controllers

package
v1.2.1 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Sep 11, 2026 License: AGPL-3.0 Imports: 55 Imported by: 0

Documentation

Overview

Package controllers contains HTTP handlers for the Starport API.

Index

Constants

This section is empty.

Variables

View Source 
var ErrUploadTooLarge = errors.New("upload exceeds the configured byte bound")

ErrUploadTooLarge reports an upload that reached the configured byte bound.

The bound is enforced on the way in rather than after the read, so a refused upload never reaches the byte store and leaves no partial object behind.

Functions

This section is empty.

Types

type AccountTemplatesController added in v1.1.0 

type AccountTemplatesController struct {
	// contains filtered or unexported fields
}

AccountTemplatesController serves the operator's account templates: the named creation defaults an account can be stamped from. It manages the templates alone; the stamping itself happens where accounts are created.

func NewAccountTemplatesController added in v1.1.0 

func NewAccountTemplatesController(templates account.TemplateRepository) *AccountTemplatesController

NewAccountTemplatesController creates the template controller. A nil repository degrades every route to 503 rather than to an empty template list, which would read as "this deployment has no templates".

func (*AccountTemplatesController) Create added in v1.1.0 

func (h *AccountTemplatesController) Create(w http.ResponseWriter, r *http.Request)

Create handles POST /api/v1/admin/account-templates.

func (*AccountTemplatesController) Delete added in v1.1.0 

func (h *AccountTemplatesController) Delete(w http.ResponseWriter, r *http.Request)

Delete handles DELETE /api/v1/admin/account-templates/{template_id}. An account stamped from the template keeps its copied defaults, so deleting a template strands nothing.

func (*AccountTemplatesController) Get added in v1.1.0 

func (h *AccountTemplatesController) Get(w http.ResponseWriter, r *http.Request)

Get handles GET /api/v1/admin/account-templates/{template_id}.

func (*AccountTemplatesController) List added in v1.1.0 

func (h *AccountTemplatesController) List(w http.ResponseWriter, r *http.Request)

List handles GET /api/v1/admin/account-templates.

func (*AccountTemplatesController) Update added in v1.1.0 

func (h *AccountTemplatesController) Update(w http.ResponseWriter, r *http.Request)

Update handles PUT /api/v1/admin/account-templates/{template_id}. It reads, applies the named fields, and writes at the revision it read, so a concurrent operator edit is reported as a conflict rather than silently overwritten.

type AccountsController added in v1.1.0 

type AccountsController struct {
	// contains filtered or unexported fields
}

AccountsController serves the operator's account plane: the accounts that hold gateway API keys, the caps that bound what each account may spend, and the credential policy that says which provider credentials serve it.

func NewAccountsController added in v1.1.0 

func NewAccountsController(
	accounts account.Repository,
	keys KeyLister,
	templates account.TemplateRepository,
	records usage.Repository,
) *AccountsController

NewAccountsController creates the account controller. A nil repository degrades every route to 503 rather than to an empty account list, which would read as "this deployment has no accounts". A nil template repository only refuses creates that name a template, because everything else on this surface works without one.

func (*AccountsController) Create added in v1.1.0 

func (h *AccountsController) Create(w http.ResponseWriter, r *http.Request)

Create handles POST /api/v1/admin/accounts.

func (*AccountsController) Delete added in v1.1.0 

func (h *AccountsController) Delete(w http.ResponseWriter, r *http.Request)

Delete handles DELETE /api/v1/admin/accounts/{account_id}. It refuses the canonical account, and it refuses an account that still holds a gateway API key: such a key would keep authenticating with no account behind it, and it would then run under the default credential policy rather than the one the operator just deleted.

func (*AccountsController) Get added in v1.1.0 

func (h *AccountsController) Get(w http.ResponseWriter, r *http.Request)

Get handles GET /api/v1/admin/accounts/{account_id}.

func (*AccountsController) List added in v1.1.0 

func (h *AccountsController) List(w http.ResponseWriter, r *http.Request)

List handles GET /api/v1/admin/accounts.

func (*AccountsController) Update added in v1.1.0 

func (h *AccountsController) Update(w http.ResponseWriter, r *http.Request)

Update handles PUT /api/v1/admin/accounts/{account_id}. It reads, applies the named fields, and writes at the revision it read, so a concurrent operator edit is reported as a conflict rather than silently overwritten.

type ActivityController added in v1.1.0 

type ActivityController struct {
	// contains filtered or unexported fields
}

ActivityController serves recorded request activity.

func NewActivityController added in v1.1.0 

func NewActivityController(usageRecords usage.Repository) *ActivityController

NewActivityController creates a new activity controller.

func (*ActivityController) ActivityExport added in v1.2.0 

func (h *ActivityController) ActivityExport(w http.ResponseWriter, r *http.Request)

ActivityExport handles GET /api/v1/activity/export. It streams the authenticated key's records under the same filters the listing takes, as NDJSON by default or CSV with format=csv. The export reads the store the listing reads, so an exported line matches the stored record.

func (*ActivityController) AdminExport added in v1.2.0 

func (h *ActivityController) AdminExport(w http.ResponseWriter, r *http.Request)

AdminExport handles GET /api/v1/admin/activity/export. It streams the records the admin listing reads under the same filters, across every key unless key_id names one. The console's usage page downloads here, so the file it saves matches the rows it shows.

func (*ActivityController) AdminList added in v1.1.0 

func (h *ActivityController) AdminList(w http.ResponseWriter, r *http.Request)

AdminList handles GET /api/v1/admin/activity. An empty key_id parameter lists activity across every key.

func (*ActivityController) ByProvider added in v1.1.0 

func (h *ActivityController) ByProvider(w http.ResponseWriter, r *http.Request)

ByProvider handles GET /api/v1/accounts/{account_id}/usage/providers. It groups one account's recorded requests by the provider that served them. The grouping is by provider and not by credential: a record names which provider answered, never which of the three credential sources paid.

The rollup totals an account and not a key because spend is an account question: an account holds many keys, and a per-key answer cannot be summed by a caller that does not know which keys the account holds.

func (*ActivityController) List added in v1.1.0 

func (h *ActivityController) List(w http.ResponseWriter, r *http.Request)

List handles GET /api/v1/activity. It always scopes the listing to the authenticated key; only the admin listing can widen the scope.

type AdminController 

type AdminController struct {
	// contains filtered or unexported fields
}

AdminController handles administrative endpoints

func NewAdminController 

func NewAdminController(
	apiKeys apikey.Repository,
	accounts account.Repository,
	usageRecords usage.Repository,
	options ...AdminOption,
) *AdminController

NewAdminController creates a new admin controller. The account repository lets the issuer refuse a key that names an account that does not exist.

func (*AdminController) CreateKey 

func (h *AdminController) CreateKey(w http.ResponseWriter, r *http.Request)

CreateKey handles POST /api/v1/admin/keys

func (*AdminController) DeleteKey 

func (h *AdminController) DeleteKey(w http.ResponseWriter, r *http.Request)

