controllers

package
v1.1.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 30, 2026 License: AGPL-3.0 Imports: 49 Imported by: 0

Documentation

Overview

Package controllers contains HTTP handlers for the Starport API.

Index

Constants

This section is empty.

Variables

View Source 
var ErrUploadTooLarge = errors.New("upload exceeds the configured byte bound")

ErrUploadTooLarge reports an upload that reached the configured byte bound.

The bound is enforced on the way in rather than after the read, so a refused upload never reaches the byte store and leaves no partial object behind.

Functions

This section is empty.

Types

type AccountTemplatesController added in v1.1.0 

type AccountTemplatesController struct {
	// contains filtered or unexported fields
}

AccountTemplatesController serves the operator's account templates: the named creation defaults an account can be stamped from. It manages the templates alone; the stamping itself happens where accounts are created.

func NewAccountTemplatesController added in v1.1.0 

func NewAccountTemplatesController(templates account.TemplateRepository) *AccountTemplatesController

NewAccountTemplatesController creates the template controller. A nil repository degrades every route to 503 rather than to an empty template list, which would read as "this deployment has no templates".

func (*AccountTemplatesController) Create added in v1.1.0 

func (h *AccountTemplatesController) Create(w http.ResponseWriter, r *http.Request)

Create handles POST /api/v1/admin/account-templates.

func (*AccountTemplatesController) Delete added in v1.1.0 

func (h *AccountTemplatesController) Delete(w http.ResponseWriter, r *http.Request)

Delete handles DELETE /api/v1/admin/account-templates/{template_id}. An account stamped from the template keeps its copied defaults, so deleting a template strands nothing.

func (*AccountTemplatesController) Get added in v1.1.0 

func (h *AccountTemplatesController) Get(w http.ResponseWriter, r *http.Request)

Get handles GET /api/v1/admin/account-templates/{template_id}.

func (*AccountTemplatesController) List added in v1.1.0 

func (h *AccountTemplatesController) List(w http.ResponseWriter, r *http.Request)

List handles GET /api/v1/admin/account-templates.

func (*AccountTemplatesController) Update added in v1.1.0 

func (h *AccountTemplatesController) Update(w http.ResponseWriter, r *http.Request)

Update handles PUT /api/v1/admin/account-templates/{template_id}. It reads, applies the named fields, and writes at the revision it read, so a concurrent operator edit is reported as a conflict rather than silently overwritten.

type AccountsController added in v1.1.0 

type AccountsController struct {
	// contains filtered or unexported fields
}

AccountsController serves the operator's account plane: the accounts that hold gateway API keys, the caps that bound what each account may spend, and the credential policy that says which provider credentials serve it.

func NewAccountsController added in v1.1.0 

func NewAccountsController(
	accounts account.Repository,
	keys KeyLister,
	templates account.TemplateRepository,
) *AccountsController

NewAccountsController creates the account controller. A nil repository degrades every route to 503 rather than to an empty account list, which would read as "this deployment has no accounts". A nil template repository only refuses creates that name a template, because everything else on this surface works without one.

func (*AccountsController) Create added in v1.1.0 

func (h *AccountsController) Create(w http.ResponseWriter, r *http.Request)

Create handles POST /api/v1/admin/accounts.

func (*AccountsController) Delete added in v1.1.0 

func (h *AccountsController) Delete(w http.ResponseWriter, r *http.Request)

Delete handles DELETE /api/v1/admin/accounts/{account_id}. It refuses the canonical account, and it refuses an account that still holds a gateway API key: such a key would keep authenticating with no account behind it, and it would then run under the default credential policy rather than the one the operator just deleted.

func (*AccountsController) Get added in v1.1.0 

func (h *AccountsController) Get(w http.ResponseWriter, r *http.Request)

Get handles GET /api/v1/admin/accounts/{account_id}.

func (*AccountsController) List added in v1.1.0 

func (h *AccountsController) List(w http.ResponseWriter, r *http.Request)

List handles GET /api/v1/admin/accounts.

func (*AccountsController) Update added in v1.1.0 

func (h *AccountsController) Update(w http.ResponseWriter, r *http.Request)

Update handles PUT /api/v1/admin/accounts/{account_id}. It reads, applies the named fields, and writes at the revision it read, so a concurrent operator edit is reported as a conflict rather than silently overwritten.

type ActivityController added in v1.1.0 

type ActivityController struct {
	// contains filtered or unexported fields
}

ActivityController serves recorded request activity.

func NewActivityController added in v1.1.0 

func NewActivityController(usageRecords usage.Repository) *ActivityController

NewActivityController creates a new activity controller.

func (*ActivityController) AdminList added in v1.1.0 

func (h *ActivityController) AdminList(w http.ResponseWriter, r *http.Request)

AdminList handles GET /api/v1/admin/activity. An empty key_id parameter lists activity across every key.

func (*ActivityController) ByProvider added in v1.1.0 

func (h *ActivityController) ByProvider(w http.ResponseWriter, r *http.Request)

ByProvider handles GET /api/v1/accounts/{account_id}/usage/providers. It groups one account's recorded requests by the provider that served them. The grouping is by provider and not by credential: a record names which provider answered, never which of the three credential sources paid.

