Documentation
¶
Overview ¶
Package requestctx defines typed request context values shared by the server middleware and HTTP controllers.
Index ¶
- func AccountCredentialStrategyOrDefault(ctx context.Context) account.CredentialStrategy
- func AccountIDOrDefault(ctx context.Context) string
- func GetAPIKey(ctx context.Context) (string, bool)
- func GetAPIKeyID(ctx context.Context) (string, bool)
- func GetAPIKeyModel(ctx context.Context) (*apikey.APIKey, bool)
- func GetAccountRecord(ctx context.Context) (*account.Account, bool)
- func GetConsoleSession(ctx context.Context) (grant, subject string, ok bool)
- func GetTeamID(ctx context.Context) string
- func ReleaseTimeout(ctx context.Context)
- func WithAPIKey(ctx context.Context, value string) context.Context
- func WithAPIKeyID(ctx context.Context, value string) context.Context
- func WithAPIKeyModel(ctx context.Context, value *apikey.APIKey) context.Context
- func WithAccountID(ctx context.Context, value string) context.Context
- func WithAccountRecord(ctx context.Context, value *account.Account) context.Context
- func WithConsoleSession(ctx context.Context, grant, subject string) context.Context
- func WithTimeoutRelease(ctx context.Context, release func()) context.Context
- type Key
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func AccountCredentialStrategyOrDefault ¶ added in v1.1.0
func AccountCredentialStrategyOrDefault(ctx context.Context) account.CredentialStrategy
AccountCredentialStrategyOrDefault returns the credential policy the operator set for this request's account. It is the ceiling a per-request strategy may narrow and may never widen, so an unreadable account resolves to the default rather than to no policy at all.
func AccountIDOrDefault ¶ added in v1.1.0
AccountIDOrDefault returns the account the request runs under, falling back to the canonical account when no authenticated caller set one.
This is the single place that decides the account of a request that carries no key. An unauthenticated gateway still has to attribute usage, apply limits, and select credentials, and it attributes all of them to the default account.
func GetAPIKeyID ¶
GetAPIKeyID returns the API key ID from the context.
func GetAPIKeyModel ¶
GetAPIKeyModel returns the API key model from the context.
func GetAccountRecord ¶ added in v1.1.0
GetAccountRecord returns the account behind the authenticated key. It is absent when the deployment could not read the account, which is not an authentication failure: the key is still valid and the request falls back to the default governing policy.
func GetConsoleSession ¶ added in v1.2.0
GetConsoleSession returns the console session's grant kind and identity subject. The second return is false when the request carried no console session.
func GetTeamID ¶ added in v1.2.0
GetTeamID returns the team the serving key is attributed to. It is empty for a teamless key and for a request that carries no key model, so team attribution and the team budget both read one derivation.
func ReleaseTimeout ¶ added in v1.2.1
ReleaseTimeout releases the request timing bound. A request that carries no bound releases nothing, so a handler calls it without a check.
func WithAPIKey ¶
WithAPIKey stores the raw API key in the context.
func WithAPIKeyID ¶
WithAPIKeyID stores the API key ID in the context.
func WithAPIKeyModel ¶
WithAPIKeyModel stores the API key model in the context.
func WithAccountID ¶ added in v1.1.0
WithAccountID stores the request account in the context.
func WithAccountRecord ¶ added in v1.1.0
WithAccountRecord stores the account behind the authenticated key.
func WithConsoleSession ¶ added in v1.2.0
WithConsoleSession stores the grant kind and identity subject of the console session a request arrived with.
Types ¶
type Key ¶
type Key string
Key is the typed context key used for server request metadata.
const ( // APIKey stores the raw API key for downstream provider-key lookups. APIKey Key = "api_key" // APIKeyID stores the authenticated Starport API key ID. APIKeyID Key = "api_key_id" // APIKeyModel stores the authenticated API key model. APIKeyModel Key = "api_key_model" // #nosec G101 - context key name, not a credential. // AccountID stores the account the request runs under. It is distinct from // APIKeyID: many keys can belong to one account. AccountID Key = "account_id" // AccountRecord stores the account behind the authenticated key. It is the // operator's governing record: the credential strategy the request may run // under, and the limits it spends against. AccountRecord Key = "account_record" // ConsoleGrant stores the grant kind that minted a console session, when // the request arrived with one. The audit trail reads it to name the // actor behind a console mutation. ConsoleGrant Key = "console_grant" // ConsoleSubject stores who an identity provider said the console caller // is. It is empty for the machine-local grants, which prove where the // caller is and not who. ConsoleSubject Key = "console_subject" // TimeoutRelease stores the release of the request timing bound. The // middleware owns the bound, so a handler that commits to a long response // releases it here instead of clearing a write deadline that leaves the // parent context deadline in place. TimeoutRelease Key = "timeout_release" )
Source Files