Help us shape the future of Go! Take the 2026 Go Developer Survey

handler

package
v0.4.5 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 21, 2026 License: Apache-2.0 Imports: 87 Imported by: 0

Documentation

Overview

Package handler provides handler functionality for CheeseWAF.

Index

Constants

This section is empty.

Variables

View Source 
var (
	ErrApprovalCredentialRejected            = errors.New("approval credential was rejected")
	ErrApprovalVerifierUnavailable           = errors.New("approval credential verifier is unavailable")
	ErrApprovalCredentialVerifierUnavailable = ErrApprovalVerifierUnavailable
)
View Source 
var ErrMaterializedConfigPath = errors.New("materialized configuration path is required")

ErrMaterializedConfigPath identifies a handler that cannot provide the durable YAML boundary required by the node-local materializer.

View Source 
var ErrProtectionPolicyCoordinatorPreviewUnavailable = errors.New("protection policy coordinator preview is unavailable")

ErrProtectionPolicyCoordinatorPreviewUnavailable indicates that a wired policy consumer cannot bind an AI approval to a control-plane snapshot. The AI path must refuse the mutation rather than fall back to a local diff.

View Source 
var ErrProtectionPolicyCoordinatorUnavailable = errors.New("protection policy coordinator consumer is unavailable")

ErrProtectionPolicyCoordinatorUnavailable indicates that the end-to-end control-plane consumer was not deliberately wired. HTTP and AI write paths must surface this as unavailable instead of falling back to the node-local YAML/runtime writer.

View Source 
var ErrProtectionPolicyMutationUnavailable = errors.New("protection policy mutation service is unavailable")

ErrProtectionPolicyMutationUnavailable indicates that the desired-state mutation seam was not deliberately wired by the owning runtime. Returning this error keeps future adapters fail-closed instead of silently falling back to the legacy local config writer.

Functions

func ApplyAuthState 

func ApplyAuthState(h *Handler, state *AuthState)

func IsLocalApprovalTransport added in v0.4.5 

func IsLocalApprovalTransport(ctx context.Context) bool

IsLocalApprovalTransport reports whether the trusted server listener marked the connection as local control transport.

func WithLocalApprovalTransport added in v0.4.5 

func WithLocalApprovalTransport(ctx context.Context) context.Context

WithLocalApprovalTransport is only for the ConnContext of the dedicated local Unix-domain control listener. Never apply it to the public TCP listener.

Types

type ApprovalChallenge 

type ApprovalChallenge struct {
	ApprovalID                string        `json:"approval_id"`
	ConfirmationID            string        `json:"confirmation_id"`
	WarningStartedAt          time.Time     `json:"warning_started_at"`
	ExpiresAt                 time.Time     `json:"expires_at"`
	Language                  string        `json:"language"`
	Phrase                    string        `json:"phrase"`
	ConfirmationStep          uint8         `json:"confirmation_step"`
	RequiresThirdConfirmation bool          `json:"requires_third_confirmation"`
	Scope                     string        `json:"scope"`
	IntentDigest              string        `json:"intent_digest"`
	WorkflowDigest            string        `json:"workflow_digest,omitempty"`
	PolicyEpoch               uint64        `json:"policy_epoch"`
	TTL                       time.Duration `json:"ttl"`
	Nonce                     string        `json:"nonce"`
	SessionID                 string        `json:"session_id"`
}

ApprovalChallenge is the server-created state needed to complete one approval. WarningStartedAt, scope, intent, epoch, TTL and nonce are all authoritative server values.

type ApprovalCredentialProof 

type ApprovalCredentialProof struct {
	// contains filtered or unexported fields
}

ApprovalCredentialProof is an opaque result produced by a trusted credential verifier. Confirmation booleans are derived only from this proof and are never accepted from an HTTP payload.

func CombineApprovalCredentialProof added in v0.4.5 

func CombineApprovalCredentialProof(password, totp ApprovalCredentialProof) ApprovalCredentialProof

func NewApprovalCredentialProof 

func NewApprovalCredentialProof(token string, passwordConfirmed, totpConfirmed bool) ApprovalCredentialProof

NewApprovalCredentialProof creates a verifier-issued proof. The token must be non-empty; callers should use a short-lived, single-use value bound to the authenticated session and approval challenge.

func NewMFAApprovalCredentialProof added in v0.4.5 

func NewMFAApprovalCredentialProof(token string, passwordConfirmed, totpConfirmed, requiresTOTP bool) ApprovalCredentialProof

NewMFAApprovalCredentialProof marks a verified password as requiring the account's enrolled second factor before authorization may be committed.

func (ApprovalCredentialProof) PasswordConfirmed added in v0.4.5 

func (p ApprovalCredentialProof) PasswordConfirmed() bool

func (ApprovalCredentialProof) RequiresTOTP added in v0.4.5 

func (p ApprovalCredentialProof) RequiresTOTP() bool

func (ApprovalCredentialProof) TOTPConfirmed added in v0.4.5 

func (p ApprovalCredentialProof) TOTPConfirmed() bool

func (ApprovalCredentialProof) Token added in v0.4.5 

func (p ApprovalCredentialProof) Token() string

Accessors and CombineApprovalCredentialProof are used by production composition adapters without exposing mutable credential state.

type ApprovalCredentialVerifier 

type ApprovalCredentialVerifier func(ctx context.Context, session ApprovalSession, credential string) (ApprovalCredentialProof, error)

ApprovalCredentialVerifier verifies one operator credential against the authenticated server-side session and returns a proof. Implementations must not persist the supplied credential.

type ApprovalHTTPHandler 

type ApprovalHTTPHandler struct {
	// contains filtered or unexported fields
}

func NewApprovalHTTPHandler 

func NewApprovalHTTPHandler(opts ApprovalHTTPOptions) *ApprovalHTTPHandler

func (*ApprovalHTTPHandler) ConfirmApproval 

func (h *ApprovalHTTPHandler) ConfirmApproval(w http.ResponseWriter, r *http.Request)

ConfirmApproval validates credentials and feeds only server-bound fields to approval.Gate. The Gate mutex makes the final commit atomic under retries.

func (*ApprovalHTTPHandler) Mount 

func (h *ApprovalHTTPHandler) Mount(r chi.Router)

Mount registers the transport endpoints below the supplied router. If a session validator is configured, the current middleware session check is applied at the route boundary as well as by direct handler calls.

func (*ApprovalHTTPHandler) PolicyEpoch added in v0.4.0 

func (h *ApprovalHTTPHandler) PolicyEpoch() uint64

PolicyEpoch returns the epoch enforced by the underlying approval Gate. It deliberately reads the Gate rather than a duplicated provider field.

func (*ApprovalHTTPHandler) SessionValidator added in v0.4.0 

func (h *ApprovalHTTPHandler) SessionValidator() middleware.SessionValidator

SessionValidator returns the validator bound to this approval transport. Production composition uses this to keep approval sessions on the same management-store lifetime as the rest of the authenticated API.

func (*ApprovalHTTPHandler) StartApprovalConfirmation 

func (h *ApprovalHTTPHandler) StartApprovalConfirmation(w http.ResponseWriter, r *http.Request)

StartApprovalConfirmation starts the server-side warning window and creates a one-time confirmation ID.

func (*ApprovalHTTPHandler) SubmitApproval 

func (h *ApprovalHTTPHandler) SubmitApproval(w http.ResponseWriter, r *http.Request)

SubmitApproval creates an immutable request bound to the current session.

type ApprovalHTTPOptions 

type ApprovalHTTPOptions struct {
	Gate               *approval.Gate
	Clock              func() time.Time
	PasswordVerifier   ApprovalCredentialVerifier
	TOTPVerifier       ApprovalCredentialVerifier
	CredentialVerifier ApprovalCredentialVerifier
	SessionValidator   middleware.SessionValidator
	AuthorityResolver  approval.AuthorityResolver
}

type ApprovalSession 

type ApprovalSession struct {
	Subject    string `json:"subject"`
	SessionID  string `json:"session_id"`
	ID         string `json:"id,omitempty"`
	Username   string `json:"username,omitempty"`
	Role       string `json:"role,omitempty"`
	RemoteAddr string `json:"-"`
	Local      bool   `json:"-"`
}

ApprovalSession is derived from middleware.Claims. Fields supplied by an HTTP client are never used to construct this value.

type AuthState 

type AuthState struct {
	// contains filtered or unexported fields
}

AuthState groups ephemeral authentication state so multiple handlers can share one lifecycle. A distributed implementation can be introduced later without coupling the API package to a specific backend.

func NewAuthState 

func NewAuthState() *AuthState

type CRPActivationExecutor added in v0.4.0 

type CRPActivationExecutor interface {
	ExecuteCRPActivation(context.Context, activation.AsyncRequest) (activation.ActivationResult, error)
}

CRPActivationExecutor is the management-plane seam backed by the production activation service. The HTTP layer cannot inject a fence, confirmation or approval claim; it can only request an operation that the service must bind to an already-approved durable record.

type Handler 

type Handler struct {
	Config *config.Config

	ConfigPath            string
	Store                 storage.Store
	Sink                  storage.LogSink
	Tokens                *middleware.TokenManager
	Secret                string
	Auditor               *middleware.Auditor
	AssistantApprovals    *ai.ApprovalStore
	AssistantGateApproval *ai.GateApprovalAdapter

	Realtime *realtime.Hub

	TwoFAState          *twoFAState
	ClusterIdentity     *identity.MemoryIdentityService
	ClusterDeployTasks  *deploy.TaskManager
	ClusterDeployAuth   *deploy.AuthorizationStore
	ClusterDeployRunner deploy.TaskRunner
	ClusterHeartbeats   *cluster.HeartbeatRegistry

	ACMEIssuer             acme.Issuer
	TimeSync               TimeSyncService
	OTAClient              OTAClient
	OTAState               OTAStateReader
	TemporaryHTTPExecutor  netlease.TemporaryHTTPExecutor
	CWEDPDownload          consumer.Executor
	CRPActivation          CRPActivationExecutor
	LoginCAPTCHAState      *loginCAPTCHAState
	CAPTCHAAssets          captchaassets.Store
	CAPTCHAAssetReferences *captchaassets.ReferenceManager
	CAPTCHAAssetInitError  error

	StartedAt        time.Time
	SetupToken       string
	SetupTokenSource setup.TokenSource
	SetupDrafts      *setup.DraftStore

	OnSitesChanged            func([]config.SiteConfig) error
	OnEdgeChanged             func(config.EdgeConfig) error
	OnProtectionChanged       func(config.ProtectionConfig) error
	OnCAPTCHAProvidersChanged func(config.CAPTCHAProvidersConfig) error

	OnAPISecChanged    func(config.APISecConfig) error
	OnBlockPageChanged func(config.BlockPageConfig) error
	OnTimeSyncChanged  func(config.TimeSyncConfig) error
	// OnConfigChanged publishes a completed setup/config snapshot to the
	// serving composition root. Setup changes the entrance gate itself.
	OnConfigChanged func(*config.Config) error
	// contains filtered or unexported fields
}

func New 

func New(opts Options) *Handler

func (*Handler) ACMEDNSProviders 

func (h *Handler) ACMEDNSProviders(w http.ResponseWriter, r *http.Request)

func (*Handler) AIAssistant 

func (h *Handler) AIAssistant(w http.ResponseWriter, r *http.Request)

func (*Handler) AIAssistantStream 

func (h *Handler) AIAssistantStream(w http.ResponseWriter, r *http.Request)

func (*Handler) AIConfig 

func (h *Handler) AIConfig(w http.ResponseWriter, _ *http.Request)

func (*Handler) AIModels 

func (h *Handler) AIModels(w http.ResponseWriter, r *http.Request)

func (*Handler) AIOpsProviders 

func (h *Handler) AIOpsProviders(w http.ResponseWriter, r *http.Request)

AIOpsProviders returns non-sensitive provider readiness, balance, and upstream usage metadata for the assistant and reasoning configurations.

func (*Handler) AIOpsUsage 

func (h *Handler) AIOpsUsage(w http.ResponseWriter, r *http.Request)

AIOpsUsage returns bounded process-local provider accounting. Raw events are intentionally never exposed by HTTP.

func (*Handler) AITools 

func (h *Handler) AITools(w http.ResponseWriter, _ *http.Request)

func (*Handler) APIEndpoints 

func (h *Handler) APIEndpoints(w http.ResponseWriter, r *http.Request)

func (*Handler) ActivateCRP added in v0.4.0 

func (h *Handler) ActivateCRP(w http.ResponseWriter, r *http.Request)

func (*Handler) AdoptThreatIntel 

func (h *Handler) AdoptThreatIntel(w http.ResponseWriter, r *http.Request)

func (*Handler) AnalyzeEvents 

func (h *Handler) AnalyzeEvents(w http.ResponseWriter, r *http.Request)

func (*Handler) AnalyzeEventsStream 

func (h *Handler) AnalyzeEventsStream(w http.ResponseWriter, r *http.Request)

func (*Handler) AnalyzeLog 

func (h *Handler) AnalyzeLog(w http.ResponseWriter, r *http.Request)

func (*Handler) AnalyzeLogStream 

func (h *Handler) AnalyzeLogStream(w http.ResponseWriter, r *http.Request)

func (*Handler) ApplyGeneratedCustomRule 

func (h *Handler) ApplyGeneratedCustomRule(ctx context.Context, rule *storage.Rule) error

ApplyGeneratedCustomRule is the only internal path for automated rule creation. It uses the same validation, persistence, hot reload and rollback flow as the management API.

func (*Handler) ApplyProtectionRuntime added in v0.4.0 

func (h *Handler) ApplyProtectionRuntime(candidate *config.Config) error

ApplyProtectionRuntime validates a complete local candidate and applies only its protection runtime snapshot. Persistence and control-plane coordination stay with the caller's transaction boundary.

func (*Handler) ApproveAIApproval 

func (h *Handler) ApproveAIApproval(w http.ResponseWriter, r *http.Request)

func (*Handler) AttackMapAggregate 

func (h *Handler) AttackMapAggregate(w http.ResponseWriter, r *http.Request)

AttackMapAggregate returns bounded, incremental security-event projections for the map views. It deliberately omits payload, user-agent, and arbitrary metadata so a frequently refreshed display cannot pull large evidence blobs.

func (*Handler) AuditEntries 

func (h *Handler) AuditEntries(w http.ResponseWriter, _ *http.Request)

func (*Handler) AuditMiddleware added in v0.4.5 

func (h *Handler) AuditMiddleware(next http.Handler) http.Handler

AuditMiddleware records management activity using the same source policy as login.

func (*Handler) AuthenticateManagementAPIToken 

func (h *Handler) AuthenticateManagementAPIToken(raw string, at time.Time) (*middleware.Claims, func(), bool)

func (*Handler) BindProtectionPolicyCoordinator added in v0.4.0 

func (h *Handler) BindProtectionPolicyCoordinator(consumer ProtectionPolicyCoordinatorConsumer) error

BindProtectionPolicyCoordinator is the production composition seam. It is called exactly once before any listener starts; nil and replacement binds are rejected so a healthy server cannot downgrade to a local write path.

func (*Handler) BlockPageConfig 

func (h *Handler) BlockPageConfig(w http.ResponseWriter, _ *http.Request)

func (*Handler) BlockPageTemplates 

func (h *Handler) BlockPageTemplates(w http.ResponseWriter, _ *http.Request)

func (*Handler) BootstrapSession 

func (h *Handler) BootstrapSession(w http.ResponseWriter, r *http.Request)

BootstrapSession migrates a valid Authorization Bearer JWT into HttpOnly cookies and rotates jti.

func (*Handler) BotChallengeMetrics 

func (h *Handler) BotChallengeMetrics(w http.ResponseWriter, r *http.Request)

func (*Handler) ChinaMapBoundary 

func (h *Handler) ChinaMapBoundary(w http.ResponseWriter, r *http.Request)

func (*Handler) ChinaMapBoundaryByCode 

func (h *Handler) ChinaMapBoundaryByCode(w http.ResponseWriter, r *http.Request)

func (*Handler) CleanupManagementAPITokens 

func (h *Handler) CleanupManagementAPITokens(now time.Time) (int, error)

CleanupManagementAPITokens removes expired or inactive management tokens in one committed configuration mutation. It is deliberately separate from the request authentication path so a scheduler can call it from one worker and avoid a scan on every API request. The removed metadata is emitted to the audit stream and administrator notifications after the durable mutation; notification failures do not resurrect a credential.

func (*Handler) CleanupStorage 

func (h *Handler) CleanupStorage(w http.ResponseWriter, r *http.Request)

func (*Handler) ClearNotifications 

func (h *Handler) ClearNotifications(w http.ResponseWriter, r *http.Request)

func (*Handler) ClusterAnsiblePackage 

func (h *Handler) ClusterAnsiblePackage(w http.ResponseWriter, r *http.Request)

func (*Handler) ClusterAudit 

func (h *Handler) ClusterAudit(w http.ResponseWriter, _ *http.Request)

func (*Handler) ClusterBootstrapPlan 

func (h *Handler) ClusterBootstrapPlan(w http.ResponseWriter, r *http.Request)

ClusterBootstrapPlan mints a join token and returns install/join operator steps (M2 close-out).

func (*Handler) ClusterConsensusStatus 

func (h *Handler) ClusterConsensusStatus(w http.ResponseWriter, r *http.Request)

ClusterConsensusStatus returns the configured coordinator view (leader, role, freeze).

func (*Handler) ClusterCreateJoinToken 

func (h *Handler) ClusterCreateJoinToken(w http.ResponseWriter, r *http.Request)

func (*Handler) ClusterDeployCheck 

func (h *Handler) ClusterDeployCheck(w http.ResponseWriter, r *http.Request)

func (*Handler) ClusterDeployRun 

func (h *Handler) ClusterDeployRun(w http.ResponseWriter, r *http.Request)

func (*Handler) ClusterGetDeployTask 

func (h *Handler) ClusterGetDeployTask(w http.ResponseWriter, r *http.Request)

func (*Handler) ClusterGetRollingUpgrade 

func (h *Handler) ClusterGetRollingUpgrade(w http.ResponseWriter, r *http.Request)

func (*Handler) ClusterHealth 

func (h *Handler) ClusterHealth(w http.ResponseWriter, r *http.Request)

func (*Handler) ClusterJoin 

func (h *Handler) ClusterJoin(w http.ResponseWriter, r *http.Request)

func (*Handler) ClusterListDeployTasks 

func (h *Handler) ClusterListDeployTasks(w http.ResponseWriter, r *http.Request)

func (*Handler) ClusterListJoinTokens 

func (h *Handler) ClusterListJoinTokens(w http.ResponseWriter, r *http.Request)

func (*Handler) ClusterListNodes 

func (h *Handler) ClusterListNodes(w http.ResponseWriter, r *http.Request)

func (*Handler) ClusterListRollingUpgrades 

func (h *Handler) ClusterListRollingUpgrades(w http.ResponseWriter, r *http.Request)

func (*Handler) ClusterNodeHeartbeat 

func (h *Handler) ClusterNodeHeartbeat(w http.ResponseWriter, r *http.Request)

func (*Handler) ClusterProposeConfigVersion 

func (h *Handler) ClusterProposeConfigVersion(w http.ResponseWriter, r *http.Request)

ClusterProposeConfigVersion records a config version on the writable leader.

func (*Handler) ClusterRevokeJoinToken 

func (h *Handler) ClusterRevokeJoinToken(w http.ResponseWriter, r *http.Request)

func (*Handler) ClusterRevokeNode 

func (h *Handler) ClusterRevokeNode(w http.ResponseWriter, r *http.Request)

func (*Handler) ClusterRotateNodeCertificate 

func (h *Handler) ClusterRotateNodeCertificate(w http.ResponseWriter, r *http.Request)

func (*Handler) ClusterStartDeployTask 

func (h *Handler) ClusterStartDeployTask(w http.ResponseWriter, r *http.Request)

func (*Handler) ClusterStartRollingRollback 

func (h *Handler) ClusterStartRollingRollback(w http.ResponseWriter, r *http.Request)

ClusterStartRollingRollback starts reverse-order reinstall for a finished rolling job.

func (*Handler) ClusterStartRollingUpgrade 

func (h *Handler) ClusterStartRollingUpgrade(w http.ResponseWriter, r *http.Request)

ClusterStartRollingUpgrade starts sequential multi-node binary upgrades (M2 close-out).

func (*Handler) ClusterStatus 

func (h *Handler) ClusterStatus(w http.ResponseWriter, r *http.Request)

func (*Handler) ClusterTrafficPeerReport 

func (h *Handler) ClusterTrafficPeerReport(w http.ResponseWriter, r *http.Request)

ClusterTrafficPeerReport records circuit success/failure for a peer (write path).

func (*Handler) ClusterTrafficPeers 

func (h *Handler) ClusterTrafficPeers(w http.ResponseWriter, r *http.Request)

ClusterTrafficPeers returns mesh peers eligible for M4 traffic scheduling.

func (*Handler) ConfigReadMiddleware 

func (h *Handler) ConfigReadMiddleware(next http.Handler) http.Handler

ConfigReadMiddleware is retained as a routing compatibility hook. Request handlers read immutable atomic snapshots, so long-lived GETs such as SSE and WebSocket connections must not hold the mutation lock for their lifetime.

func (*Handler) ConfigSnapshot added in v0.4.0 

func (h *Handler) ConfigSnapshot(ctx context.Context) (*config.Config, error)

ConfigSnapshot returns an isolated copy of the current complete local configuration. The materializer uses this as its read boundary; callers must not receive the atomic request snapshot itself because Config contains maps and slices that would otherwise be mutable through aliasing.

func (*Handler) ConfirmAIApproval added in v0.4.5 

func (h *Handler) ConfirmAIApproval(w http.ResponseWriter, r *http.Request)

ConfirmAIApproval completes one checkpoint of the strict destructive AI approval flow. Credentials are verified by the production adapter against the current management session; client confirmation booleans are ignored.

func (*Handler) ContinueAIApprovalStream 

func (h *Handler) ContinueAIApprovalStream(w http.ResponseWriter, r *http.Request)

func (*Handler) CreateManagementAPIToken 

func (h *Handler) CreateManagementAPIToken(w http.ResponseWriter, r *http.Request)

func (*Handler) CreateRule 

func (h *Handler) CreateRule(w http.ResponseWriter, r *http.Request)

func (*Handler) CreateSite 

func (h *Handler) CreateSite(w http.ResponseWriter, r *http.Request)

func (*Handler) CreateUser 

func (h *Handler) CreateUser(w http.ResponseWriter, r *http.Request)

func (*Handler) CurrentPermissions 

func (h *Handler) CurrentPermissions() middleware.PermissionMap

func (*Handler) DecideReviewItem 

func (h *Handler) DecideReviewItem(w http.ResponseWriter, r *http.Request)

func (*Handler) DeleteCAPTCHAAsset 

func (h *Handler) DeleteCAPTCHAAsset(w http.ResponseWriter, r *http.Request)

func (*Handler) DeleteCustomBlockPage 

func (h *Handler) DeleteCustomBlockPage(w http.ResponseWriter, r *http.Request)

func (*Handler) DeleteRule 

func (h *Handler) DeleteRule(w http.ResponseWriter, r *http.Request)

func (*Handler) DeleteSite 

func (h *Handler) DeleteSite(w http.ResponseWriter, r *http.Request)

func (*Handler) DisableUser2FA 

func (h *Handler) DisableUser2FA(w http.ResponseWriter, r *http.Request)

func (*Handler) DownloadCWEDP added in v0.4.0 

func (h *Handler) DownloadCWEDP(w http.ResponseWriter, r *http.Request)

DownloadCWEDP executes one authenticated, durable transfer and stages the admitted CRP. It never promotes, activates, or starts the staged package.

func (*Handler) EdgePolicy 

func (h *Handler) EdgePolicy(w http.ResponseWriter, _ *http.Request)

func (*Handler) EnableUser2FA 

func (h *Handler) EnableUser2FA(w http.ResponseWriter, r *http.Request)

func (*Handler) ExampleCustomRules 

func (h *Handler) ExampleCustomRules(w http.ResponseWriter, r *http.Request)

func (*Handler) ExecuteAITool 

func (h *Handler) ExecuteAITool(w http.ResponseWriter, r *http.Request)

func (*Handler) ExportBackup 

func (h *Handler) ExportBackup(w http.ResponseWriter, _ *http.Request)

func (*Handler) ExportCustomRules 

func (h *Handler) ExportCustomRules(w http.ResponseWriter, r *http.Request)

func (*Handler) ExportThreatIntel 

func (h *Handler) ExportThreatIntel(w http.ResponseWriter, r *http.Request)

func (*Handler) GetAIApproval 

func (h *Handler) GetAIApproval(w http.ResponseWriter, r *http.Request)

func (*Handler) GetCAPTCHAAssetConfig 

func (h *Handler) GetCAPTCHAAssetConfig(w http.ResponseWriter, _ *http.Request)

func (*Handler) GetReviewItem 

func (h *Handler) GetReviewItem(w http.ResponseWriter, r *http.Request)

func (*Handler) GetSite 

func (h *Handler) GetSite(w http.ResponseWriter, r *http.Request)

func (*Handler) Health 

func (h *Handler) Health(w http.ResponseWriter, _ *http.Request)

func (*Handler) ImportCustomRules 

func (h *Handler) ImportCustomRules(w http.ResponseWriter, r *http.Request)

func (*Handler) ImportNginx 

func (h *Handler) ImportNginx(w http.ResponseWriter, r *http.Request)

func (*Handler) ImportThreatIntel 

func (h *Handler) ImportThreatIntel(w http.ResponseWriter, r *http.Request)

func (*Handler) IssueCAPTCHAAssetPreview 

func (h *Handler) IssueCAPTCHAAssetPreview(w http.ResponseWriter, r *http.Request)

func (*Handler) IssueCaptchaLabChallenge 

func (h *Handler) IssueCaptchaLabChallenge(w http.ResponseWriter, r *http.Request)

func (*Handler) IssueSiteACME 

func (h *Handler) IssueSiteACME(w http.ResponseWriter, r *http.Request)

func (*Handler) ListAIApprovals 

func (h *Handler) ListAIApprovals(w http.ResponseWriter, r *http.Request)

func (*Handler) ListCAPTCHAAssets 

func (h *Handler) ListCAPTCHAAssets(w http.ResponseWriter, r *http.Request)

func (*Handler) ListCustomRules 

func (h *Handler) ListCustomRules(ctx context.Context) ([]storage.Rule, error)

ListCustomRules exposes the live site-scoped rules to internal automation.

func (*Handler) ListIPRules 

func (h *Handler) ListIPRules(w http.ResponseWriter, r *http.Request)

func (*Handler) ListLogs 

func (h *Handler) ListLogs(w http.ResponseWriter, r *http.Request)

func (*Handler) ListManagementAPITokens 

func (h *Handler) ListManagementAPITokens(w http.ResponseWriter, _ *http.Request)

func (*Handler) ListNotifications 

func (h *Handler) ListNotifications(w http.ResponseWriter, r *http.Request)

func (*Handler) ListReviewItems 

func (h *Handler) ListReviewItems(w http.ResponseWriter, r *http.Request)

func (*Handler) ListRules 

func (h *Handler) ListRules(w http.ResponseWriter, r *http.Request)

func (*Handler) ListSites 

func (h *Handler) ListSites(w http.ResponseWriter, r *http.Request)

func (*Handler) ListTasks 

func (h *Handler) ListTasks(w http.ResponseWriter, _ *http.Request)

func (*Handler) ListUsers 

func (h *Handler) ListUsers(w http.ResponseWriter, r *http.Request)

func (*Handler) Login 

func (h *Handler) Login(w http.ResponseWriter, r *http.Request)

func (*Handler) LoginCAPTCHA 

func (h *Handler) LoginCAPTCHA(w http.ResponseWriter, r *http.Request)

func (*Handler) LoginOptions 

func (h *Handler) LoginOptions(w http.ResponseWriter, _ *http.Request)

func (*Handler) Logout 

func (h *Handler) Logout(w http.ResponseWriter, r *http.Request)

func (*Handler) LookupThreatIntel 

func (h *Handler) LookupThreatIntel(w http.ResponseWriter, r *http.Request)

func (*Handler) MarkAllNotificationsRead 

func (h *Handler) MarkAllNotificationsRead(w http.ResponseWriter, r *http.Request)

func (*Handler) Metrics 

func (h *Handler) Metrics(w http.ResponseWriter, r *http.Request)

func (*Handler) MonitorSummary 

func (h *Handler) MonitorSummary(w http.ResponseWriter, r *http.Request)

func (*Handler) NextManagementAPITokenCleanupAt 

func (h *Handler) NextManagementAPITokenCleanupAt() time.Time

NextManagementAPITokenCleanupAt exposes the coalesced cleanup deadline to a service scheduler. It does not force a scan or perform any mutation.

func (*Handler) OTAStatus added in v0.4.0 

func (h *Handler) OTAStatus(w http.ResponseWriter, r *http.Request)

OTAStatus performs a read-only index check when a client has been wired by the launcher. A candidate is informational until CRP/CWEDP activation and approval are available, so this endpoint never installs or changes config.

func (*Handler) PersistMaterializedConfig added in v0.4.0 

func (h *Handler) PersistMaterializedConfig(ctx context.Context, candidate *config.Config) error

PersistMaterializedConfig validates and persists a complete local candidate for the node-local materializer. It deliberately does not publish the candidate or apply runtime side effects: the orchestrator owns the YAML/runtime/journal ordering and compensation boundary.

The candidate is cloned before validation so EnsureRuntimeSecrets and any validation normalization cannot mutate the caller's materializer state.

func (*Handler) PrepareProtectionPolicyMutation added in v0.4.0 

func (h *Handler) PrepareProtectionPolicyMutation(request desiredstate.ProtectionPolicyMutationRequest) (desiredstate.ProtectionPolicyMutation, error)

PrepareProtectionPolicyMutation prepares a desired-state proposal from the handler's immutable policy snapshot. This method has no persistence, runtime-apply, HTTP, or coordinator side effects. The current production router leaves the mutator unset; a later lifecycle owner may inject it once proposal submission and materialization are fully wired.

func (*Handler) PreviewBlockPageConfig 

func (h *Handler) PreviewBlockPageConfig(w http.ResponseWriter, r *http.Request)

func (*Handler) PreviewCAPTCHAAsset 

func (h *Handler) PreviewCAPTCHAAsset(w http.ResponseWriter, r *http.Request)

func (*Handler) Protection 

func (h *Handler) Protection(w http.ResponseWriter, _ *http.Request)

func (*Handler) PublishMaterializedConfig added in v0.4.0 

func (h *Handler) PublishMaterializedConfig(ctx context.Context, candidate *config.Config) error

PublishMaterializedConfig publishes a candidate only after its caller has persisted YAML and applied the runtime. It deliberately has no persistence or runtime side effect of its own; the materializer journal is the ordering authority. Callers must hold WithProtectionPolicyMaterialization.

func (*Handler) ReclaimSystemResources 

func (h *Handler) ReclaimSystemResources(w http.ResponseWriter, r *http.Request)

func (*Handler) RecoverUser2FA 

func (h *Handler) RecoverUser2FA(w http.ResponseWriter, r *http.Request)

func (*Handler) RefreshToken 

func (h *Handler) RefreshToken(w http.ResponseWriter, r *http.Request)

func (*Handler) RejectAIApproval 

func (h *Handler) RejectAIApproval(w http.ResponseWriter, r *http.Request)

func (*Handler) ReloadLiveConfig 

func (h *Handler) ReloadLiveConfig(next *config.Config) error

ReloadLiveConfig applies the file-backed settings that the running process can actually hot-apply (sites, edge, protection, API security, block page, time sync). Listen addresses, TLS files, storage backends, and other restart-only fields stay on the previous snapshot so APIs do not report them as live. Store site replacement is restored as a whole if any write fails.

func (*Handler) RenewACMEOnce added in v0.4.5 

func (h *Handler) RenewACMEOnce(ctx context.Context) error

RenewACMEOnce performs one deterministic renewal/expiry scan. It is exposed for startup checks and tests; it never starts a background goroutine.

func (*Handler) ReportUIError 

func (h *Handler) ReportUIError(w http.ResponseWriter, r *http.Request)

func (*Handler) ReselectTimeSync 

func (h *Handler) ReselectTimeSync(w http.ResponseWriter, r *http.Request)

func (*Handler) RestoreBackup 

func (h *Handler) RestoreBackup(w http.ResponseWriter, r *http.Request)

func (*Handler) RevokeManagementAPIToken 

func (h *Handler) RevokeManagementAPIToken(w http.ResponseWriter, r *http.Request)

func (*Handler) RollbackCRP added in v0.4.0 

func (h *Handler) RollbackCRP(w http.ResponseWriter, r *http.Request)

func (*Handler) RunAISelfLearning 

func (h *Handler) RunAISelfLearning(w http.ResponseWriter, r *http.Request)

func (*Handler) SessionInfo 

func (h *Handler) SessionInfo(w http.ResponseWriter, r *http.Request)

SessionInfo returns the current browser session (cookie or bearer) for SPA auth gates.

func (*Handler) SetClusterApprovalHTTP added in v0.4.5 

func (h *Handler) SetClusterApprovalHTTP(boundary *ApprovalHTTPHandler)

SetClusterApprovalHTTP shares the durable approval boundary with cluster enrollment and certificate rotation. Composition calls it before serving.

func (*Handler) Setup 

func (h *Handler) Setup(w http.ResponseWriter, r *http.Request)

func (*Handler) SetupDraftGet 

func (h *Handler) SetupDraftGet(w http.ResponseWriter, r *http.Request)

SetupDraftGet returns the current setup draft for the session cookie.

func (*Handler) SetupDraftPatch 

func (h *Handler) SetupDraftPatch(w http.ResponseWriter, r *http.Request)

SetupDraftPatch updates multi-step wizard fields. CompleteSetup remains a separate final call.

func (*Handler) SetupPostgreSQLTest added in v0.4.0 

func (h *Handler) SetupPostgreSQLTest(w http.ResponseWriter, r *http.Request)

SetupPostgreSQLTest validates and pings the operator-supplied PostgreSQL endpoint while the setup lock is still open. Setup is a capability-gated, local-first flow, so private hosts are allowed here; this endpoint never persists the submitted values.

func (*Handler) SetupProbe 

func (h *Handler) SetupProbe(w http.ResponseWriter, r *http.Request)

SetupProbe runs the first-install performance probe (R0). Only meaningful when NeedsSetup.

func (*Handler) SetupStatus 

func (h *Handler) SetupStatus(w http.ResponseWriter, r *http.Request)

SetupStatus reports whether first-install is still required. Setup credentials are delivered only through the serve process's stdout/runtime URL file.

func (*Handler) SetupUser2FA 

func (h *Handler) SetupUser2FA(w http.ResponseWriter, r *http.Request)

func (*Handler) SetupVictoriaLogsTest added in v0.4.0 

func (h *Handler) SetupVictoriaLogsTest(w http.ResponseWriter, r *http.Request)

SetupVictoriaLogsTest performs a read-only HTTP probe against the configured write endpoint. A 4xx response still proves the service is reachable (the endpoint may only accept POST); 5xx and transport failures are reported as connectivity errors. No log payload is written during the probe.

func (*Handler) StartACMERenewal added in v0.4.5 

func (h *Handler) StartACMERenewal(ctx context.Context) context.CancelFunc

StartACMERenewal starts the in-process ACME renewal worker. The first scan runs immediately; subsequent scans use a conservative hourly interval. The caller owns ctx and should cancel it with the rest of the serving runtime.

func (*Handler) StartAIApprovalConfirmation added in v0.4.5 

func (h *Handler) StartAIApprovalConfirmation(w http.ResponseWriter, r *http.Request)

StartAIApprovalConfirmation opens the server-held warning window for a destructive AI approval. The adapter owns the challenge and binds it to the authenticated approver session; request body identity fields are ignored.

func (*Handler) StartManagementAPITokenCleanup 

func (h *Handler) StartManagementAPITokenCleanup(ctx context.Context)

StartManagementAPITokenCleanup starts the single coalesced worker used by the service process. Calling it more than once is harmless. The worker is intentionally independent from request goroutines and stops with ctx.

func (*Handler) Stats 

func (h *Handler) Stats(w http.ResponseWriter, _ *http.Request)

func (*Handler) StopACMERenewal added in v0.4.5 

func (h *Handler) StopACMERenewal()

StopACMERenewal stops the currently running renewal worker, if any.

func (*Handler) StorageStats 

func (h *Handler) StorageStats(w http.ResponseWriter, _ *http.Request)

func (*Handler) SyncThreatIntel 

func (h *Handler) SyncThreatIntel(w http.ResponseWriter, r *http.Request)

func (*Handler) SyncTimeNow 

func (h *Handler) SyncTimeNow(w http.ResponseWriter, r *http.Request)

func (*Handler) System 

func (h *Handler) System(w http.ResponseWriter, _ *http.Request)

func (*Handler) TaskHistory 

func (h *Handler) TaskHistory(w http.ResponseWriter, _ *http.Request)

func (*Handler) TemporaryHTTP added in v0.4.0 

func (h *Handler) TemporaryHTTP(w http.ResponseWriter, r *http.Request)

TemporaryHTTP executes exactly one administrator-approved HTTPS operation. It is intentionally mounted only inside the authenticated management API; the executor owns fresh session/confirmation/lease creation and cleanup.

func (*Handler) TestAIConnection 

func (h *Handler) TestAIConnection(w http.ResponseWriter, r *http.Request)

func (*Handler) TestCAPTCHAAssetConfig 

func (h *Handler) TestCAPTCHAAssetConfig(w http.ResponseWriter, r *http.Request)

func (*Handler) TestStorageBackend 

func (h *Handler) TestStorageBackend(w http.ResponseWriter, r *http.Request)

func (*Handler) TestThreatIntelProvider 

func (h *Handler) TestThreatIntelProvider(w http.ResponseWriter, r *http.Request)

func (*Handler) TimeSyncStatus 

func (h *Handler) TimeSyncStatus(w http.ResponseWriter, _ *http.Request)

func (*Handler) UpdateACLRules 

func (h *Handler) UpdateACLRules(w http.ResponseWriter, r *http.Request)

func (*Handler) UpdateAIConfig 

func (h *Handler) UpdateAIConfig(w http.ResponseWriter, r *http.Request)

func (*Handler) UpdateBlockPageConfig 

func (h *Handler) UpdateBlockPageConfig(w http.ResponseWriter, r *http.Request)

func (*Handler) UpdateBotProtection 

func (h *Handler) UpdateBotProtection(w http.ResponseWriter, r *http.Request)

func (*Handler) UpdateCAPTCHAAssetConfig 

func (h *Handler) UpdateCAPTCHAAssetConfig(w http.ResponseWriter, r *http.Request)

func (*Handler) UpdateEdgePolicy 

func (h *Handler) UpdateEdgePolicy(w http.ResponseWriter, r *http.Request)

func (*Handler) UpdateIPAccessRules 

func (h *Handler) UpdateIPAccessRules(w http.ResponseWriter, r *http.Request)

func (*Handler) UpdateIPReputationOverrides 

func (h *Handler) UpdateIPReputationOverrides(w http.ResponseWriter, r *http.Request)

func (*Handler) UpdateIPRules 

func (h *Handler) UpdateIPRules(w http.ResponseWriter, r *http.Request)

func (*Handler) UpdateIPTags 

func (h *Handler) UpdateIPTags(w http.ResponseWriter, r *http.Request)

func (*Handler) UpdateNotification 

func (h *Handler) UpdateNotification(w http.ResponseWriter, r *http.Request)

func (*Handler) UpdateProtectionPolicy 

func (h *Handler) UpdateProtectionPolicy(w http.ResponseWriter, r *http.Request)

func (*Handler) UpdateRateLimit 

func (h *Handler) UpdateRateLimit(w http.ResponseWriter, r *http.Request)

func (*Handler) UpdateRule 

func (h *Handler) UpdateRule(w http.ResponseWriter, r *http.Request)

func (*Handler) UpdateSite 

func (h *Handler) UpdateSite(w http.ResponseWriter, r *http.Request)

func (*Handler) UpdateSystem 

func (h *Handler) UpdateSystem(w http.ResponseWriter, r *http.Request)

func (*Handler) UpdateTasks 

func (h *Handler) UpdateTasks(w http.ResponseWriter, r *http.Request)

func (*Handler) UpdateThreatIntelProviders 

func (h *Handler) UpdateThreatIntelProviders(w http.ResponseWriter, r *http.Request)

func (*Handler) UpdateUser 

func (h *Handler) UpdateUser(w http.ResponseWriter, r *http.Request)

func (*Handler) UploadBlockPageHTML 

func (h *Handler) UploadBlockPageHTML(w http.ResponseWriter, r *http.Request)

func (*Handler) UploadCAPTCHAAsset 

func (h *Handler) UploadCAPTCHAAsset(w http.ResponseWriter, r *http.Request)

func (*Handler) ValidateAPIRequest 

func (h *Handler) ValidateAPIRequest(w http.ResponseWriter, r *http.Request)

func (*Handler) VerifyCaptchaLabChallenge 

func (h *Handler) VerifyCaptchaLabChallenge(w http.ResponseWriter, r *http.Request)

func (*Handler) VerifyLoginCAPTCHA 

func (h *Handler) VerifyLoginCAPTCHA(w http.ResponseWriter, r *http.Request)

func (*Handler) Version 

func (h *Handler) Version(w http.ResponseWriter, _ *http.Request)

func (*Handler) WithProtectionPolicyMaterialization added in v0.4.0 

func (h *Handler) WithProtectionPolicyMaterialization(fn func() error) error

WithProtectionPolicyMaterialization reserves the local configuration mutation lane for one desired-state materialization transaction. It is intentionally narrow: callers still own control-plane fencing and journal semantics, while ordinary config mutations take the shared read side.

