Documentation
¶
Overview ¶
Package internalrpc is the server-to-server RPC plumbing for the fleet: a per-peer connection pool, API-key authentication for internal-only endpoints, and helpers for forwarding a request to the member that owns its key. It carries no domain knowledge — event forwarding and cluster ownership forwarding ride the same machinery.
Index ¶
Constants ¶
const APIKeyHeaderName = "x-flipcash-internal-rpc-api-key"
APIKeyHeaderName carries the internal RPC API key. Internal endpoints are reachable on the public gRPC surface, so every internal RPC must present a key and every internal handler must verify one.
Variables ¶
var ErrPoolClosed = errors.New("internal rpc connection pool is closed")
ErrPoolClosed is returned by Conn after Close: a connection created past Close would never be closed or reaped.
Functions ¶
func RedirectAddress ¶
RedirectAddress extracts the forwarding target from an Ownership.Do error. ok is true only when the error is a NotOwnerError naming a member: forward the request to the returned address (and report a failed forward via Ownership.NoteUnreachable). ok is false for a redirect-less NotOwnerError — no healthy owner is known, so use the store-serialized fallback — and for every other error.
Types ¶
type Authenticator ¶
type Authenticator struct {
// contains filtered or unexported fields
}
Authenticator verifies internal API keys on incoming RPCs. It holds the set of currently accepted keys, which may exceed one so keys can be rotated across a deploy without rejecting in-flight traffic.
func NewAuthenticator ¶
func NewAuthenticator(apiKeys ...string) *Authenticator
NewAuthenticator creates an authenticator accepting the given keys. Empty keys are discarded: an absent header reads back as the empty string, so accepting "" (e.g. from an unset config value) would leave internal endpoints open to unauthenticated callers on the public gRPC surface. An authenticator left with no keys denies everything — a misconfiguration fails closed and loud, never open.
func (*Authenticator) Allow ¶
func (a *Authenticator) Allow(ctx context.Context) (bool, error)
Allow reports whether the RPC presented an accepted internal API key. A malformed header is an error; an absent header (which reads as "") or a well-formed but unaccepted key is (false, nil) so handlers can return their endpoint's denial shape.
type Pool ¶
type Pool struct {
// contains filtered or unexported fields
}
Pool caches one gRPC client connection per peer address. Connections are created lazily, shared by all callers, and reaped only once they report broken (peer addresses die with their instances, so idle-but-healthy conns are cheap and worth keeping).
Source Files