The rollup totals an account and not a key because spend is an account question: an account holds many keys, and a per-key answer cannot be summed by a caller that does not know which keys the account holds.

func (*ActivityController) List added in v1.1.0 

func (h *ActivityController) List(w http.ResponseWriter, r *http.Request)

List handles GET /api/v1/activity. It always scopes the listing to the authenticated key; only the admin listing can widen the scope.

type AdminController 

type AdminController struct {
	// contains filtered or unexported fields
}

AdminController handles administrative endpoints

func NewAdminController 

func NewAdminController(
	apiKeys apikey.Repository,
	accounts account.Repository,
	usageRecords usage.Repository,
	options ...AdminOption,
) *AdminController

NewAdminController creates a new admin controller. The account repository lets the issuer refuse a key that names an account that does not exist.

func (*AdminController) CreateKey 

func (h *AdminController) CreateKey(w http.ResponseWriter, r *http.Request)

CreateKey handles POST /api/v1/admin/keys

func (*AdminController) DeleteKey 

func (h *AdminController) DeleteKey(w http.ResponseWriter, r *http.Request)

DeleteKey handles DELETE /api/v1/admin/keys/{key_id}

func (*AdminController) GetKey 

func (h *AdminController) GetKey(w http.ResponseWriter, r *http.Request)

GetKey handles GET /api/v1/admin/keys/{key_id}

func (*AdminController) ListKeys 

func (h *AdminController) ListKeys(w http.ResponseWriter, r *http.Request)

ListKeys handles GET /api/v1/admin/keys

func (*AdminController) Metrics 

func (h *AdminController) Metrics(w http.ResponseWriter, r *http.Request)

Metrics handles GET /api/v1/admin/metrics

func (*AdminController) SystemInfo 

func (h *AdminController) SystemInfo(w http.ResponseWriter, _ *http.Request)

SystemInfo handles GET /api/v1/admin/info

func (*AdminController) UpdateKey 

func (h *AdminController) UpdateKey(w http.ResponseWriter, r *http.Request)

UpdateKey handles PUT /api/v1/admin/keys/{key_id}

type AdminOption added in v1.1.0 

type AdminOption func(*AdminController)

AdminOption adjusts what the admin surface reports.

func WithFileStorage added in v1.1.0 

func WithFileStorage(backend string) AdminOption

WithFileStorage names the blob backend the deployment writes stored files to. An operator reads it on the settings view to confirm where the bytes land, which is the one fact about file storage that no route reveals.

type AuthController added in v1.1.0 

type AuthController struct {
	// contains filtered or unexported fields
}

AuthController reports how the gateway authenticates requests, and lets an operator change it.

func NewAuthController added in v1.1.0 

func NewAuthController(
	policy *authmode.Policy,
	store authmode.Repository,
	bindHost string,
	allowRemote bool,
) *AuthController

NewAuthController creates a controller over the running authentication policy.

bindHost and allowRemote are the same two values startup validation reads. They travel here because the runtime switch answers the same question startup does — may authentication be off on this address — and a rule enforced at startup and restated at runtime is a rule with two versions.

func (*AuthController) Mode added in v1.1.0 

func (c *AuthController) Mode(w http.ResponseWriter, r *http.Request)

Mode handles GET /api/v1/auth/mode.

The route carries no key requirement on purpose. A client that does not yet hold a gateway API key needs to know whether it has to go get one, and answering that question with 401 tells it nothing it can act on. The answer discloses only what an unauthenticated request would discover by making one.

func (*AuthController) SetMode added in v1.1.0 

func (c *AuthController) SetMode(w http.ResponseWriter, r *http.Request)

SetMode handles PUT /api/v1/admin/auth/mode.

It is the only write in the gateway that can open the gateway, so it is guarded three ways and each guard answers a different question: the admin scope asks who is calling, the loopback checks ask from where, and the exposure rule asks whether the resulting gateway would be reachable without a key. Holding admin is not enough, because an operator whose key leaked should not be able to turn the lock off from anywhere on the network.

type AuthModeResponse added in v1.1.0 

type AuthModeResponse struct {
	// Mode is "required" or "disabled".
	Mode string `json:"mode"`
	// Source names what set the running mode: "default", "config", "flag", or
	// "console". An operator who wants to change a mode they cannot change
	// here needs to know which thing to edit.
	Source string `json:"source"`
	// CanChange reports whether this caller may change the mode at runtime. It
	// is answered per request, because the same deployment says yes to a
	// browser on the machine and no to one across the network.
	CanChange bool `json:"can_change"`
	// Reason names why CanChange is false, so the console can explain the
	// disabled control instead of showing one that fails. It is empty when
	// CanChange is true.
	Reason string `json:"reason,omitempty"`
}

AuthModeResponse is the answer to GET /api/v1/auth/mode and to a successful PUT.

type AuthorsController added in v1.1.0 

type AuthorsController struct {
	*BaseHandler
}

AuthorsController handles catalog author endpoints

func NewAuthorsController added in v1.1.0 

func NewAuthorsController(service proxy.Proxy) *AuthorsController

NewAuthorsController creates a new authors controller

func (*AuthorsController) Get added in v1.1.0 

func (h *AuthorsController) Get(w http.ResponseWriter, r *http.Request)

Get handles GET /api/v1/authors/{author}

func (*AuthorsController) List added in v1.1.0 

func (h *AuthorsController) List(w http.ResponseWriter, r *http.Request)

