proxy

func AllowedReadOnlyPath ¶

func AllowedReadOnlyPath(rawPath string) bool

func AllowedWritePath ¶ added in v0.3.0

func AllowedWritePath(method, rawPath string) bool

AllowedWritePath is the sole admission control for write methods through the dashboard proxy. It admits EXACTLY these shapes:

POST   /api/v1/projects/{id}/workflow-chains/{chain_ref}/governed-intake
POST   /api/v1/projects/{id}/workflow-chain-runs/{chain_run_id}/cancel
POST   /api/v1/projects/{id}/workflow-chain-runs/{chain_run_id}/retry
POST   /api/v1/projects/{id}/workflow-chain-runs/{chain_run_id}/retry-gitops
POST   /api/v1/projects/{id}/integrations/jira/issues/{key}/ingest
DELETE /api/v1/projects/{id}/workflow-chain-runs/{chain_run_id}

where {id}, {chain_ref}/{chain_run_id}, and {key} pass segmentSafe (no traversal, no path tricks). Every other method or path — including near-misses (extra/missing segments, other POST routes, GET on these paths) — is rejected. This is the security boundary for the launcher + run lifecycle + manual Jira re-ingest: widening it is an explicit, reviewed change, never incidental.

func ReadyCheck ¶

func ReadyCheck(upstream *url.URL) func(context.Context) error