DeleteKey handles DELETE /api/v1/admin/keys/{key_id}

func (*AdminController) GetKey 

func (h *AdminController) GetKey(w http.ResponseWriter, r *http.Request)

GetKey handles GET /api/v1/admin/keys/{key_id}

func (*AdminController) ListKeys 

func (h *AdminController) ListKeys(w http.ResponseWriter, r *http.Request)

ListKeys handles GET /api/v1/admin/keys

func (*AdminController) Metrics 

func (h *AdminController) Metrics(w http.ResponseWriter, r *http.Request)

Metrics handles GET /api/v1/admin/metrics

func (*AdminController) SystemInfo 

func (h *AdminController) SystemInfo(w http.ResponseWriter, _ *http.Request)

SystemInfo handles GET /api/v1/admin/info. Every value it states comes from the linker, the clock, or the loaded configuration. A fact this process cannot know reads "unavailable" rather than a plausible guess.

func (*AdminController) UpdateKey 

func (h *AdminController) UpdateKey(w http.ResponseWriter, r *http.Request)

UpdateKey handles PUT /api/v1/admin/keys/{key_id}

func (*AdminController) Webhooks added in v1.2.0 

func (h *AdminController) Webhooks(w http.ResponseWriter, _ *http.Request)

Webhooks handles GET /api/v1/admin/webhooks: the configured receivers with their secrets removed, the event names, and the delivery state.

type AdminOption added in v1.1.0 

type AdminOption func(*AdminController)

AdminOption adjusts what the admin surface reports.

func WithBuildInfo added in v1.2.0 

func WithBuildInfo(build BuildInfo) AdminOption

WithBuildInfo states which binary answers. A surface that reports a version the linker never stamped tells an operator nothing about what is deployed.

func WithDeployment added in v1.2.0 

func WithDeployment(deployment Deployment) AdminOption

WithDeployment states the configured storage, telemetry, guardrail, and retention settings the surface reports.

func WithFileStorage added in v1.1.0 

func WithFileStorage(backend string) AdminOption

WithFileStorage names the blob backend the deployment writes stored files to. An operator reads it on the settings view to confirm where the bytes land, which is the one fact about file storage that no route reveals.

func WithWebhooks added in v1.2.0 

func WithWebhooks(reporter WebhookReporter) AdminOption

WithWebhooks supplies the webhook delivery state. A nil reporter reads as webhooks off.

type AuditController added in v1.2.0 

type AuditController struct {
	// contains filtered or unexported fields
}

AuditController serves the admin audit listing.

func NewAuditController added in v1.2.0 

func NewAuditController(trail AuditReader) *AuditController

NewAuditController creates the audit listing controller.

func (*AuditController) List added in v1.2.0 

func (h *AuditController) List(w http.ResponseWriter, r *http.Request)

List handles GET /api/v1/admin/audit. It serves one page of the trail, newest first, under the listing's filters.

type AuditReader added in v1.2.0 

type AuditReader interface {
	List(ctx context.Context, query audit.Query) (audit.Page, error)
}

AuditReader serves the recorded trail to the admin surface.

type AuditRecorder added in v1.2.0 

type AuditRecorder interface {
	Record(ctx context.Context, record audit.Record) error
}

AuditRecorder records one admin mutation on the durable trail. Every mutating controller holds one; a nil recorder records nothing, which is what a deployment without the relational store gets.

type AuditTrail added in v1.2.0 

type AuditTrail interface {
	AuditRecorder
	AuditReader
}

AuditTrail is the whole trail: the mutating controllers write it and the admin listing reads it. The audit repository satisfies both halves.

type AuthController added in v1.1.0 

type AuthController struct {
	// contains filtered or unexported fields
}

AuthController reports how the gateway authenticates requests, and lets an operator change it.

func NewAuthController added in v1.1.0 

func NewAuthController(
	policy *authmode.Policy,
	store authmode.Repository,
	bindHost string,
	allowRemote bool,
) *AuthController

NewAuthController creates a controller over the running authentication policy.

bindHost and allowRemote are the same two values startup validation reads. They travel here because the runtime switch answers the same question startup does — may authentication be off on this address — and a rule enforced at startup and restated at runtime is a rule with two versions.

func (*AuthController) Mode added in v1.1.0 

func (c *AuthController) Mode(w http.ResponseWriter, r *http.Request)

Mode handles GET /api/v1/auth/mode.

The route carries no key requirement on purpose. A client that does not yet hold a gateway API key needs to know whether it has to go get one, and answering that question with 401 tells it nothing it can act on. The answer discloses only what an unauthenticated request would discover by making one.

func (*AuthController) SetMode added in v1.1.0 

func (c *AuthController) SetMode(w http.ResponseWriter, r *http.Request)

SetMode handles PUT /api/v1/admin/auth/mode.

It is the only write in the gateway that can open the gateway, so it is guarded three ways and each guard answers a different question: the admin scope asks who is calling, the loopback checks ask from where, and the exposure rule asks whether the resulting gateway would be reachable without a key. Holding admin is not enough, because an operator whose key leaked should not be able to turn the lock off from anywhere on the network.

type AuthModeResponse added in v1.1.0 

type AuthModeResponse struct {
	// Mode is "required" or "disabled".
	Mode string `json:"mode"`
	// Source names what set the running mode: "default", "config", "flag", or
	// "console". An operator who wants to change a mode they cannot change
	// here needs to know which thing to edit.
	Source string `json:"source"`
	// CanChange reports whether this caller may change the mode at runtime. It
	// is answered per request, because the same deployment says yes to a
	// browser on the machine and no to one across the network.
	CanChange bool `json:"can_change"`
	// Reason names why CanChange is false, so the console can explain the
	// disabled control instead of showing one that fails. It is empty when
	// CanChange is true.
	Reason string `json:"reason,omitempty"`
}

AuthModeResponse is the answer to GET /api/v1/auth/mode and to a successful PUT.

type AuthorsController added in v1.1.0 

type AuthorsController struct {
	*BaseHandler
}

AuthorsController handles catalog author endpoints

func NewAuthorsController added in v1.1.0 

func NewAuthorsController(service proxy.Proxy) *AuthorsController

NewAuthorsController creates a new authors controller

func (*AuthorsController) Get added in v1.1.0 

func (h *AuthorsController) Get(w http.ResponseWriter, r *http.Request)

Get handles GET /api/v1/authors/{author}

func (*AuthorsController) List added in v1.1.0 

func (h *AuthorsController) List(w http.ResponseWriter, r *http.Request)

List handles GET /api/v1/authors

type BaseHandler 

type BaseHandler struct {
	// contains filtered or unexported fields
}

BaseHandler provides common functionality for all handlers

func NewBaseHandler 

func NewBaseHandler(service proxy.Proxy) *BaseHandler

NewBaseHandler creates a new base handler

func NewProtocolBaseHandler 

func NewProtocolBaseHandler(service proxy.Proxy, protocol Protocol) *BaseHandler

NewProtocolBaseHandler creates a handler for one explicit wire dialect.