List handles GET /api/v1/authors

type BaseHandler 

type BaseHandler struct {
	// contains filtered or unexported fields
}

BaseHandler provides common functionality for all handlers

func NewBaseHandler 

func NewBaseHandler(service proxy.Proxy) *BaseHandler

NewBaseHandler creates a new base handler

func NewProtocolBaseHandler 

func NewProtocolBaseHandler(service proxy.Proxy, protocol Protocol) *BaseHandler

NewProtocolBaseHandler creates a handler for one explicit wire dialect.

type CatalogController added in v1.1.0 

type CatalogController struct {
	// contains filtered or unexported fields
}

CatalogController serves catalog freshness and refresh operations.

func NewCatalogController added in v1.1.0 

func NewCatalogController(operations CatalogOperations) *CatalogController

NewCatalogController creates the catalog operations adapter.

func (*CatalogController) Changes added in v1.1.0 

func (h *CatalogController) Changes(w http.ResponseWriter, r *http.Request)

Changes handles GET /api/v1/catalog/changes.

func (*CatalogController) Metadata added in v1.1.0 

func (h *CatalogController) Metadata(w http.ResponseWriter, r *http.Request)

Metadata handles GET /api/v1/catalog.

func (*CatalogController) Refresh added in v1.1.0 

func (h *CatalogController) Refresh(w http.ResponseWriter, r *http.Request)

Refresh handles POST /api/v1/admin/catalog/refresh.

type CatalogOperations added in v1.1.0 

type CatalogOperations interface {
	CatalogMetadata(context.Context) (catalog.SnapshotMetadata, error)
	CatalogChanges(context.Context) (catalog.Diff, error)
	RefreshCatalog(context.Context) (catalog.RefreshReport, error)
}

CatalogOperations supplies snapshot freshness, generation diffs, and forced catalog acquisition.

type ChatController 

type ChatController struct {
	*BaseHandler
}

ChatController handles chat completion endpoints

func NewChatController 

func NewChatController(service proxy.Proxy) *ChatController

NewChatController creates a new chat controller

func NewOpenRouterChatController 

func NewOpenRouterChatController(service proxy.Proxy) *ChatController

NewOpenRouterChatController creates an OpenRouter chat controller.

func (*ChatController) Create 

func (h *ChatController) Create(w http.ResponseWriter, r *http.Request)

Create handles POST /v1/chat/completions and /api/v1/chat/completions

type Config 

type Config struct {
	Service            proxy.Proxy
	ProviderKeys       keyring.ProviderKeys
	APIKeys            apikey.Repository
	Accounts           account.Repository
	Usage              usage.Repository
	ProviderOperations ProviderOperations
	Catalog            CatalogOperations
	Presets            presets.Repository
	// Templates serves the account-template surface. A nil repository
	// degrades those routes to 503, the way an absent preset store does.
	Templates account.TemplateRepository
	// Files serves the stored file surface. A nil service leaves the routes
	// registered and answers each one with a service-unavailable result, so a
	// deployment that configured no file storage says so instead of 404.
	Files           *files.Service
	FileUploadBound int64
	// Jobs serves work that outlives its request. A nil service leaves the
	// video routes registered and answers each one with a service-unavailable
	// result, the same way an unconfigured file store answers.
	Jobs *jobs.Service
	// FileBackend names the blob backend stored file bytes land in. It reaches
	// the admin surface rather than the file routes, because it describes the
	// deployment and not any one file.
	FileBackend string
	ServiceName string
	Version     string
	// AuthPolicy is the running authentication mode. It is a pointer to the
	// live policy and not a copy of the mode, because the console can change
	// the mode while the router stands.
	AuthPolicy *authmode.Policy
	// AuthModeStore persists a console change so it outlives the process. A nil
	// store leaves the mode readable and refuses to change it.
	AuthModeStore authmode.Repository
	// AuthModeBindHost and AllowRemoteNoAuth are the two values the exposure
	// tripwire reads. They travel together because either alone answers the
	// wrong question.
	AuthModeBindHost  string
	AllowRemoteNoAuth bool
	Console           console.PageServer
	// LocalGate redeems console launch tickets. A nil gate refuses every
	// launch, which is what a gateway with no local admin token should do.
	LocalGate *localauth.Gate
	// IdentityAuth is the OAuth acquisition path, or nil on a deployment
	// with no identity provider configured. Nil keeps the identity routes
	// mounted and refusing with the operator's answer.
	IdentityAuth IdentityAuthenticator
	// Identity holds the durable people plane: users, teams, memberships,
	// and account grants. Zero repositories degrade the members routes to
	// 503, the way an absent template store degrades its surface.
	Identity identity.Repositories
}

Config holds configuration for creating handlers

type ConsoleIdentityController added in v1.1.0 

type ConsoleIdentityController struct {
	// contains filtered or unexported fields
}

ConsoleIdentityController serves the third way into a console session: a person an identity provider vouched for. The two machine-local grants say where the caller is; this one says who they are, and it exists only when an operator configured a provider.

func NewConsoleIdentityController added in v1.1.0 

func NewConsoleIdentityController(
	authenticator IdentityAuthenticator, gate *localauth.Gate,
) *ConsoleIdentityController

NewConsoleIdentityController creates the controller. A nil authenticator leaves the routes mounted and refusing with the operator's answer — no identity provider is configured — matching how every other optional surface degrades loudly instead of vanishing.

