Documentation
¶
Overview ¶
Package app builds the identity service HTTP handler from injected dependencies. It is shared by the production binary (cmd/identity) and the integration test harness (tests/integration), so that both exercise the exact same wiring code: middleware chain, audit logger, service layer, and Connect-RPC handler registration.
Schema declaration listing.
EntDB's schema is client-side: the SDK reads (entdb.node) / (entdb.edge) options off the proto descriptor at every call site, and the wire format is keyed by proto field id. There is no server-side "register schema" step to wait for — the previous "schema_registration_pending_upstream_api" warning was wrong about the SDK contract.
This file therefore loads the embedded FileDescriptor for identity's schema and emits one structured log line per declared node type at startup, so operators can see the contract identity runs against. It does no I/O.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ErrSchemaMalformed = errors.New("identity schema descriptor is malformed")
ErrSchemaMalformed indicates the embedded identity schema descriptor is missing required (entdb.node) annotations on messages we declared as node types. We treat this as an internal invariant violation — identity binaries should never ship with a schema that fails this check.
Functions ¶
func New ¶
New builds the full HTTP handler stack: middleware chain wrapping the Connect-RPC handler. The returned shutdown func must be called during graceful termination so background workers (audit flusher etc.) drain cleanly. Configuration errors (e.g. invalid CORS origins) are returned without starting the audit flusher.
Types ¶
type Deps ¶
type Deps struct {
Config *config.Config
Logger *zap.Logger
KeyRing *jwt.KeyRing
Repo service.Repository
DB service.DB
Passkeys *passkeys.WebAuthnService
TOTPKey []byte
// TOTPRecoveryPepper is the HMAC-SHA-256 key used to hash and
// verify recovery codes. Must be >= totp.MinRecoveryPepperBytes
// bytes long; the binary refuses to start otherwise.
TOTPRecoveryPepper []byte
// EmailTransport delivers outbound mail. If nil, New constructs a
// transport from cfg via buildEmailTransport (so production code
// only needs to populate this when a test wants a custom recorder).
EmailTransport email.Transport
// OAuthRegistry holds the per-provider Exchangers used for OAuth
// login. May be nil — in that case OAuthLogin returns
// ErrOAuthDisabled. When nil, New builds a registry from the
// config's GATEWAY_*_CLIENT_ID/SECRET env vars (only providers
// with both credentials set are registered).
OAuthRegistry *oauth.Registry
// IDVProvider drives identity-verification (document + selfie).
// May be nil — in that case BeginIdentityVerification returns
// CodeUnimplemented. Production deployments wire an Azure or
// other real provider; tests typically pass an idv.StubProvider.
IDVProvider idv.Provider
}
Deps groups the injectable dependencies required to build the identity HTTP handler. It lets the production main.go pass real adapters and the integration test harness pass in-memory fakes, without duplicating the wiring code.
Source Files