type BatchAdmission added in v1.2.0 

type BatchAdmission struct {
	AccountID string
	KeyID     string
	// TeamID is the team the submitting key is attributed to, or empty for a
	// teamless key. The governor meters the team's spend budget with it.
	TeamID        string
	AccountLimits *limits.Limits
	KeyLimits     *limits.Limits
}

BatchAdmission is the identity one batch line presents to the governor. The values are captured at submission, because the line runs long after the submitting request and its context are gone.

type BatchBudgetError added in v1.2.0 

type BatchBudgetError struct {
	Message string
}

BatchBudgetError reports a line refused because a budget for the current window is exhausted. It is the one governor refusal a caller reads as its own doing, so it keeps the online route's 402 shape on the line.

func (*BatchBudgetError) Error added in v1.2.0 

func (e *BatchBudgetError) Error() string

Error states the refusal.

type BatchGovernor added in v1.2.0 

type BatchGovernor interface {
	AdmitLine(ctx context.Context, admission BatchAdmission) error
}

BatchGovernor admits one batch line under the account's live budget and rate limits. The interface lives here and the meters live in the server package, because the meters read middleware-owned state this package never holds. A rate refusal waits inside the governor rather than failing the line: a batch is background work, and pacing is the point of the limit.

type BatchesController added in v1.2.0 

type BatchesController struct {
	*BaseHandler
	// contains filtered or unexported fields
}

BatchesController serves the OpenAI batch surface under /v1/batches.

It holds the batch service for the record lifecycle and the file service for the JSONL bytes. The gateway is reached only through the line runner this controller hands the service, which is what keeps every provider call on the same pipeline the online routes run.

func NewBatchesController added in v1.2.0 

func NewBatchesController(
	service proxy.Proxy,
	batches *jobs.BatchService,
	fileStore *files.Service,
	governor BatchGovernor,
) *BatchesController

NewBatchesController creates an OpenAI-protocol batch controller.

func (*BatchesController) Cancel added in v1.2.0 

func (h *BatchesController) Cancel(w http.ResponseWriter, r *http.Request)

Cancel handles POST /v1/batches/{batch_id}/cancel. Lines already running drain and keep their results; no new line starts.

func (*BatchesController) Create added in v1.2.0 

func (h *BatchesController) Create(w http.ResponseWriter, r *http.Request)

Create handles POST /v1/batches.

func (*BatchesController) Get added in v1.2.0 

func (h *BatchesController) Get(w http.ResponseWriter, r *http.Request)

Get handles GET /v1/batches/{batch_id}.

func (*BatchesController) List added in v1.2.0 

func (h *BatchesController) List(w http.ResponseWriter, r *http.Request)

List handles GET /v1/batches. It reads records and asks no provider anything, so a listing costs one storage read.

type BuildInfo added in v1.2.0 

type BuildInfo struct {
	Version   string
	Commit    string
	BuildTime string
	StartedAt time.Time
}

BuildInfo is the provenance of the running binary. The linker stamps the version, commit, and build time; the composition root records when the process started so the surface can state an uptime instead of guessing.

type CatalogController added in v1.1.0 

type CatalogController struct {
	// contains filtered or unexported fields
}

CatalogController serves the catalog read surface and the admin catalog operations.

func NewCatalogController added in v1.1.0 

func NewCatalogController(operations CatalogOperations) *CatalogController

NewCatalogController creates the catalog operations adapter.

func (*CatalogController) CancelRefresh added in v1.2.1 

func (h *CatalogController) CancelRefresh(w http.ResponseWriter, r *http.Request)

CancelRefresh handles DELETE /api/v1/admin/catalog/refreshes/{run_id}. It ends one open run. A run that already closed answers with its own terminal state, so a repeated cancel changes nothing.

func (*CatalogController) Changes added in v1.1.0 

func (h *CatalogController) Changes(w http.ResponseWriter, r *http.Request)

Changes handles GET /api/v1/catalog/changes.

func (*CatalogController) Refresh added in v1.1.0 

func (h *CatalogController) Refresh(w http.ResponseWriter, r *http.Request)

Refresh handles POST /api/v1/admin/catalog/refresh. It accepts the work and answers 202 with the operation that carries it. The run outlives the request, so the caller reads its end through the run route.

Overlapping requests join one run: a second caller receives the identifier of the run in flight rather than starting a second one.

func (*CatalogController) RefreshStatus added in v1.2.1 

func (h *CatalogController) RefreshStatus(w http.ResponseWriter, r *http.Request)

RefreshStatus handles GET /api/v1/admin/catalog/refreshes/{run_id}.

func (*CatalogController) Status added in v1.2.1 

func (h *CatalogController) Status(w http.ResponseWriter, r *http.Request)

Status handles GET /api/v1/admin/catalog/status. It serves the operator view behind the admin scope, with candidate, accepted, rejected, and pending route-validation state as distinct values.

func (*CatalogController) Summary added in v1.2.1 

func (h *CatalogController) Summary(w http.ResponseWriter, r *http.Request)

Summary handles GET /api/v1/catalog. It serves the allowlisted reader view and nothing else. A gateway with no catalog answers a sanitized 503 that names no source and no failure.

type CatalogOperations added in v1.1.0 

type CatalogOperations interface {
	// CatalogSummary is the allowlisted view a reader receives.
	CatalogSummary(context.Context) (catalog.Summary, error)
	// CatalogChanges diffs the two newest accepted generations.
	CatalogChanges(context.Context) (catalog.Diff, error)
	// CatalogStatus is the operator view behind the admin scope.
	CatalogStatus(context.Context) (catalog.AdminStatus, error)
	// StartCatalogRefresh accepts one refresh. The second value reports that
	// the request joined the run in flight.
	StartCatalogRefresh(context.Context) (catalog.Operation, bool, error)
	// CatalogOperation reports one refresh run.
	CatalogOperation(context.Context, string) (catalog.Operation, error)
	// CancelCatalogOperation ends one open refresh run.
	CancelCatalogOperation(context.Context, string) (catalog.Operation, error)
}

CatalogOperations serves the reader summary, the operator status, generation diffs, and the asynchronous catalog refresh.

type ChatController 

type ChatController struct {
	*BaseHandler
}

ChatController handles chat completion endpoints

func NewChatController 

func NewChatController(service proxy.Proxy) *ChatController

NewChatController creates a new chat controller

func NewOpenRouterChatController 

func NewOpenRouterChatController(service proxy.Proxy) *ChatController

NewOpenRouterChatController creates an OpenRouter chat controller.

func (*ChatController) Create 

func (h *ChatController) Create(w http.ResponseWriter, r *http.Request)

