protection

package

v0.14.0 Latest Latest Go to latest Published: Jun 15, 2026 License: MIT Imports: 4 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/aynaash/nextdeploy

Links

Open Source Insights

Documentation ¶

Overview ¶

Package protection builds the edge-guard runtime config from a user's protection spec. It is deliberately decoupled from the config (YAML) layer — callers map config.CFProtection → protection.Config — so the normalizer and the emitted JSON contract can be unit-tested in isolation and reused by the nextcompile runtime without importing the whole config package.

The output (Runtime) is serialized to _nextdeploy/protection.json and read by runtime_src/guard.mjs at the edge. All defaults are resolved here so the JS side never has to guess.

Index ¶

Constants
type Auth
type AuthRT
type Config
type RateLimit
type RateLimitRT
type Runtime
- func BuildRuntime(c *Config) (*Runtime, error)
- func (r *Runtime) JSON() ([]byte, error)

Constants ¶

View Source

const (
	DefaultSecretEnv    = "AUTH_SECRET"
	DefaultCookieName   = "session"
	DefaultLoginPath    = "/login"
	DefaultKVBinding    = "RATE_LIMIT"
	DefaultRequestsPerM = 60
)

Defaults applied when the user leaves a field blank.

Variables ¶

This section is empty.

Functions ¶

This section is empty.

Types ¶

type Auth ¶

type Auth struct {
	SecretEnv      string
	CookieName     string
	ProtectedPaths []string
	LoginPath      string
}

type AuthRT ¶

type AuthRT struct {
	SecretEnv      string   `json:"secretEnv"`
	CookieName     string   `json:"cookieName"`
	LoginPath      string   `json:"loginPath"`
	ProtectedPaths []string `json:"protectedPaths"`
}

type Config ¶

type Config struct {
	Enabled     bool
	PublicPaths []string
	Auth        *Auth
	RateLimit   *RateLimit
	Allow       []string
	Deny        []string
}

Config is the decoupled mirror of config.CFProtection.

type RateLimit ¶

type RateLimit struct {
	KVBinding         string
	RequestsPerMinute int
	Paths             []string
}

type RateLimitRT ¶

type RateLimitRT struct {
	KVBinding         string   `json:"kvBinding"`
	RequestsPerMinute int      `json:"requestsPerMinute"`
	Paths             []string `json:"paths"`
}

type Runtime ¶

type Runtime struct {
	Version     int          `json:"version"`
	PublicPaths []string     `json:"publicPaths"`
	Allow       []string     `json:"allow,omitempty"`
	Deny        []string     `json:"deny,omitempty"`
	Auth        *AuthRT      `json:"auth,omitempty"`
	RateLimit   *RateLimitRT `json:"rateLimit,omitempty"`
}

Runtime is the normalized, fully-defaulted shape guard.mjs consumes.

func BuildRuntime ¶

func BuildRuntime(c *Config) (*Runtime, error)

BuildRuntime validates c and resolves defaults. Returns (nil, nil) when protection is absent or disabled (caller emits no guard). Returns an error when Enabled but no actual rule (auth / rate-limit / allow / deny) is set — a guard that does nothing is almost always a config mistake.

func (*Runtime) JSON ¶

func (r *Runtime) JSON() ([]byte, error)

JSON renders the runtime config deterministically (stable key order via the struct field order; slices are already deduped/sorted where it matters).

Source Files ¶

View all Source files

protection.go

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL