Documentation
¶
Index ¶
- func APIKeyAuth(apiKey string) func(http.Handler) http.Handler
- func DecompressRequest(maxDecompressedBytes int64) func(http.Handler) http.Handler
- func MaxBodySize(maxBytes int64) func(http.Handler) http.Handler
- func PrometheusMiddleware(next http.Handler) http.Handler
- func RequireAdmin(next http.Handler) http.Handler
- func RequireAdminAPI(next http.Handler) http.Handler
- func RequireAuthAPI(next http.Handler) http.Handler
- func SessionFromContext(ctx context.Context) *store.Session
- func UserFromContext(ctx context.Context) *store.User
- type RateLimiter
- type ReliabilityProvider
- type Server
- func (s *Server) DynamicAPIKeyAuth(next http.Handler) http.Handler
- func (s *Server) DynamicCORSMiddleware(next http.Handler) http.Handler
- func (s *Server) IngestHandler() *ingest.Handler
- func (s *Server) MCPTokenAuth(next http.Handler) http.Handler
- func (s *Server) ProxyAuth(next http.Handler) http.Handler
- func (s *Server) Shutdown(ctx context.Context) error
- type ServerDeps
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func APIKeyAuth ¶
APIKeyAuth returns middleware that validates a Bearer token against the given API key. If apiKey is empty, all requests are allowed (auth disabled). Uses constant-time comparison to prevent timing side-channel attacks.
func DecompressRequest ¶
DecompressRequest transparently decompresses gzip-encoded request bodies. It limits the decompressed output to maxDecompressedBytes to prevent zip bombs.
func MaxBodySize ¶
MaxBodySize limits the request body to the given number of bytes.
func PrometheusMiddleware ¶
PrometheusMiddleware records HTTP request counts and duration as Prometheus metrics.
func RequireAdmin ¶
RequireAdmin returns 403 if the user is not an admin.
func RequireAdminAPI ¶
RequireAdminAPI returns 403 JSON if the user is not an admin (for API endpoints).
func RequireAuthAPI ¶
RequireAuthAPI returns 401 JSON if no user is in the context (for API endpoints).
func SessionFromContext ¶
SessionFromContext returns the session from the request context, or nil.
Types ¶
type RateLimiter ¶
type RateLimiter struct {
// contains filtered or unexported fields
}
RateLimiter provides per-IP rate limiting.
func NewRateLimiter ¶
func NewRateLimiter(limit int, window time.Duration, trusted []string) *RateLimiter
NewRateLimiter creates a rate limiter allowing limit requests per window per IP. It starts a background goroutine that evicts expired entries every 5 minutes. Call Stop() to terminate the background goroutine. The trusted parameter lists proxy IPs whose X-Forwarded-For header should be trusted.
func (*RateLimiter) Middleware ¶
func (rl *RateLimiter) Middleware(next http.Handler) http.Handler
Middleware returns an HTTP middleware that enforces the rate limit.
func (*RateLimiter) Stop ¶
func (rl *RateLimiter) Stop()
Stop terminates the background cleanup goroutine.
type ReliabilityProvider ¶
ReliabilityProvider returns recent reliability data for health checks. Implemented by healthcheck.Scheduler.
type Server ¶
type Server struct {
Router chi.Router
// Handler is the top-level http.Handler (wraps Router with SSE mux)
Handler http.Handler
// contains filtered or unexported fields
}
Server holds the HTTP server and its dependencies.
func NewServer ¶
func NewServer(dsStore store.DataSourceStore, logStore store.LogStore, registry *connector.Registry, cfg *config.Config) *Server
NewServer creates a new Server with the given dependencies and sets up routes.
func NewServerWithDeps ¶
func NewServerWithDeps(deps ServerDeps) *Server
NewServerWithDeps creates a new Server using the ServerDeps struct.
func (*Server) DynamicAPIKeyAuth ¶
DynamicAPIKeyAuth resolves the API key per-request (env var or DB) and validates the Bearer token. If no key is configured, all requests pass. Uses constant-time comparison to prevent timing side-channel attacks.
func (*Server) DynamicCORSMiddleware ¶
DynamicCORSMiddleware resolves CORS allowed origins per-request (env var or DB) and sets appropriate CORS headers. If no origins are configured, CORS headers are not set (same-origin only).
func (*Server) IngestHandler ¶
IngestHandler returns the log ingestion handler so it can be reused by non-HTTP transports (e.g. Unix socket listener).
func (*Server) MCPTokenAuth ¶
MCPTokenAuth is middleware that authenticates requests using a Bearer token validated against the user's MCP token in the database. It sets the authenticated user in the request context.
type ServerDeps ¶
type ServerDeps struct {
Ctx context.Context // app lifecycle context; nil defaults to Background
DB *sql.DB
Stores store.Stores
Registry *connector.Registry
Cfg *config.Config
WatchStreamEvaluator *watcher.WatchStreamEvaluator
WatchMetrics *watcher.WatchMetrics
IngestQueue *ingest.Queue
ReliabilityProvider ReliabilityProvider
Modules []server.Module
}
ServerDeps holds all dependencies for the web server.
Source Files