type ManagementTokenConfirmation 

type ManagementTokenConfirmation struct {
	ConfirmationID     string
	WarningReadAt      time.Time
	Password           string
	TOTPCode           string
	SecondConfirmation bool
	ConfirmationPhrase string
}

ManagementTokenConfirmation carries the transient proof for an exceptional non-expiring management token. Password/TOTP values are never persisted or logged; the verifier must consume them synchronously and discard them.

type ManagementTokenConfirmationVerifier 

type ManagementTokenConfirmationVerifier func(*http.Request, ManagementTokenConfirmation, time.Time) error

ManagementTokenConfirmationVerifier is the security boundary for exceptional non-expiring management tokens. A production implementation must bind the confirmation to the current local Session, verify password/TOTP and the language confirmation phrase after the server-side warning delay, and reject replayed IDs. A nil verifier keeps the operation fail-closed.

type OTAClient added in v0.4.0 

type OTAClient interface {
	Check(context.Context, ota.Request) (ota.Candidate, error)
}

OTAClient is the read-only index boundary. It can propose a candidate but cannot install or activate a CRP package.

type OTAStateReader added in v0.4.0 

type OTAStateReader interface {
	Load(context.Context) (ota.LastKnownGood, error)
}

OTAStateReader exposes only the persisted last-known-good sequence.

type Options 

type Options struct {
	Config                      *config.Config
	ConfigSnapshot              *config.Config
	ConfigPath                  string
	Store                       storage.Store
	Sink                        storage.LogSink
	Tokens                      *middleware.TokenManager
	Secret                      string
	Auditor                     *middleware.Auditor
	AssistantApprovals          *ai.ApprovalStore
	AssistantGateApproval       *ai.GateApprovalAdapter
	Realtime                    *realtime.Hub
	ClusterIdentity             *identity.MemoryIdentityService
	ClusterDeployTasks          *deploy.TaskManager
	ClusterDeployAuth           *deploy.AuthorizationStore
	ClusterDeployRunner         deploy.TaskRunner
	ClusterHeartbeats           *cluster.HeartbeatRegistry
	ACMEIssuer                  acme.Issuer
	TimeSync                    TimeSyncService
	OTAClient                   OTAClient
	OTAState                    OTAStateReader
	TemporaryHTTPExecutor       netlease.TemporaryHTTPExecutor
	CWEDPDownload               consumer.Executor
	CRPActivation               CRPActivationExecutor
	SetupToken                  string
	SetupTokenSource            setup.TokenSource
	SetupDrafts                 *setup.DraftStore
	RunSetupProbe               func(context.Context, string) setup.ProbeResult
	OnSitesChanged              func([]config.SiteConfig) error
	OnEdgeChanged               func(config.EdgeConfig) error
	OnProtectionChanged         func(config.ProtectionConfig) error
	OnCAPTCHAProvidersChanged   func(config.CAPTCHAProvidersConfig) error
	ProtectionPolicyMutator     desiredstate.ProtectionPolicyMutator
	ProtectionPolicyCoordinator ProtectionPolicyCoordinatorConsumer
	// RequireProtectionPolicyCoordinator is set only by the production
	// composition root. It makes an omitted consumer fail closed; embedded and
	// unit-test routers retain the historical local-only behavior explicitly.
	RequireProtectionPolicyCoordinator  bool
	OnAPISecChanged                     func(config.APISecConfig) error
	OnBlockPageChanged                  func(config.BlockPageConfig) error
	OnTimeSyncChanged                   func(config.TimeSyncConfig) error
	OnConfigChanged                     func(*config.Config) error
	CAPTCHAAssets                       captchaassets.Store
	Clock                               timekeeper.Clock
	ManagementTokenConfirmationVerifier ManagementTokenConfirmationVerifier
	// ApprovalHTTP is the durable approval boundary shared by cluster operations.
	// It is injected by the composition root; nil keeps cluster approval fail-closed.
	ApprovalHTTP *ApprovalHTTPHandler
}

type ProtectionPolicyCoordinatorConsumer added in v0.4.0 

type ProtectionPolicyCoordinatorConsumer interface {
	ProposeAndApply(context.Context, string, desiredstate.ProtectionPolicyPatch) (desiredstate.ProtectionPolicyCoordinationResult, error)
}

ProtectionPolicyCoordinatorConsumer owns the complete protection-policy lifecycle after an authenticated caller supplies a field-presence patch: control-plane snapshot/fencing, nonce generation, consensus + durable commit, and node-local materialization. Handler must not implement any of those steps or accept fencing metadata from the request body.

The returned mutation is the non-sensitive policy result. Implementations must not require the caller to provide a nonce, leader, epoch, revision, or local configuration snapshot.

type ProtectionPolicyCoordinatorPreviewConsumer added in v0.4.0 

type ProtectionPolicyCoordinatorPreviewConsumer interface {
	ProtectionPolicyCoordinatorConsumer
	Preview(context.Context, string, desiredstate.ProtectionPolicyPatch) (desiredstate.ProtectionPolicyCoordinationPreview, error)
	ProposeAndApplyWithPreview(context.Context, string, desiredstate.ProtectionPolicyPatch, string) (desiredstate.ProtectionPolicyCoordinationResult, error)
}

ProtectionPolicyCoordinatorPreviewConsumer extends the write consumer with a snapshot-bound preview and an apply method that enforces its opaque binding. This prevents an approved AI diff from silently applying to a newer control-plane state.

type TimeSyncService 

type TimeSyncService interface {
	Status() timekeeper.Status
	ReselectNow(context.Context) error
	SyncNow(context.Context) error
}

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.