Create handles POST /v1/chat/completions and /api/v1/chat/completions

type Config 

type Config struct {
	Service            proxy.Proxy
	ProviderKeys       keyring.ProviderKeys
	APIKeys            apikey.Repository
	Accounts           account.Repository
	Usage              usage.Repository
	ProviderOperations ProviderOperations
	Catalog            CatalogOperations
	Presets            presets.Repository
	// Templates serves the account-template surface. A nil repository
	// degrades those routes to 503, the way an absent preset store does.
	Templates account.TemplateRepository
	// Files serves the stored file surface. A nil service leaves the routes
	// registered and answers each one with a service-unavailable result, so a
	// deployment that configured no file storage says so instead of 404.
	Files           *files.Service
	FileUploadBound int64
	// Jobs serves work that outlives its request. A nil service leaves the
	// video routes registered and answers each one with a service-unavailable
	// result, the same way an unconfigured file store answers.
	Jobs *jobs.Service
	// Batches serves the batch surface. A nil service degrades its routes the
	// same way a nil job service degrades the video ones.
	Batches *jobs.BatchService
	// BatchGovernor admits each batch line under the caller's live budget and
	// rate limits. A nil governor admits every line, which is what a test
	// deployment without meters means.
	BatchGovernor BatchGovernor
	// FileBackend names the blob backend stored file bytes land in. It reaches
	// the admin surface rather than the file routes, because it describes the
	// deployment and not any one file.
	FileBackend string
	ServiceName string
	// Build is the provenance of the running binary. The health and admin
	// surfaces report it, so a caller learns what is deployed from either.
	Build BuildInfo
	// Deployment is what the admin surface states about the configured
	// storage, telemetry, guardrail, and retention settings.
	Deployment Deployment
	// Webhooks reports the delivery state of the webhook surface. A nil
	// reporter reads as webhooks off.
	Webhooks WebhookReporter
	// AuthPolicy is the running authentication mode. It is a pointer to the
	// live policy and not a copy of the mode, because the console can change
	// the mode while the router stands.
	AuthPolicy *authmode.Policy
	// AuthModeStore persists a console change so it outlives the process. A nil
	// store leaves the mode readable and refuses to change it.
	AuthModeStore authmode.Repository
	// AuthModeBindHost and AllowRemoteNoAuth are the two values the exposure
	// tripwire reads. They travel together because either alone answers the
	// wrong question.
	AuthModeBindHost  string
	AllowRemoteNoAuth bool
	Console           console.PageServer
	// LocalGate redeems console launch tickets. A nil gate refuses every
	// launch, which is what a gateway with no local admin token should do.
	LocalGate *localauth.Gate
	// IdentityAuth is the OAuth acquisition path, or nil on a deployment
	// with no identity provider configured. Nil keeps the identity routes
	// mounted and refusing with the operator's answer.
	IdentityAuth IdentityAuthenticator
	// Identity holds the durable people plane: users, teams, memberships,
	// and account grants. Zero repositories degrade the members routes to
	// 503, the way an absent template store degrades its surface.
	Identity identity.Repositories
	// Audit records admin mutations and serves the trail back. A nil trail
	// records nothing and degrades the listing route to 503, the way an
	// absent preset store degrades its surface.
	Audit AuditTrail
	// Events pushes key lifecycle events to the configured webhook
	// endpoints. A nil emitter pushes nothing.
	Events EventEmitter
}

Config holds configuration for creating handlers

type ConsoleIdentityController added in v1.1.0 

type ConsoleIdentityController struct {
	// contains filtered or unexported fields
}

ConsoleIdentityController serves the third way into a console session: a person an identity provider vouched for. The two machine-local grants say where the caller is; this one says who they are, and it exists only when an operator configured a provider.

func NewConsoleIdentityController added in v1.1.0 

func NewConsoleIdentityController(
	authenticator IdentityAuthenticator, gate *localauth.Gate,
) *ConsoleIdentityController

NewConsoleIdentityController creates the controller. A nil authenticator leaves the routes mounted and refusing with the operator's answer — no identity provider is configured — matching how every other optional surface degrades loudly instead of vanishing.

func (*ConsoleIdentityController) Begin added in v1.1.0 

func (c *ConsoleIdentityController) Begin(w http.ResponseWriter, r *http.Request)

Begin handles GET /console/identity/{provider}: it sends the browser to the provider's consent page.

func (*ConsoleIdentityController) Callback added in v1.1.0 

func (c *ConsoleIdentityController) Callback(w http.ResponseWriter, r *http.Request)

Callback handles GET /console/identity/{provider}/callback: the provider sent the browser back, the acquisition path verifies the claim, and the identity grant turns it into the same console session every other grant mints.

func (*ConsoleIdentityController) Providers added in v1.1.0 

func (c *ConsoleIdentityController) Providers(w http.ResponseWriter, _ *http.Request)

Providers handles GET /console/identity/providers. An unconfigured deployment answers an empty list with 200: the console asks this on first contact, and "none" is a normal answer there, not a failure.

type ConsoleSessionController added in v1.1.0 

type ConsoleSessionController struct {
	// contains filtered or unexported fields
}

ConsoleSessionController opens a console session from a token an operator pasted.

It is the second way in, and it exists because the first one is not always available. A launch ticket is handed to a browser by a process on this machine; an operator who closed that tab, or who is looking at a gateway somebody else started, has no way back that does not involve restarting it. `starport auth token` prints a value for exactly this, and until this route existed nothing accepted that value.

func NewConsoleSessionController added in v1.1.0 

func NewConsoleSessionController(gate *localauth.Gate) *ConsoleSessionController

NewConsoleSessionController creates a controller over the running gateway's local admin token. A nil gate leaves the route mounted and refusing, matching the launch route: 404 would say this build mints no console session, and it does.

func (*ConsoleSessionController) Create added in v1.1.0 

func (c *ConsoleSessionController) Create(w http.ResponseWriter, r *http.Request)

Create handles POST /console/session.

The token arrives in a JSON body rather than a query string or a form field so it stays out of the address bar, out of browser history, and out of the access log line that records the URL. The response carries no body on success: everything the browser needs is in the cookies, and a body echoing anything about the credential is a body that ends up somewhere.

type Controllers 

type Controllers struct {
	Health               *HealthController
	Chat                 *ChatController
	OpenRouterChat       *ChatController
	Responses            *ResponsesController
	Embeddings           *EmbeddingsController
	OpenRouterEmbeddings *EmbeddingsController
	Rerank               *RerankController
	OpenRouterRerank     *RerankController
	Moderations          *ModerationsController
	Media                *MediaController
	OpenRouterMedia      *MediaController
	Models               *ModelsController
	OpenRouterModels     *ModelsController
	Providers            *ProvidersController
	Authors              *AuthorsController
	Logos                *LogosController
	ProviderCredentials  *ProviderCredentialsController
	Activity             *ActivityController
	Audit                *AuditController
	Admin                *AdminController
	Accounts             *AccountsController
	AccountTemplates     *AccountTemplatesController
	Members              *MembersController
	ProviderOperations   *ProviderOperationsController
	Catalog              *CatalogController
	Files                *FilesController
	Videos               *VideosController
	OpenRouterVideos     *VideosController
	Batches              *BatchesController
	Presets              *PresetsController
	Auth                 *AuthController
	Launch               *LaunchController
	ConsoleSession       *ConsoleSessionController
	ConsoleIdentity      *ConsoleIdentityController
	Console              console.PageServer
}

Controllers holds all HTTP Controllers

func NewControllers 

func NewControllers(cfg Config) *Controllers

NewControllers creates a new controller collection

type Deployment added in v1.2.0 

type Deployment struct {
	// StorageMode names the key-value store: badger or valkey.
	StorageMode string
	// RelationalMode names the relational twin: sqlite, postgres, or mysql.
	RelationalMode string
	// MetricsMode states who may read the scrape: on, admin, or off.
	MetricsMode string
	// TracesEndpoint is the configured OTLP endpoint, or empty when the
	// tracer is a no-op. The surface reports its host alone.
	TracesEndpoint string
	// UsageExportKind names the export sink: http, file, or empty when
	// nothing exports.
	UsageExportKind string
	// UsageExport reports what the sink dropped. Nil means no sink.
	UsageExport DropCounter
	// GuardrailChecks lists the configured checks in run order. Empty
	// means guardrails are off.
	GuardrailChecks []string
	// PIIMode states what a PII finding does: redact or refuse.
	PIIMode string
	// ModerationModel names the moderation model the moderation check
	// calls, or empty when no check names one.
	ModerationModel string
	// AuditRetention, FileRetention, and JobAssetRetention are the windows
	// the three stores prune at.
	AuditRetention    time.Duration
	FileRetention     time.Duration
	JobAssetRetention time.Duration
}

Deployment is what the admin surface states about how this gateway was configured. Application composition fills it from the loaded configuration, so the controller reports values and never reads the environment. Every field is a plain value or a live reader, because the surface describes the deployment and not any one request.

type DropCounter added in v1.2.0 

type DropCounter interface {
	Dropped() int64
}

DropCounter reports records an export target never received. The usage export sink satisfies it.

type EmbeddingsController 

type EmbeddingsController struct {
	*BaseHandler
}

EmbeddingsController handles embeddings endpoints

func NewEmbeddingsController 

func NewEmbeddingsController(service proxy.Proxy) *EmbeddingsController

NewEmbeddingsController creates a new embeddings controller

func NewOpenRouterEmbeddingsController 

func NewOpenRouterEmbeddingsController(service proxy.Proxy) *EmbeddingsController

NewOpenRouterEmbeddingsController creates an OpenRouter embeddings controller.

func (*EmbeddingsController) Create 

func (h *EmbeddingsController) Create(w http.ResponseWriter, r *http.Request)

Create handles POST /v1/embeddings and /api/v1/embeddings

type EventEmitter added in v1.2.0 

type EventEmitter interface {
	Emit(eventType string, data map[string]string)
}

EventEmitter pushes one named event out through the configured webhook endpoints. The events dispatcher satisfies it, and a nil emitter pushes nothing, which is what a deployment with no webhook endpoint gets.

type FilesController added in v1.1.0 

type FilesController struct {
	// contains filtered or unexported fields
}

FilesController serves the OpenAI files surface under /v1/files.

It holds no blob key and opens no store. The file service owns both, which is why reading content goes through Open rather than through a key this controller could log or return.

func NewFilesController added in v1.1.0 

func NewFilesController(service *files.Service, uploadBound int64) *FilesController

NewFilesController builds the files adapter over the file service.

func (*FilesController) Content added in v1.1.0 

func (h *FilesController) Content(w http.ResponseWriter, r *http.Request)

Content handles GET /v1/files/{file_id}/content.

The bytes stream from the store to the client. The controller never holds the whole file, because a deployment that answers a 512 MB download by buffering it answers two of them by falling over.

func (*FilesController) Create added in v1.1.0 

func (h *FilesController) Create(w http.ResponseWriter, r *http.Request)

Create handles POST /v1/files.

func (*FilesController) Delete added in v1.1.0 

func (h *FilesController) Delete(w http.ResponseWriter, r *http.Request)

Delete handles DELETE /v1/files/{file_id}.

func (*FilesController) Get added in v1.1.0 

func (h *FilesController) Get(w http.ResponseWriter, r *http.Request)

Get handles GET /v1/files/{file_id}.

func (*FilesController) List added in v1.1.0 

func (h *FilesController) List(w http.ResponseWriter, r *http.Request)

List handles GET /v1/files.

type HealthController 

type HealthController struct {
	// contains filtered or unexported fields
}

HealthController handles health check endpoints

func NewHealthController 

func NewHealthController(service, version string) *HealthController

NewHealthController creates a new health controller

func (*HealthController) Live 

func (h *HealthController) Live(w http.ResponseWriter, _ *http.Request)

Live handles GET /health/live

func (*HealthController) Ready 

func (h *HealthController) Ready(w http.ResponseWriter, _ *http.Request)

Ready handles GET /health/ready

type IdentityAuthenticator added in v1.1.0 

type IdentityAuthenticator interface {
	// Providers reports the configured provider names for the console to
	// offer.
	Providers() []string
	// Begin redirects the browser to the named provider's consent page.
	Begin(w http.ResponseWriter, r *http.Request, provider string) error
	// Complete verifies the provider's callback and returns the one-time
	// claim the identity grant redeems.
	Complete(w http.ResponseWriter, r *http.Request, provider string) (string, error)
}

IdentityAuthenticator is the slice of the OAuth acquisition path these routes need. It is declared here so the controller can be tested against a stub and so this package depends on the contract rather than the acquisition machinery.

type KeyLister added in v1.1.0 

type KeyLister interface {
	List(ctx context.Context, limit, offset int) ([]apikey.Record, error)
}

KeyLister lists gateway API keys. The account surface holds this single method rather than the API key repository: deleting an account must be able to find out whether a key still names it, and nothing more.

type LaunchController added in v1.1.0 

type LaunchController struct {
	// contains filtered or unexported fields
}

LaunchController exchanges a launch ticket for a console session.

It is the only route that turns something an operator can hold into something a browser can hold, and it exists so the browser never has to hold a gateway API key. A key pasted into a console is a long-lived account credential sitting in local storage, where a copied URL, a shared profile, or a browser extension can reach it and nothing can revoke it individually.

func NewLaunchController added in v1.1.0 

func NewLaunchController(gate *localauth.Gate) *LaunchController

NewLaunchController creates a controller over the running gateway's local admin token. A nil gate leaves the route mounted and refusing, which is what a deployment with no local token should do: 404 would say the feature does not exist in this build, and it does.

func (*LaunchController) Launch added in v1.1.0 

func (c *LaunchController) Launch(w http.ResponseWriter, r *http.Request)

Launch handles GET /launch.

It redirects rather than rendering the console itself, so the ticket leaves the address bar the moment it is spent. A console served directly at this URL would keep a spent credential in history, in the tab title, and in whatever the operator copies next.

type LogosController added in v1.1.0 

type LogosController struct {
	*BaseHandler
}

LogosController serves catalog identity marks. The bundled SVG set leads: it is curated color-first from one icon family, so marks render consistently, where catalog-carried bytes mix monochrome and color glyphs. Catalog bytes fill the gaps the bundle does not cover. The route is public: logos are static brand assets the console loads without credentials, like the health probes.

func NewLogosController added in v1.1.0 

func NewLogosController(service proxy.Proxy) *LogosController

NewLogosController creates the logos controller.

func (*LogosController) Get added in v1.1.0 

func (h *LogosController) Get(w http.ResponseWriter, r *http.Request)

Get handles GET /api/v1/logos/{kind}/{id}.svg.

type MediaController added in v1.1.0 

type MediaController struct {
	*BaseHandler
}

MediaController serves the three dedicated media operations. One controller holds all of them, because they share their authentication handling, their upload reading, and their protocol switch, and the only part that differs is which proxy method the handler calls.

func NewMediaController added in v1.1.0 

func NewMediaController(service proxy.Proxy) *MediaController

NewMediaController creates an OpenAI-protocol media controller.

func NewOpenRouterMediaController added in v1.1.0 

func NewOpenRouterMediaController(service proxy.Proxy) *MediaController

NewOpenRouterMediaController creates an OpenRouter-protocol media controller.

func (*MediaController) EditImages added in v1.1.0 

func (h *MediaController) EditImages(w http.ResponseWriter, r *http.Request)

EditImages handles POST /v1/images/edits. An edit carries its source image, so the body is multipart form data rather than JSON. OpenRouter publishes no edit path, so this handler serves the OpenAI family alone.

func (*MediaController) GenerateImages added in v1.1.0 

func (h *MediaController) GenerateImages(w http.ResponseWriter, r *http.Request)

GenerateImages handles POST /v1/images/generations and POST /api/v1/images.

func (*MediaController) Speech added in v1.1.0 

func (h *MediaController) Speech(w http.ResponseWriter, r *http.Request)

Speech handles POST /v1/audio/speech and POST /api/v1/audio/speech. The answer is an encoded audio file rather than JSON, so the handler writes the provider's bytes and repeats the media type the provider stated.

func (*MediaController) Transcribe added in v1.1.0 

func (h *MediaController) Transcribe(w http.ResponseWriter, r *http.Request)

Transcribe handles POST /v1/audio/transcriptions and POST /api/v1/audio/transcriptions.

func (*MediaController) Translate added in v1.1.0 

func (h *MediaController) Translate(w http.ResponseWriter, r *http.Request)

Translate handles POST /v1/audio/translations. It asks for an English transcript of speech in another language. OpenRouter publishes no translation path, so this handler serves the OpenAI family alone.

type MembersController added in v1.1.0 

type MembersController struct {
	// contains filtered or unexported fields
}

MembersController serves the deployment's people plane: the users an identity provider resolved, the teams an operator forms from them, and the account grants that give an account to one user or one team. The accounts themselves live on the accounts surface; a grant only names one, the way a shared credential's grant list names accounts without owning them.

func NewMembersController added in v1.1.0 

func NewMembersController(repositories identity.Repositories, records usage.Repository) *MembersController

NewMembersController creates the members controller. Zero repositories — a deployment with no identity configured — degrade every route to 503 rather than to an empty list, which would read as "nobody is here" on a gateway that never looked.

func (*MembersController) AddTeamMember added in v1.1.0 

func (h *MembersController) AddTeamMember(w http.ResponseWriter, r *http.Request)

AddTeamMember handles PUT /api/v1/admin/teams/{team_id}/members/{user_id}. PUT because the request states a fact — this user is on this team — and the whole fact is in the path.

func (*MembersController) CreateGrant added in v1.1.0 

func (h *MembersController) CreateGrant(w http.ResponseWriter, r *http.Request)

CreateGrant handles POST /api/v1/admin/account-grants. The body names one account and exactly one grantee, a user or a team.

func (*MembersController) CreateTeam added in v1.1.0 

func (h *MembersController) CreateTeam(w http.ResponseWriter, r *http.Request)

CreateTeam handles POST /api/v1/admin/teams. The gateway names the team itself: a team ID is a join key for memberships and grants, not a word an operator should have to invent.

func (*MembersController) DeleteGrant added in v1.1.0 

func (h *MembersController) DeleteGrant(w http.ResponseWriter, r *http.Request)

DeleteGrant handles DELETE /api/v1/admin/account-grants. The grant's three naming fields arrive as query parameters, because the composite of all three is the grant's only identity.

func (*MembersController) DeleteTeam added in v1.1.0 

func (h *MembersController) DeleteTeam(w http.ResponseWriter, r *http.Request)

DeleteTeam handles DELETE /api/v1/admin/teams/{team_id}. Deleting a team takes its memberships and its account grants with it: both rows are access control, so neither may outlive the team they name.

func (*MembersController) ListTeamGrants added in v1.1.0 

func (h *MembersController) ListTeamGrants(w http.ResponseWriter, r *http.Request)

ListTeamGrants handles GET /api/v1/admin/teams/{team_id}/grants.

func (*MembersController) ListTeamMembers added in v1.1.0 

func (h *MembersController) ListTeamMembers(w http.ResponseWriter, r *http.Request)

ListTeamMembers handles GET /api/v1/admin/teams/{team_id}/members. It reads the team first so an unknown team answers 404 rather than an empty roster.

func (*MembersController) ListTeams added in v1.1.0 

func (h *MembersController) ListTeams(w http.ResponseWriter, r *http.Request)

ListTeams handles GET /api/v1/admin/teams.

func (*MembersController) ListUserGrants added in v1.1.0 

func (h *MembersController) ListUserGrants(w http.ResponseWriter, r *http.Request)

ListUserGrants handles GET /api/v1/admin/users/{user_id}/grants: the grants that name this user directly, without the ones that reach it through teams.

func (*MembersController) ListUsers added in v1.1.0 

func (h *MembersController) ListUsers(w http.ResponseWriter, r *http.Request)

ListUsers handles GET /api/v1/admin/users.

func (*MembersController) ReachableAccounts added in v1.1.0 

func (h *MembersController) ReachableAccounts(w http.ResponseWriter, r *http.Request)

ReachableAccounts handles GET /api/v1/admin/users/{user_id}/accounts: every account this user's grants reach, the direct ones and the ones that arrive through any team the user is on, deduplicated. This is the operator's view of the same answer the session gate resolves for the user's own sessions.

func (*MembersController) RemoveTeamMember added in v1.1.0 

func (h *MembersController) RemoveTeamMember(w http.ResponseWriter, r *http.Request)

RemoveTeamMember handles DELETE /api/v1/admin/teams/{team_id}/members/{user_id}.

func (*MembersController) UpdateTeam added in v1.2.0 

func (h *MembersController) UpdateTeam(w http.ResponseWriter, r *http.Request)

UpdateTeam handles PUT /api/v1/admin/teams/{team_id}. The body states the team's whole mutable surface — the name and the budget — so an omitted budget clears it: PUT states the team as it should now be, not a delta.

