Documentation
¶
Index ¶
Constants ¶
const WbtSessionCookie = "wbt_session"
WbtSessionCookie is the name of the httpOnly browser session cookie. Must stay in sync with handler.WbtSessionCookie — they share the same value.
Variables ¶
This section is empty.
Functions ¶
func APIKeyMiddleware ¶
func APIKeyMiddleware(apiKey string) echo.MiddlewareFunc
APIKeyMiddleware returns an Echo middleware that validates the caller's identity. It accepts two authentication paths in priority order:
- X-API-Key header — used by MCP clients, CLI tools, and curl.
- wbt_session cookie — used by the React SPA (httpOnly, Secure, SameSite=Strict).
On success, an auth.Authorized capability token is stored in the Echo context under auth.ContextKey. Downstream handlers may retrieve it via auth.FromContext. The expected key is passed at construction time so it is read from env once at startup.
func CORSMiddleware ¶
func CORSMiddleware(allowedOrigins string) echo.MiddlewareFunc
CORSMiddleware returns an Echo CORS middleware. allowedOrigins is a comma-separated list of explicit origins. AllowCredentials is set to true so that the browser can send the wbt_session httpOnly cookie in cross-origin requests.
IMPORTANT: allowedOrigins must not be "*" or empty — wildcard origins are incompatible with AllowCredentials=true and browsers reject such responses. This function panics at startup when an unsafe value is detected to prevent silent misconfiguration in production.
Types ¶
This section is empty.
Source Files