Documentation
¶
Index ¶
- func AddHealthRoutes(mux *http.ServeMux)
- func AddUIAuthRoutes(mux *http.ServeMux, token string)
- func AddVersionRoutes(mux *http.ServeMux, version, nodeInstanceID, tenancy string)
- func AuthenticateCredential(token, cred string) bool
- func Handler(mux *http.ServeMux, config *Config) http.Handler
- func IsLoopbackAddress(addr string) bool
- func LoadConfig[T any](cfg *T) error
- func New(ctx context.Context, mux *http.ServeMux, nodeInstanceID, tenancy string, ...) (func() error, error)
- func ProtectAPI(token, allowedOrigins string, next http.Handler) http.Handler
- func ProtectMutatingAPI(token string, next http.Handler) http.Handler
- func ProtectMutatingAPIWithAllowedOrigins(token, allowedOrigins string, next http.Handler) http.Handler
- func ValidateLocalServeSecurity(addr, token string) error
- type Config
- type Dependencies
- type HealthResponse
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func AddHealthRoutes ¶
AddHealthRoutes registers GET /health for liveness checks.
func AddUIAuthRoutes ¶ added in v0.36.0
AddUIAuthRoutes registers the Beam login endpoints on mux. Wire it on the serve root mux only (outside the /api protection wrapper, so /ui/login is reachable without already holding the cookie it issues). token is the configured shared secret; when empty, login is not required and the endpoints report so while remaining harmless no-ops.
func AddVersionRoutes ¶
AddVersionRoutes registers GET /version.
func AuthenticateCredential ¶ added in v0.36.0
AuthenticateCredential reports whether cred authenticates against the configured token. It accepts either the raw TOKEN itself (compared in constant time — the programmatic Bearer / X-API-Key / ?token= path) or a valid session JWT minted by /ui/login (the browser cookie path). Both the API protection middleware and the /acp WebSocket upgrade use this single gate, so one login satisfies every serve surface. Returns false when no token is configured (callers gate on that separately) or cred is empty.
func Handler ¶ added in v0.32.8
Handler wraps a mux with the standard middleware chain: CORS, request ID, tracing, and local API request protection.
func IsLoopbackAddress ¶
func LoadConfig ¶
LoadConfig populates cfg from environment variables (lowercased keys mapped to json tags).
func New ¶
func New(ctx context.Context, mux *http.ServeMux, nodeInstanceID, tenancy string, config *Config, deps ...Dependencies) (func() error, error)
New registers the spine routes (not-found shape, health, version) on mux and, when deps are supplied, the product API routes. Returns a cleanup function.
func ProtectAPI ¶ added in v0.36.0
ProtectAPI is the primary /api/* gate. When a TOKEN is configured, EVERY request — all methods including GET/HEAD, same-origin or cross-site — must present a valid credential (a session-cookie JWT from /ui/login, or the raw TOKEN as a Bearer / X-API-Key header for programmatic clients); anything else is 401. This closes the same-origin-read hole where a LAN attacker's browser, or any local script, could read /api/state, /api/backends, /api/mcp-servers, etc. with no credential because only mutations were gated.
When NO token is configured (the loopback zero-friction case), the historical CSRF stance is preserved: reads pass, and browser-originated mutations must be same-origin (or an explicitly allowed origin) — a cross-site browser mutation is 403. Non-loopback binds already require a TOKEN (ValidateLocalServeSecurity), so the no-token branch only ever serves local development.
func ProtectMutatingAPI ¶
ProtectMutatingAPI wraps next with ProtectAPI and no explicit allowed origins.
func ProtectMutatingAPIWithAllowedOrigins ¶ added in v0.33.0
func ProtectMutatingAPIWithAllowedOrigins(token, allowedOrigins string, next http.Handler) http.Handler
ProtectMutatingAPIWithAllowedOrigins is retained as an alias for ProtectAPI so existing callers keep compiling; the name is historical (the wrapper no longer gates only mutations — see ProtectAPI).
Types ¶
type Config ¶
type Config struct {
Addr string `json:"addr"`
Port string `json:"port"`
Token string `json:"token"`
UIBaseURL string `json:"ui_base_url"`
AllowedAPIOrigins string `json:"allowed_api_origins"`
ProxyOrigin string `json:"proxy_origin"`
BeamDevProxyURL string `json:"beam_dev_proxy_url"`
TerminalEnabled string `json:"terminal_enabled"`
TerminalAllowedRoot string `json:"terminal_allowed_root"`
TerminalShell string `json:"terminal_shell"`
TerminalIdleTimeout string `json:"terminal_idle_timeout"`
TerminalMaxSessions string `json:"terminal_max_sessions"`
// WorkspaceRoots is the operator's allowlist of directories a browser client
// may choose as a session workspace, separated by the OS path-list separator
// (":" on POSIX). The serve directory is always the default root; these
// extend the allowlist. Also settable via `--workspace-root` flags and the
// `contenox serve [dir]` positional arguments.
WorkspaceRoots string `json:"workspace_roots"`
}
Config holds the HTTP serving configuration for `contenox serve`.
type Dependencies ¶
type Dependencies struct {
DB libdb.DBManager
PubSub libbus.Messenger
State *runtimestate.State
ToolsProviderService toolsproviderservice.Service
Auth middleware.AuthZReader
Agent agentservice.Agent
Chains taskchainservice.Service
WorkspaceID string
ProjectRoot string
ContenoxDir string
// WorkspaceRoots is the workspace-root allowlist. When set, the /files browse
// API resolves each request against a client-supplied `root` (validated
// through the allowlist) instead of the single fixed ProjectRoot.
WorkspaceRoots *vfs.Factory
Defaults stateservice.RuntimeDefaults
TerminalService terminalservice.Service
TerminalEnabled bool
// HITLPolicySource and HITLDefaultPolicyName feed the /files `agent` view
// filter: verdicts are computed by the same HITL policy engine the live agent
// uses. When HITLPolicySource is nil the filter is unavailable (the raw tree
// still serves). HITLDefaultPolicyName is the fallback policy when a request
// omits `policy`; empty means the service's built-in default.
HITLPolicySource hitlservice.PolicySource
HITLDefaultPolicyName string
}
Dependencies are the services the product routes are mounted on. All fields are optional: a route group is only registered when its dependencies are present, so a bare runtime still serves /health and /version.
type HealthResponse ¶
type HealthResponse struct {
Status string `json:"status"`
}
Source Files