A body that names a revision states which team it read. A mismatch answers 409 before anything is written, so one operator's budget save cannot overwrite another's rename. A body with no revision keeps the unconditional update: a script that never read the team may still state it whole.

type ModelsController 

type ModelsController struct {
	*BaseHandler
}

ModelsController handles model-related endpoints

func NewModelsController 

func NewModelsController(service proxy.Proxy) *ModelsController

NewModelsController creates a new models controller

func NewOpenRouterModelsController 

func NewOpenRouterModelsController(service proxy.Proxy) *ModelsController

NewOpenRouterModelsController creates an OpenRouter models controller.

func (*ModelsController) Get 

func (h *ModelsController) Get(w http.ResponseWriter, r *http.Request)

Get handles GET /v1/models/{model} and /api/v1/models/{model}

func (*ModelsController) GetEndpoints 

func (h *ModelsController) GetEndpoints(w http.ResponseWriter, r *http.Request)

GetEndpoints handles GET /api/v1/models/{model}/endpoints

func (*ModelsController) List 

func (h *ModelsController) List(w http.ResponseWriter, r *http.Request)

List handles GET /v1/models and /api/v1/models

type ModerationsController added in v1.2.0 

type ModerationsController struct {
	*BaseHandler
}

ModerationsController serves POST /v1/moderations. OpenAI publishes the one moderation route a 2026 SDK expects, and OpenRouter publishes none, so this controller owns a single protocol.

func NewModerationsController added in v1.2.0 

func NewModerationsController(service proxy.Proxy) *ModerationsController

NewModerationsController creates an OpenAI-protocol moderations controller.

func (*ModerationsController) Create added in v1.2.0 

func (h *ModerationsController) Create(w http.ResponseWriter, r *http.Request)

Create handles POST /v1/moderations.

type PresetsController added in v1.1.0 

type PresetsController struct {
	// contains filtered or unexported fields
}

PresetsController serves preset CRUD under /api/v1/presets.

func NewPresetsController added in v1.1.0 

func NewPresetsController(repository presets.Repository) *PresetsController

NewPresetsController creates the preset management adapter.

func (*PresetsController) Create added in v1.1.0 

func (h *PresetsController) Create(w http.ResponseWriter, r *http.Request)

Create handles POST /api/v1/presets.

func (*PresetsController) Delete added in v1.1.0 

func (h *PresetsController) Delete(w http.ResponseWriter, r *http.Request)

Delete handles DELETE /api/v1/presets/{name}. An optional revision query parameter makes the delete conditional; without one it is unconditional.

func (*PresetsController) Get added in v1.1.0 

func (h *PresetsController) Get(w http.ResponseWriter, r *http.Request)

Get handles GET /api/v1/presets/{name}.

func (*PresetsController) History added in v1.2.0 

func (h *PresetsController) History(w http.ResponseWriter, r *http.Request)

History handles GET /api/v1/presets/{name}/history. It answers stored revisions newest-first.

func (*PresetsController) List added in v1.1.0 

func (h *PresetsController) List(w http.ResponseWriter, r *http.Request)

List handles GET /api/v1/presets.

func (*PresetsController) Rollback added in v1.2.0 

func (h *PresetsController) Rollback(w http.ResponseWriter, r *http.Request)

Rollback handles POST /api/v1/presets/{name}/rollback. It saves a new head revision that copies the named old one.

func (*PresetsController) Update added in v1.1.0 

func (h *PresetsController) Update(w http.ResponseWriter, r *http.Request)

Update handles PUT /api/v1/presets/{name}. The body's revision field names the revision the caller read; a mismatch conflicts.

type Protocol 

type Protocol string

Protocol identifies one external HTTP dialect. 

const (
	// ProtocolOpenAI selects the OpenAI v1 contract.
	ProtocolOpenAI Protocol = "openai"
	// ProtocolOpenRouter selects the OpenRouter v1 contract.
	ProtocolOpenRouter Protocol = "openrouter"
)

type ProviderCredentialsController added in v1.1.0 

type ProviderCredentialsController struct {
	// contains filtered or unexported fields
}

ProviderCredentialsController serves both stored provider-credential planes.

A shared credential belongs to the operator and serves the deployment's accounts. A BYOK credential belongs to one account and serves only that account. The plane is always named by the route rather than derived from the gateway API key that carried the request.

func NewProviderCredentialsController added in v1.1.0 

func NewProviderCredentialsController(
	providerKeys keyring.ProviderKeys,
	accounts accountPolicyReader,
) *ProviderCredentialsController

NewProviderCredentialsController creates the credential controller. A nil accounts reader disables BYOK-policy enforcement, which only a test uses.

func (*ProviderCredentialsController) BYOKDelete added in v1.1.0 

func (h *ProviderCredentialsController) BYOKDelete(w http.ResponseWriter, r *http.Request)

BYOKDelete handles DELETE /api/v1/accounts/{account_id}/byok/{provider}.

func (*ProviderCredentialsController) BYOKGet added in v1.1.0 

func (h *ProviderCredentialsController) BYOKGet(w http.ResponseWriter, r *http.Request)

BYOKGet handles GET /api/v1/accounts/{account_id}/byok/{provider}.

func (*ProviderCredentialsController) BYOKList added in v1.1.0 

func (h *ProviderCredentialsController) BYOKList(w http.ResponseWriter, r *http.Request)

BYOKList handles GET /api/v1/accounts/{account_id}/byok.

func (*ProviderCredentialsController) BYOKPut added in v1.1.0 

func (h *ProviderCredentialsController) BYOKPut(w http.ResponseWriter, r *http.Request)

BYOKPut handles PUT /api/v1/accounts/{account_id}/byok/{provider}. The write is where the operator's BYOK policy speaks: an account outside the policy never stores the credential, so nothing later has to unwind one.

func (*ProviderCredentialsController) BYOKValidate added in v1.1.0 

func (h *ProviderCredentialsController) BYOKValidate(w http.ResponseWriter, r *http.Request)

BYOKValidate handles POST /api/v1/accounts/{account_id}/byok/{provider}/validate.

func (*ProviderCredentialsController) SharedCreate added in v1.1.0 

func (h *ProviderCredentialsController) SharedCreate(w http.ResponseWriter, r *http.Request)

SharedCreate handles POST /api/v1/providers/{provider}/credentials. The response names the id that addresses the new credential from now on.

func (*ProviderCredentialsController) SharedDelete added in v1.1.0 

func (h *ProviderCredentialsController) SharedDelete(w http.ResponseWriter, r *http.Request)

SharedDelete handles DELETE /api/v1/providers/{provider}/credentials/{credential_id}.

func (*ProviderCredentialsController) SharedGet added in v1.1.0 

func (h *ProviderCredentialsController) SharedGet(w http.ResponseWriter, r *http.Request)

SharedGet handles GET /api/v1/providers/{provider}/credentials/{credential_id}.

func (*ProviderCredentialsController) SharedList added in v1.1.0 

func (h *ProviderCredentialsController) SharedList(w http.ResponseWriter, r *http.Request)