func (*ConsoleIdentityController) Begin added in v1.1.0 

func (c *ConsoleIdentityController) Begin(w http.ResponseWriter, r *http.Request)

Begin handles GET /console/identity/{provider}: it sends the browser to the provider's consent page.

func (*ConsoleIdentityController) Callback added in v1.1.0 

func (c *ConsoleIdentityController) Callback(w http.ResponseWriter, r *http.Request)

Callback handles GET /console/identity/{provider}/callback: the provider sent the browser back, the acquisition path verifies the claim, and the identity grant turns it into the same console session every other grant mints.

func (*ConsoleIdentityController) Providers added in v1.1.0 

func (c *ConsoleIdentityController) Providers(w http.ResponseWriter, _ *http.Request)

Providers handles GET /console/identity/providers. An unconfigured deployment answers an empty list with 200: the console asks this on first contact, and "none" is a normal answer there, not a failure.

type ConsoleSessionController added in v1.1.0 

type ConsoleSessionController struct {
	// contains filtered or unexported fields
}

ConsoleSessionController opens a console session from a token an operator pasted.

It is the second way in, and it exists because the first one is not always available. A launch ticket is handed to a browser by a process on this machine; an operator who closed that tab, or who is looking at a gateway somebody else started, has no way back that does not involve restarting it. `starport auth token` prints a value for exactly this, and until this route existed nothing accepted that value.

func NewConsoleSessionController added in v1.1.0 

func NewConsoleSessionController(gate *localauth.Gate) *ConsoleSessionController

NewConsoleSessionController creates a controller over the running gateway's local admin token. A nil gate leaves the route mounted and refusing, matching the launch route: 404 would say this build mints no console session, and it does.

func (*ConsoleSessionController) Create added in v1.1.0 

func (c *ConsoleSessionController) Create(w http.ResponseWriter, r *http.Request)

Create handles POST /console/session.

The token arrives in a JSON body rather than a query string or a form field so it stays out of the address bar, out of browser history, and out of the access log line that records the URL. The response carries no body on success: everything the browser needs is in the cookies, and a body echoing anything about the credential is a body that ends up somewhere.

type Controllers 

type Controllers struct {
	Health               *HealthController
	Chat                 *ChatController
	OpenRouterChat       *ChatController
	Embeddings           *EmbeddingsController
	OpenRouterEmbeddings *EmbeddingsController
	Rerank               *RerankController
	OpenRouterRerank     *RerankController
	Media                *MediaController
	OpenRouterMedia      *MediaController
	Models               *ModelsController
	OpenRouterModels     *ModelsController
	Providers            *ProvidersController
	Authors              *AuthorsController
	Logos                *LogosController
	ProviderCredentials  *ProviderCredentialsController
	Activity             *ActivityController
	Admin                *AdminController
	Accounts             *AccountsController
	AccountTemplates     *AccountTemplatesController
	Members              *MembersController
	ProviderOperations   *ProviderOperationsController
	Catalog              *CatalogController
	Files                *FilesController
	Videos               *VideosController
	OpenRouterVideos     *VideosController
	Presets              *PresetsController
	Auth                 *AuthController
	Launch               *LaunchController
	ConsoleSession       *ConsoleSessionController
	ConsoleIdentity      *ConsoleIdentityController
	Console              console.PageServer
}

Controllers holds all HTTP Controllers

func NewControllers 

func NewControllers(cfg Config) *Controllers

NewControllers creates a new controller collection

type EmbeddingsController 

type EmbeddingsController struct {
	*BaseHandler
}

EmbeddingsController handles embeddings endpoints

func NewEmbeddingsController 

func NewEmbeddingsController(service proxy.Proxy) *EmbeddingsController

NewEmbeddingsController creates a new embeddings controller

func NewOpenRouterEmbeddingsController 

func NewOpenRouterEmbeddingsController(service proxy.Proxy) *EmbeddingsController

NewOpenRouterEmbeddingsController creates an OpenRouter embeddings controller.

func (*EmbeddingsController) Create 

func (h *EmbeddingsController) Create(w http.ResponseWriter, r *http.Request)

Create handles POST /v1/embeddings and /api/v1/embeddings

type FilesController added in v1.1.0 

type FilesController struct {
	// contains filtered or unexported fields
}

FilesController serves the OpenAI files surface under /v1/files.

It holds no blob key and opens no store. The file service owns both, which is why reading content goes through Open rather than through a key this controller could log or return.

func NewFilesController added in v1.1.0 

func NewFilesController(service *files.Service, uploadBound int64) *FilesController

NewFilesController builds the files adapter over the file service.

func (*FilesController) Content added in v1.1.0 

func (h *FilesController) Content(w http.ResponseWriter, r *http.Request)

Content handles GET /v1/files/{file_id}/content.

The bytes stream from the store to the client. The controller never holds the whole file, because a deployment that answers a 512 MB download by buffering it answers two of them by falling over.

func (*FilesController) Create added in v1.1.0 

func (h *FilesController) Create(w http.ResponseWriter, r *http.Request)

Create handles POST /v1/files.

func (*FilesController) Delete added in v1.1.0 

func (h *FilesController) Delete(w http.ResponseWriter, r *http.Request)

Delete handles DELETE /v1/files/{file_id}.

func (*FilesController) Get added in v1.1.0 

func (h *FilesController) Get(w http.ResponseWriter, r *http.Request)

Get handles GET /v1/files/{file_id}.

func (*FilesController) List added in v1.1.0 

func (h *FilesController) List(w http.ResponseWriter, r *http.Request)

List handles GET /v1/files.

type HealthController 

type HealthController struct {
	// contains filtered or unexported fields
}

HealthController handles health check endpoints

func NewHealthController 

func NewHealthController(service, version string) *HealthController

NewHealthController creates a new health controller

func (*HealthController) Live 

func (h *HealthController) Live(w http.ResponseWriter, _ *http.Request)

Live handles GET /health/live

func (*HealthController) Ready 

func (h *HealthController) Ready(w http.ResponseWriter, _ *http.Request)

Ready handles GET /health/ready

type IdentityAuthenticator added in v1.1.0 

type IdentityAuthenticator interface {
	// Providers reports the configured provider names for the console to
	// offer.
	Providers() []string
	// Begin redirects the browser to the named provider's consent page.
	Begin(w http.ResponseWriter, r *http.Request, provider string) error
	// Complete verifies the provider's callback and returns the one-time
	// claim the identity grant redeems.
	Complete(w http.ResponseWriter, r *http.Request, provider string) (string, error)
}

IdentityAuthenticator is the slice of the OAuth acquisition path these routes need. It is declared here so the controller can be tested against a stub and so this package depends on the contract rather than the acquisition machinery.

type KeyLister added in v1.1.0 

type KeyLister interface {
	List(ctx context.Context, limit, offset int) ([]apikey.Record, error)
}

KeyLister lists gateway API keys. The account surface holds this single method rather than the API key repository: deleting an account must be able to find out whether a key still names it, and nothing more.

type LaunchController added in v1.1.0 

type LaunchController struct {
	// contains filtered or unexported fields
}

LaunchController exchanges a launch ticket for a console session.

It is the only route that turns something an operator can hold into something a browser can hold, and it exists so the browser never has to hold a gateway API key. A key pasted into a console is a long-lived account credential sitting in local storage, where a copied URL, a shared profile, or a browser extension can reach it and nothing can revoke it individually.

func NewLaunchController added in v1.1.0 

func NewLaunchController(gate *localauth.Gate) *LaunchController

NewLaunchController creates a controller over the running gateway's local admin token. A nil gate leaves the route mounted and refusing, which is what a deployment with no local token should do: 404 would say the feature does not exist in this build, and it does.

func (*LaunchController) Launch added in v1.1.0 

func (c *LaunchController) Launch(w http.ResponseWriter, r *http.Request)

Launch handles GET /launch.

It redirects rather than rendering the console itself, so the ticket leaves the address bar the moment it is spent. A console served directly at this URL would keep a spent credential in history, in the tab title, and in whatever the operator copies next.

type LogosController added in v1.1.0 

type LogosController struct {
	*BaseHandler
}

LogosController serves catalog identity marks. The bundled SVG set leads: it is curated color-first from one icon family, so marks render consistently, where catalog-carried bytes mix monochrome and color glyphs. Catalog bytes fill the gaps the bundle does not cover. The route is public: logos are static brand assets the console loads without credentials, like the health probes.

func NewLogosController added in v1.1.0 

func NewLogosController(service proxy.Proxy) *LogosController

NewLogosController creates the logos controller.

func (*LogosController) Get added in v1.1.0 

func (h *LogosController) Get(w http.ResponseWriter, r *http.Request)

Get handles GET /api/v1/logos/{kind}/{id}.svg.

type MediaController added in v1.1.0 

type MediaController struct {
	*BaseHandler
}

MediaController serves the three dedicated media operations. One controller holds all of them, because they share their authentication handling, their upload reading, and their protocol switch, and the only part that differs is which proxy method the handler calls.

func NewMediaController added in v1.1.0 

func NewMediaController(service proxy.Proxy) *MediaController

NewMediaController creates an OpenAI-protocol media controller.

func NewOpenRouterMediaController added in v1.1.0 

func NewOpenRouterMediaController(service proxy.Proxy) *MediaController

NewOpenRouterMediaController creates an OpenRouter-protocol media controller.

func (*MediaController) EditImages added in v1.1.0 

func (h *MediaController) EditImages(w http.ResponseWriter, r *http.Request)

EditImages handles POST /v1/images/edits. An edit carries its source image, so the body is multipart form data rather than JSON. OpenRouter publishes no edit path, so this handler serves the OpenAI family alone.

func (*MediaController) GenerateImages added in v1.1.0 

func (h *MediaController) GenerateImages(w http.ResponseWriter, r *http.Request)

GenerateImages handles POST /v1/images/generations and POST /api/v1/images.

func (*MediaController) Speech added in v1.1.0 

func (h *MediaController) Speech(w http.ResponseWriter, r *http.Request)

Speech handles POST /v1/audio/speech and POST /api/v1/audio/speech. The answer is an encoded audio file rather than JSON, so the handler writes the provider's bytes and repeats the media type the provider stated.

func (*MediaController) Transcribe added in v1.1.0 

func (h *MediaController) Transcribe(w http.ResponseWriter, r *http.Request)

Transcribe handles POST /v1/audio/transcriptions and POST /api/v1/audio/transcriptions.

func (*MediaController) Translate added in v1.1.0 

func (h *MediaController) Translate(w http.ResponseWriter, r *http.Request)

