Documentation
¶
Overview ¶
extension.go — generic, unopinionated extension seams (X2-T3).
These are registration hooks the OSS server exposes so an external module (the enterprise build, or any third-party wrapper) can attach behaviour WITHOUT the OSS tree depending on it. Nothing here is enterprise-specific: the defaults are community-mode no-ops, so an untouched OSS binary behaves exactly as before.
Two seams:
- Org injection — a request-context org id, resolved per request and defaulting to storage.DefaultOrgID ("default"). Single-tenant OSS never sees it; a multi-tenant wrapper registers a resolver that reads the org from a header/token.
- Auth slot — a settable middleware that runs on the API surface ahead of the OSS gateway-secret checks. OSS registers none (the slot is a pass-through); a wrapper registers SSO/JWT enforcement. A registered handler may call MarkAuthorized to tell the OSS gateway-secret guards the request is already authenticated by an alternative credential (e.g. an SSO session), so one enterprise credential can unlock both the data plane and the admin surfaces.
Registration is process-wide and expected to happen once at boot, before the server starts accepting connections.
Index ¶
- Constants
- func AuthMiddleware() fiber.Handler
- func Logger() fiber.Handler
- func MarkAuthorized(c *fiber.Ctx)
- func OrgFromContext(c *fiber.Ctx) string
- func OrgInjector() fiber.Handler
- func RequestAuthorized(c *fiber.Ctx) bool
- func SetAuthMiddleware(h fiber.Handler)
- func SetOrgResolver(r OrgResolver)
- type OrgResolver
Constants ¶
const AuthorizedContextKey = "versus.authorized"
AuthorizedContextKey is the fiber Locals key a registered auth handler (see SetAuthMiddleware) sets to mark a request as already authenticated by an alternative credential — e.g. an enterprise SSO session. The OSS gateway-secret guards honour this flag and skip the X-Gateway-Secret check when it is set, so a single enterprise credential can unlock both the data plane and the admin surfaces.
const OrgContextKey = "versus.org_id"
OrgContextKey is the fiber Locals key under which the resolved org id is stored for the lifetime of a request.
Variables ¶
This section is empty.
Functions ¶
func AuthMiddleware ¶ added in v1.4.4
AuthMiddleware returns the registered auth handler, or a no-op pass-through when none is registered (community mode).
func MarkAuthorized ¶ added in v1.4.4
MarkAuthorized records that the current request was authenticated upstream by a registered auth handler. Community OSS never calls this, so the gateway-secret guards behave exactly as before.
func OrgFromContext ¶ added in v1.4.4
OrgFromContext returns the org id stamped on the request by OrgInjector, or storage.DefaultOrgID when none was set.
func OrgInjector ¶ added in v1.4.4
OrgInjector returns middleware that stamps the resolved org id onto the request context. With no resolver registered (or a resolver that returns ""), every request is scoped to storage.DefaultOrgID, which is invisible to single-tenant OSS users.
func RequestAuthorized ¶ added in v1.4.4
RequestAuthorized reports whether a prior auth handler marked this request authorized. It defaults to false (community mode), leaving the OSS gateway-secret checks unchanged.
func SetAuthMiddleware ¶ added in v1.4.4
SetAuthMiddleware registers an extra auth handler that runs on the API surface ahead of the OSS gateway-secret checks. OSS ships none. Passing nil clears the slot (back to the community pass-through). Call at boot.
func SetOrgResolver ¶ added in v1.4.4
func SetOrgResolver(r OrgResolver)
SetOrgResolver registers the function used to resolve an org id from a request. OSS ships none, so every request resolves to the default org. Passing nil clears it. Call at boot.
Types ¶
type OrgResolver ¶ added in v1.4.4
OrgResolver extracts the org id for a request. Returning "" means "no explicit org" and falls back to storage.DefaultOrgID.
Source Files