(s aiTriageReviewService)

SetAITriageReviews wires the tenant-scoped human review queue.

func (*Router) SetAgentDecisionStore 

func (rt *Router) SetAgentDecisionStore(ds ports.DecisionStore)

SetAgentDecisionStore wires the read-only decision log behind GET …/decisions.

func (*Router) SetAgentPlanStore 

func (rt *Router) SetAgentPlanStore(ps ports.PlanStore)

SetAgentPlanStore wires the read-only execution-plan view behind GET …/plan.

func (*Router) SetAgentRunContext 

func (rt *Router) SetAgentRunContext(ctx context.Context)

SetAgentRunContext binds inline agent runs to a server-lifetime context (cancelled on shutdown) so a SIGTERM stops in-flight runs instead of leaving detached goroutines.

func (*Router) SetAssets added in v0.1.8 

func (rt *Router) SetAssets(s assetService)

SetAssets wires the asset service and enables the asset routes.

func (*Router) SetAttackPaths added in v0.1.8 

func (rt *Router) SetAttackPaths(s attackPathService)

func (*Router) SetAutoVerifier 

func (rt *Router) SetAutoVerifier(s autoVerifierService)

SetAutoVerifier wires the optional automated LLM judgment-verifier (nil ⇒ the auto-verify route is not registered). It seals a distinct-verifier verdict on each proposed gated judgment.

func (*Router) SetBusinessAssets added in v0.1.8 

func (rt *Router) SetBusinessAssets(service businessAssetService)

func (*Router) SetCSPM added in v0.1.8 

func (rt *Router) SetCSPM(service *cspm.Service)

func (*Router) SetDASTScan added in v0.1.8 

func (rt *Router) SetDASTScan(s dastScanService)

SetDASTScan wires secret-free authenticated DAST scan endpoints.

func (*Router) SetDASTWorkflow 

func (rt *Router) SetDASTWorkflow(s dastWorkflowService)

SetDASTWorkflow wires the governed safe-DAST proposal/approval/run endpoints.

func (*Router) SetDetectionReader added in v0.1.8 

func (rt *Router) SetDetectionReader(r detectionReader)

SetDetectionReader wires the detection read routes (#423). Left unset, the routes report an empty ledger rather than 500 — the feature is simply not enabled.

func (*Router) SetExploitation 

func (rt *Router) SetExploitation(v findingVerifier)

SetExploitation wires the evidence-gated finding-verify endpoint.

func (*Router) SetFleet added in v0.1.8 

func (rt *Router) SetFleet(agents fleetAgentService, work fleetWorkService, now func() time.Time, clientCertHeader string)

SetFleet wires the untrusted agent transport plane. When nil, /api/v1/fleet is not served. clientCertHeader, when non-empty, is the header a trusted mutual-TLS-terminating proxy uses to pass the verified client certificate; empty disables certificate auth and uses the bearer token.

func (*Router) SetFleetAdmin added in v0.1.8 

func (rt *Router) SetFleetAdmin(s fleetAdminService)

SetFleetAdmin wires the operator agent-admin routes (mint enrolment token, list, revoke).

func (*Router) SetFleetClusterInventory added in v0.1.8 

func (rt *Router) SetFleetClusterInventory(s fleetClusterInventory)

SetFleetClusterInventory wires the cluster snapshot ingest use case onto the agent transport plane. It must be called after SetFleet; a nil fleet (transport disabled) makes it a no-op.

func (*Router) SetFleetCoverage added in v0.1.8 

func (rt *Router) SetFleetCoverage(s coverageService)

SetFleetCoverage wires the coverage read model and enables the coverage/agent-view routes.

func (*Router) SetFleetHostInventory added in v0.1.8 

func (rt *Router) SetFleetHostInventory(s fleetHostInventory)

SetFleetHostInventory wires the VM host inventory ingest use case onto the agent transport plane. It must be called after SetFleet; a nil fleet (transport disabled) makes it a no-op.

func (*Router) SetFleetRollout added in v0.1.8 

func (rt *Router) SetFleetRollout(d fleetRolloutDecider)

SetFleetRollout wires the operator-controlled update rollout (#412 req 9). Optional: with no decider wired the heartbeat offers no update at all, which is the fail-closed default — an absent rollout service must never read as permission to update.

func (*Router) SetFleetRolloutAdmin added in v0.1.8 

func (rt *Router) SetFleetRolloutAdmin(s fleetRolloutService)

SetFleetRolloutAdmin wires the operator routes. Optional: when nil they are not registered.

func (*Router) SetFleetVersionPolicy added in v0.1.8 

func (rt *Router) SetFleetVersionPolicy(minAgentVersion, cpVersion string)

SetFleetVersionPolicy wires the version-skew policy (#412): minAgentVersion is the minimum agent version allowed to claim work (empty = no floor), and cpVersion is the control-plane version advertised to agents so they can enforce their own minimum control-plane requirement. Must be called after SetFleet.

func (*Router) SetImportedFindings added in v0.1.8 

func (rt *Router) SetImportedFindings(r sarifReader)

SetImportedFindings wires the imported-finding read. Optional: when nil the route is not registered.

func (*Router) SetJudgments 

func (rt *Router) SetJudgments(s judgmentService)

SetJudgments wires the AI judgment lifecycle endpoints. nil ⇒ routes are not registered.

func (*Router) SetOffensiveKillSwitch added in v0.1.8 

func (rt *Router) SetOffensiveKillSwitch(ks offensiveKillSwitch)

SetOffensiveKillSwitch wires the red-team halt route (#418). Left unset, the route is not registered: an endpoint that accepts a halt and does nothing would be the worst possible failure for this control.

func (*Router) SetProjects 

func (rt *Router) SetProjects(s projectService)

func (*Router) SetPurpleCoverageReader added in v0.1.8 

func (rt *Router) SetPurpleCoverageReader(r purpleCoverageReader)

SetPurpleCoverageReader wires the purple-coverage read route (#426). Left unset, the route reports empty coverage rather than 500 — the feature is simply not enabled.

func (*Router) SetQualityGates 

func (rt *Router) SetQualityGates(s qualityGateService)

SetQualityGates wires quality gate management endpoints.

func (*Router) SetQualityProfiles 

func (rt *Router) SetQualityProfiles(s qualityProfileService)

SetQualityProfiles wires the quality-profile management endpoints. nil ⇒ routes are not registered.

func (*Router) SetRiskStoryReader added in v0.1.8 

func (rt *Router) SetRiskStoryReader(r riskStoryReader)

SetRiskStoryReader wires the risk-story read routes (#427). Left unset, the routes report an empty result rather than 500 — the correlation view is simply not enabled.

func (*Router) SetRules 

func (rt *Router) SetRules(s rulesService)

SetRules wires the rule catalog endpoints. nil ⇒ not registered.

func (*Router) SetRuntimeVerifier 

func (rt *Router) SetRuntimeVerifier(s runtimeVerifierService)

SetRuntimeVerifier wires typed runtime-verifier result ingestion. nil means the route is absent.

func (*Router) SetSARIFIngest added in v0.1.8 

func (rt *Router) SetSARIFIngest(s sarifIngester)

SetSARIFIngest wires the ingest usecase and enables the import route. Optional: when nil the route is not registered.

func (*Router) SetSLA added in v0.1.8 

func (rt *Router) SetSLA(service *slauc.Service)

SetSLA wires the opt-in risk-based remediation governance API.

func (*Router) SetThreatModel 

func (rt *Router) SetThreatModel(s threatModelService)

SetThreatModel wires the architecture threat-model ingest/read endpoints. nil ⇒ not registered.

func (*Router) SetVulnerabilityActions added in v0.1.8 

func (rt *Router) SetVulnerabilityActions(actions *vulnerabilityactionuc.Service)

func (*Router) SetVulnerabilityAudit added in v0.1.8 

func (rt *Router) SetVulnerabilityAudit(audit ports.AuditLogger)

func (*Router) SetVulnerabilityIntelligence added in v0.1.8 

func (rt *Router) SetVulnerabilityIntelligence(sources *vulnerabilitysourceuc.Service, monitor *vulnerabilitymonitor.Service)

SetVulnerabilityIntelligence wires source management and durable sync routes.

func (*Router) SetVulnerabilityReadModel added in v0.1.8 

func (rt *Router) SetVulnerabilityReadModel(service *vulnerabilityinteluc.Service)

func (*Router) SetVulnerabilityReconciliation added in v0.1.8 

func (rt *Router) SetVulnerabilityReconciliation(service *vulnerabilityreconciliation.Service)

func (*Router) SetWriteupDrafts 

func (rt *Router) SetWriteupDrafts(s writeupDraftService)

SetWriteupDrafts wires the human sign-off endpoints for AI-proposed write-up drafts. nil ⇒ not registered.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.