SharedList handles GET /api/v1/providers/{provider}/credentials. An empty plane is an empty collection: "no credential is stored" is an answer about the list, not a lookup failure.

func (*ProviderCredentialsController) SharedUpdate added in v1.1.0 

func (h *ProviderCredentialsController) SharedUpdate(w http.ResponseWriter, r *http.Request)

SharedUpdate handles PUT /api/v1/providers/{provider}/credentials/{credential_id}.

func (*ProviderCredentialsController) SharedValidate added in v1.1.0 

func (h *ProviderCredentialsController) SharedValidate(w http.ResponseWriter, r *http.Request)

SharedValidate handles POST /api/v1/providers/{provider}/credentials/{credential_id}/validate.

type ProviderOperations added in v1.0.3 

type ProviderOperations interface {
	ProviderStates() providerstate.Snapshot
	RefreshProviders(context.Context) (providers.ReconcileReport, error)
	// ProviderIncidentLog answers one provider's published incident log;
	// the bool reports whether the catalog knows the provider at all.
	ProviderIncidentLog(context.Context, catalogs.ProviderID) (statuspage.History, bool)
	// ProviderIncidentTransitions answers the durable record of indicator
	// changes this gateway observed for one provider, newest first.
	ProviderIncidentTransitions(context.Context, catalogs.ProviderID) ([]providerstate.IncidentTransition, error)
}

ProviderOperations supplies safe provider state and forced reconciliation.

type ProviderOperationsController added in v1.0.3 

type ProviderOperationsController struct {
	// contains filtered or unexported fields
}

ProviderOperationsController handles authenticated provider operations.

func NewProviderOperationsController added in v1.0.3 

func NewProviderOperationsController(operations ProviderOperations) *ProviderOperationsController

NewProviderOperationsController creates the provider operations adapter.

func (*ProviderOperationsController) Incidents added in v1.1.0 

func (h *ProviderOperationsController) Incidents(w http.ResponseWriter, r *http.Request)

Incidents handles GET /api/v1/admin/providers/{provider}/incidents. The response keeps the two provenances apart: `log` is what the provider's own status page publishes about itself, and `observed` is what this gateway saw the live indicator do, on this deployment's clock.

func (*ProviderOperationsController) Refresh added in v1.0.3 

func (h *ProviderOperationsController) Refresh(w http.ResponseWriter, r *http.Request)

Refresh handles POST /api/v1/admin/providers/refresh.

func (*ProviderOperationsController) Status added in v1.0.3 

func (h *ProviderOperationsController) Status(w http.ResponseWriter, _ *http.Request)

Status handles GET /api/v1/admin/providers.

type ProvidersController 

type ProvidersController struct {
	*BaseHandler
}

ProvidersController handles provider-related endpoints

func NewProvidersController 

func NewProvidersController(service proxy.Proxy) *ProvidersController

NewProvidersController creates a new providers controller

func (*ProvidersController) List 

func (h *ProvidersController) List(w http.ResponseWriter, r *http.Request)

List handles GET /api/v1/providers

type RerankController added in v1.1.0 

type RerankController struct {
	*BaseHandler
}

RerankController serves POST /v1/rerank and POST /api/v1/rerank. The two paths plan one route and reach one provider. They differ only at the edge, where each protocol owns its own wire names, so the handler below reads the decoding its protocol produced and writes the answer that protocol states.

func NewOpenRouterRerankController added in v1.1.0 

func NewOpenRouterRerankController(service proxy.Proxy) *RerankController

NewOpenRouterRerankController creates an OpenRouter-protocol rerank controller.

func NewRerankController added in v1.1.0 

func NewRerankController(service proxy.Proxy) *RerankController

NewRerankController creates an OpenAI-protocol rerank controller.

func (*RerankController) Create added in v1.1.0 

func (h *RerankController) Create(w http.ResponseWriter, r *http.Request)

Create handles POST /v1/rerank and POST /api/v1/rerank.

type ResponsesController added in v1.2.0 

type ResponsesController struct {
	*BaseHandler
}

ResponsesController serves POST /v1/responses: the stateless subset of the OpenAI Responses API. The codec maps the request onto the canonical chat request, so routing, budgets, caching, and usage recording run the same pipeline the chat route runs. The surface exists on the OpenAI dialect alone, because OpenRouter publishes no responses route.

func NewResponsesController added in v1.2.0 

func NewResponsesController(service proxy.Proxy) *ResponsesController

NewResponsesController creates a responses controller.

func (*ResponsesController) Create added in v1.2.0 

func (h *ResponsesController) Create(w http.ResponseWriter, r *http.Request)

Create handles POST /v1/responses.

type VideosController added in v1.1.0 

type VideosController struct {
	*BaseHandler
	// contains filtered or unexported fields
}

VideosController serves the video job surface.

It holds the job service rather than calling the gateway directly, because the record is what a caller comes back to and the service is the only thing that writes a state. The gateway reaches a provider only through the runner this controller hands the service, which is what keeps the provider job identifier inside internal/jobs.

func NewOpenRouterVideosController added in v1.1.0 

func NewOpenRouterVideosController(service proxy.Proxy, records *jobs.Service) *VideosController

NewOpenRouterVideosController creates an OpenRouter-protocol controller.

func NewVideosController added in v1.1.0 

func NewVideosController(service proxy.Proxy, records *jobs.Service) *VideosController

NewVideosController creates an OpenAI-protocol video job controller.

func (*VideosController) Cancel added in v1.1.0 

func (h *VideosController) Cancel(w http.ResponseWriter, r *http.Request)

Cancel handles POST /v1/videos/{video_id}/cancel.

func (*VideosController) Content added in v1.1.0 

func (h *VideosController) Content(w http.ResponseWriter, r *http.Request)

Content handles GET /v1/videos/{video_id}/content.

The route serves Starport's own stored bytes and never redirects a caller to the provider. A provider link expires on the provider's schedule and carries the provider's credential, so a caller holding a Starport identifier would be handed something it cannot read and this gateway cannot promise.

The route reads the record first, so a job another account owns answers not found here exactly as it does on every other video path.

func (*VideosController) Get added in v1.1.0 

func (h *VideosController) Get(w http.ResponseWriter, r *http.Request)

Get handles GET /v1/videos/{video_id}.

The read reaches a provider only while the answer can still change, which the job service decides. A caller may poll a finished job as often as it likes and reach no provider at all.

func (*VideosController) List added in v1.1.0 

func (h *VideosController) List(w http.ResponseWriter, r *http.Request)

List handles GET /v1/videos. It reads records and asks no provider anything, so a listing costs one storage read however many jobs are still running.

func (*VideosController) Submit added in v1.1.0 

func (h *VideosController) Submit(w http.ResponseWriter, r *http.Request)

Submit handles POST /v1/videos and POST /api/v1/videos.

type WebhookReporter added in v1.2.0 

type WebhookReporter interface {
	Stats() events.Stats
}

WebhookReporter reports the delivery state of the configured webhook surface. The events dispatcher satisfies it, and a nil dispatcher reports the unconfigured zero.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.