Documentation
¶
Index ¶
- Constants
- func APIGroupFromContext(c *gin.Context) string
- func CORS() gin.HandlerFunc
- func CheckTeamAccessForRoute(c *gin.Context, team *types.Team) error
- func EnforceBlockedTeam() gin.HandlerFunc
- func InitLaunchDarklyContext(c *gin.Context)
- func IsSecretsRoute(c *gin.Context) bool
- func LabelMetricsWithTeam() gin.HandlerFunc
- func NoStoreSecrets() gin.HandlerFunc
- func ReadRequestBody(limit int64) gin.HandlerFunc
- func RefuseDeletedProject(isProjectDeleted func(ctx context.Context, projectID uuid.UUID) (bool, error)) gin.HandlerFunc
- func WithAPIGroup(authenticate openapi3filter.AuthenticationFunc) openapi3filter.AuthenticationFunc
Constants ¶
const ( SecretsInvalidRequestMessage = "Invalid secrets request" SecretsNotFoundMessage = "Secret not found" SecretsConflictMessage = "Secret cannot be modified in its current state" SecretsBackendMessage = "Secrets backend error" SecretsBackendTimeoutMessage = "Secrets backend timed out" )
The fixed public messages shared by everything that can answer a secrets request: this package, the request-validation error handler, and the handlers. A caller learns the class of the failure and nothing else.
const APIGroupExtension = "x-api-group"
Variables ¶
This section is empty.
Functions ¶
func APIGroupFromContext ¶
func CORS ¶
func CORS() gin.HandlerFunc
CORS returns the gin CORS middleware for the api service. A preflight is answered and the chain stopped, since no route serves OPTIONS.
func CheckTeamAccessForRoute ¶
CheckTeamAccessForRoute applies CheckTeamBanned + the api blocked-team allowlist to a late-resolved team.
func EnforceBlockedTeam ¶
func EnforceBlockedTeam() gin.HandlerFunc
EnforceBlockedTeam returns the gin middleware for the api service, configured with the api-specific blocked-team allowlist.
func InitLaunchDarklyContext ¶
func IsSecretsRoute ¶
IsSecretsRoute reports whether a request targets the secret management path family. It answers for unmatched paths too, so a 404 below /secrets is treated as confidentially as a matched route.
func LabelMetricsWithTeam ¶
func LabelMetricsWithTeam() gin.HandlerFunc
LabelMetricsWithTeam puts the authenticated team on the request's metrics through the gin key the metrics middleware reads once the chain has run, so the team the auth middleware resolves further down still labels the request.
func NoStoreSecrets ¶
func NoStoreSecrets() gin.HandlerFunc
NoStoreSecrets marks every response on the secrets path family before any later layer writes, whichever one answers: auth, validation, the rate limiter, the handlers, or a recovered panic. Gin's own canonical-path redirects bypass the middleware chain and are deliberately not covered: they carry no body and no customer data.
func ReadRequestBody ¶
func ReadRequestBody(limit int64) gin.HandlerFunc
ReadRequestBody reads the whole request body, up to limit bytes, before the request validator runs, and answers a body it cannot read itself: 413 when it is over the limit, else 400. The validator reads a routed request's body before authenticating anyway, so reading it here first adds only a copy in memory. A request no route matches gets 404, and nothing reads its body.
func RefuseDeletedProject ¶
func RefuseDeletedProject(isProjectDeleted func(ctx context.Context, projectID uuid.UUID) (bool, error)) gin.HandlerFunc
RefuseDeletedProject answers 404 to a write addressed to a deleted project. A deleted project keeps its team row, so without this the handlers would still find it and apply the write.
func WithAPIGroup ¶
func WithAPIGroup(authenticate openapi3filter.AuthenticationFunc) openapi3filter.AuthenticationFunc
WithAPIGroup records the validator's matched API group in Gin after authentication succeeds.
Types ¶
This section is empty.
Source Files
Directories