Translate handles POST /v1/audio/translations. It asks for an English transcript of speech in another language. OpenRouter publishes no translation path, so this handler serves the OpenAI family alone.

type MembersController added in v1.1.0 

type MembersController struct {
	// contains filtered or unexported fields
}

MembersController serves the deployment's people plane: the users an identity provider resolved, the teams an operator forms from them, and the account grants that give an account to one user or one team. The accounts themselves live on the accounts surface; a grant only names one, the way a shared credential's grant list names accounts without owning them.

func NewMembersController added in v1.1.0 

func NewMembersController(repositories identity.Repositories) *MembersController

NewMembersController creates the members controller. Zero repositories — a deployment with no identity configured — degrade every route to 503 rather than to an empty list, which would read as "nobody is here" on a gateway that never looked.

func (*MembersController) AddTeamMember added in v1.1.0 

func (h *MembersController) AddTeamMember(w http.ResponseWriter, r *http.Request)

AddTeamMember handles PUT /api/v1/admin/teams/{team_id}/members/{user_id}. PUT because the request states a fact — this user is on this team — and the whole fact is in the path.

func (*MembersController) CreateGrant added in v1.1.0 

func (h *MembersController) CreateGrant(w http.ResponseWriter, r *http.Request)

CreateGrant handles POST /api/v1/admin/account-grants. The body names one account and exactly one grantee, a user or a team.

func (*MembersController) CreateTeam added in v1.1.0 

func (h *MembersController) CreateTeam(w http.ResponseWriter, r *http.Request)

CreateTeam handles POST /api/v1/admin/teams. The gateway names the team itself: a team ID is a join key for memberships and grants, not a word an operator should have to invent.

func (*MembersController) DeleteGrant added in v1.1.0 

func (h *MembersController) DeleteGrant(w http.ResponseWriter, r *http.Request)

DeleteGrant handles DELETE /api/v1/admin/account-grants. The grant's three naming fields arrive as query parameters, because the composite of all three is the grant's only identity.

func (*MembersController) DeleteTeam added in v1.1.0 

func (h *MembersController) DeleteTeam(w http.ResponseWriter, r *http.Request)

DeleteTeam handles DELETE /api/v1/admin/teams/{team_id}. Deleting a team takes its memberships and its account grants with it: both rows are access control, so neither may outlive the team they name.

func (*MembersController) ListTeamGrants added in v1.1.0 

func (h *MembersController) ListTeamGrants(w http.ResponseWriter, r *http.Request)

ListTeamGrants handles GET /api/v1/admin/teams/{team_id}/grants.

func (*MembersController) ListTeamMembers added in v1.1.0 

func (h *MembersController) ListTeamMembers(w http.ResponseWriter, r *http.Request)

ListTeamMembers handles GET /api/v1/admin/teams/{team_id}/members. It reads the team first so an unknown team answers 404 rather than an empty roster.

func (*MembersController) ListTeams added in v1.1.0 

func (h *MembersController) ListTeams(w http.ResponseWriter, r *http.Request)

ListTeams handles GET /api/v1/admin/teams.

func (*MembersController) ListUserGrants added in v1.1.0 

func (h *MembersController) ListUserGrants(w http.ResponseWriter, r *http.Request)

ListUserGrants handles GET /api/v1/admin/users/{user_id}/grants: the grants that name this user directly, without the ones that reach it through teams.

func (*MembersController) ListUsers added in v1.1.0 

func (h *MembersController) ListUsers(w http.ResponseWriter, r *http.Request)

ListUsers handles GET /api/v1/admin/users.

func (*MembersController) ReachableAccounts added in v1.1.0 

func (h *MembersController) ReachableAccounts(w http.ResponseWriter, r *http.Request)

ReachableAccounts handles GET /api/v1/admin/users/{user_id}/accounts: every account this user's grants reach, the direct ones and the ones that arrive through any team the user is on, deduplicated. This is the operator's view of the same answer the session gate resolves for the user's own sessions.

func (*MembersController) RemoveTeamMember added in v1.1.0 

func (h *MembersController) RemoveTeamMember(w http.ResponseWriter, r *http.Request)

RemoveTeamMember handles DELETE /api/v1/admin/teams/{team_id}/members/{user_id}.

type ModelsController 

type ModelsController struct {
	*BaseHandler
}

ModelsController handles model-related endpoints

func NewModelsController 

func NewModelsController(service proxy.Proxy) *ModelsController

NewModelsController creates a new models controller

func NewOpenRouterModelsController 

func NewOpenRouterModelsController(service proxy.Proxy) *ModelsController

NewOpenRouterModelsController creates an OpenRouter models controller.

func (*ModelsController) Get 

func (h *ModelsController) Get(w http.ResponseWriter, r *http.Request)

Get handles GET /v1/models/{model} and /api/v1/models/{model}

func (*ModelsController) GetEndpoints 

func (h *ModelsController) GetEndpoints(w http.ResponseWriter, r *http.Request)

GetEndpoints handles GET /api/v1/models/{model}/endpoints

func (*ModelsController) List 

func (h *ModelsController) List(w http.ResponseWriter, r *http.Request)

List handles GET /v1/models and /api/v1/models

type PresetsController added in v1.1.0 

type PresetsController struct {
	// contains filtered or unexported fields
}

PresetsController serves preset CRUD under /api/v1/presets.

func NewPresetsController added in v1.1.0 

func NewPresetsController(repository presets.Repository) *PresetsController

NewPresetsController creates the preset management adapter.

func (*PresetsController) Create added in v1.1.0 

func (h *PresetsController) Create(w http.ResponseWriter, r *http.Request)

Create handles POST /api/v1/presets.

func (*PresetsController) Delete added in v1.1.0 

func (h *PresetsController) Delete(w http.ResponseWriter, r *http.Request)

Delete handles DELETE /api/v1/presets/{name}. An optional revision query parameter makes the delete conditional; without one it is unconditional.

func (*PresetsController) Get added in v1.1.0 

func (h *PresetsController) Get(w http.ResponseWriter, r *http.Request)

Get handles GET /api/v1/presets/{name}.

func (*PresetsController) List added in v1.1.0 

func (h *PresetsController) List(w http.ResponseWriter, r *http.Request)

List handles GET /api/v1/presets.

func (*PresetsController) Update added in v1.1.0 

func (h *PresetsController) Update(w http.ResponseWriter, r *http.Request)

Update handles PUT /api/v1/presets/{name}. The body's revision field names the revision the caller read; a mismatch conflicts.

type Protocol 

type Protocol string

Protocol identifies one external HTTP dialect. 

const (
	// ProtocolOpenAI selects the OpenAI v1 contract.
	ProtocolOpenAI Protocol = "openai"
	// ProtocolOpenRouter selects the OpenRouter v1 contract.
	ProtocolOpenRouter Protocol = "openrouter"
)

type ProviderCredentialsController added in v1.1.0 

type ProviderCredentialsController struct {
	// contains filtered or unexported fields
}

ProviderCredentialsController serves both stored provider-credential planes.

A shared credential belongs to the operator and serves the deployment's accounts. A BYOK credential belongs to one account and serves only that account. The plane is always named by the route rather than derived from the gateway API key that carried the request.

func NewProviderCredentialsController added in v1.1.0 

func NewProviderCredentialsController(
	providerKeys keyring.ProviderKeys,
	accounts accountPolicyReader,
) *ProviderCredentialsController

NewProviderCredentialsController creates the credential controller. A nil accounts reader disables BYOK-policy enforcement, which only a test uses.

func (*ProviderCredentialsController) BYOKDelete added in v1.1.0 

func (h *ProviderCredentialsController) BYOKDelete(w http.ResponseWriter, r *http.Request)

BYOKDelete handles DELETE /api/v1/accounts/{account_id}/byok/{provider}.

func (*ProviderCredentialsController) BYOKGet added in v1.1.0 

func (h *ProviderCredentialsController) BYOKGet(w http.ResponseWriter, r *http.Request)

BYOKGet handles GET /api/v1/accounts/{account_id}/byok/{provider}.

func (*ProviderCredentialsController) BYOKList added in v1.1.0 

func (h *ProviderCredentialsController) BYOKList(w http.ResponseWriter, r *http.Request)

BYOKList handles GET /api/v1/accounts/{account_id}/byok.

func (*ProviderCredentialsController) BYOKPut added in v1.1.0 

func (h *ProviderCredentialsController) BYOKPut(w http.ResponseWriter, r *http.Request)

BYOKPut handles PUT /api/v1/accounts/{account_id}/byok/{provider}. The write is where the operator's BYOK policy speaks: an account outside the policy never stores the credential, so nothing later has to unwind one.

func (*ProviderCredentialsController) BYOKValidate added in v1.1.0 

func (h *ProviderCredentialsController) BYOKValidate(w http.ResponseWriter, r *http.Request)

BYOKValidate handles POST /api/v1/accounts/{account_id}/byok/{provider}/validate.

func (*ProviderCredentialsController) SharedCreate added in v1.1.0 

func (h *ProviderCredentialsController) SharedCreate(w http.ResponseWriter, r *http.Request)

SharedCreate handles POST /api/v1/providers/{provider}/credentials. The response names the id that addresses the new credential from now on.

func (*ProviderCredentialsController) SharedDelete added in v1.1.0 

func (h *ProviderCredentialsController) SharedDelete(w http.ResponseWriter, r *http.Request)

SharedDelete handles DELETE /api/v1/providers/{provider}/credentials/{credential_id}.

func (*ProviderCredentialsController) SharedGet added in v1.1.0 

func (h *ProviderCredentialsController) SharedGet(w http.ResponseWriter, r *http.Request)

SharedGet handles GET /api/v1/providers/{provider}/credentials/{credential_id}.

func (*ProviderCredentialsController) SharedList added in v1.1.0 

func (h *ProviderCredentialsController) SharedList(w http.ResponseWriter, r *http.Request)

SharedList handles GET /api/v1/providers/{provider}/credentials. An empty plane is an empty collection: "no credential is stored" is an answer about the list, not a lookup failure.

func (*ProviderCredentialsController) SharedUpdate added in v1.1.0 

func (h *ProviderCredentialsController) SharedUpdate(w http.ResponseWriter, r *http.Request)

SharedUpdate handles PUT /api/v1/providers/{provider}/credentials/{credential_id}.

func (*ProviderCredentialsController) SharedValidate added in v1.1.0 

func (h *ProviderCredentialsController) SharedValidate(w http.ResponseWriter, r *http.Request)

SharedValidate handles POST /api/v1/providers/{provider}/credentials/{credential_id}/validate.

type ProviderOperations added in v1.0.3 

type ProviderOperations interface {
	ProviderStates() providerstate.Snapshot
	RefreshProviders(context.Context) (providers.ReconcileReport, error)
	// ProviderIncidentLog answers one provider's published incident log;
	// the bool reports whether the catalog knows the provider at all.
	ProviderIncidentLog(context.Context, catalogs.ProviderID) (statuspage.History, bool)
	// ProviderIncidentTransitions answers the durable record of indicator
	// changes this gateway observed for one provider, newest first.
	ProviderIncidentTransitions(context.Context, catalogs.ProviderID) ([]providerstate.IncidentTransition, error)
}

ProviderOperations supplies safe provider state and forced reconciliation.

type ProviderOperationsController added in v1.0.3 

type ProviderOperationsController struct {
	// contains filtered or unexported fields
}

ProviderOperationsController handles authenticated provider operations.

func NewProviderOperationsController added in v1.0.3 

func NewProviderOperationsController(operations ProviderOperations) *ProviderOperationsController

NewProviderOperationsController creates the provider operations adapter.

func (*ProviderOperationsController) Incidents added in v1.1.0 

func (h *ProviderOperationsController) Incidents(w http.ResponseWriter, r *http.Request)

Incidents handles GET /api/v1/admin/providers/{provider}/incidents. The response keeps the two provenances apart: `log` is what the provider's own status page publishes about itself, and `observed` is what this gateway saw the live indicator do, on this deployment's clock.

func (*ProviderOperationsController) Refresh added in v1.0.3 

func (h *ProviderOperationsController) Refresh(w http.ResponseWriter, r *http.Request)

Refresh handles POST /api/v1/admin/providers/refresh.

func (*ProviderOperationsController) Status added in v1.0.3 

func (h *ProviderOperationsController) Status(w http.ResponseWriter, _ *http.Request)

Status handles GET /api/v1/admin/providers.

type ProvidersController 

type ProvidersController struct {
	*BaseHandler
}

ProvidersController handles provider-related endpoints

func NewProvidersController 

func NewProvidersController(service proxy.Proxy) *ProvidersController

NewProvidersController creates a new providers controller

func (*ProvidersController) List 

func (h *ProvidersController) List(w http.ResponseWriter, r *http.Request)

List handles GET /api/v1/providers

type RerankController added in v1.1.0 

type RerankController struct {
	*BaseHandler
}

RerankController serves POST /v1/rerank and POST /api/v1/rerank. The two paths plan one route and reach one provider. They differ only at the edge, where each protocol owns its own wire names, so the handler below reads the decoding its protocol produced and writes the answer that protocol states.

func NewOpenRouterRerankController added in v1.1.0 

func NewOpenRouterRerankController(service proxy.Proxy) *RerankController

NewOpenRouterRerankController creates an OpenRouter-protocol rerank controller.

func NewRerankController added in v1.1.0 

func NewRerankController(service proxy.Proxy) *RerankController

NewRerankController creates an OpenAI-protocol rerank controller.

func (*RerankController) Create added in v1.1.0 

func (h *RerankController) Create(w http.ResponseWriter, r *http.Request)

Create handles POST /v1/rerank and POST /api/v1/rerank.

type VideosController added in v1.1.0 

type VideosController struct {
	*BaseHandler
	// contains filtered or unexported fields
}

VideosController serves the video job surface.

It holds the job service rather than calling the gateway directly, because the record is what a caller comes back to and the service is the only thing that writes a state. The gateway reaches a provider only through the runner this controller hands the service, which is what keeps the provider job identifier inside internal/jobs.

func NewOpenRouterVideosController added in v1.1.0 

func NewOpenRouterVideosController(service proxy.Proxy, records *jobs.Service) *VideosController

NewOpenRouterVideosController creates an OpenRouter-protocol controller.

func NewVideosController added in v1.1.0 

func NewVideosController(service proxy.Proxy, records *jobs.Service) *VideosController

NewVideosController creates an OpenAI-protocol video job controller.

func (*VideosController) Cancel added in v1.1.0 

func (h *VideosController) Cancel(w http.ResponseWriter, r *http.Request)

Cancel handles POST /v1/videos/{video_id}/cancel.

func (*VideosController) Content added in v1.1.0 

func (h *VideosController) Content(w http.ResponseWriter, r *http.Request)

Content handles GET /v1/videos/{video_id}/content.

The route serves Starport's own stored bytes and never redirects a caller to the provider. A provider link expires on the provider's schedule and carries the provider's credential, so a caller holding a Starport identifier would be handed something it cannot read and this gateway cannot promise.

The route reads the record first, so a job another account owns answers not found here exactly as it does on every other video path.

func (*VideosController) Get added in v1.1.0 

func (h *VideosController) Get(w http.ResponseWriter, r *http.Request)

Get handles GET /v1/videos/{video_id}.

The read reaches a provider only while the answer can still change, which the job service decides. A caller may poll a finished job as often as it likes and reach no provider at all.

func (*VideosController) List added in v1.1.0 

func (h *VideosController) List(w http.ResponseWriter, r *http.Request)

List handles GET /v1/videos. It reads records and asks no provider anything, so a listing costs one storage read however many jobs are still running.

func (*VideosController) Submit added in v1.1.0 

func (h *VideosController) Submit(w http.ResponseWriter, r *http.Request)

Submit handles POST /v1/videos and POST /api/v1/videos.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.