Documentation
¶
Overview ¶
Package server owns the bounded administrative HTTP server lifecycle.
Index ¶
Constants ¶
const ( // APIKeyIDHeader carries the non-secret static key identifier. APIKeyIDHeader = "X-Queue-Control-Key-ID" //nolint:gosec // A protocol header name, not a credential. // APIKeySecretHeader carries the static key credential. APIKeySecretHeader = "X-Queue-Control-Key" //nolint:gosec // A protocol header name, not a credential. )
Variables ¶
var ErrInvalidAccessDocument = errors.New("server: invalid access document")
ErrInvalidAccessDocument is a secret-safe static access configuration error.
var ErrInvalidConfiguration = errors.New("server: invalid configuration")
Functions ¶
func NewAdministrativeHandler ¶
func NewAdministrativeHandler( api http.Handler, extractor authhttp.CredentialExtractor, authenticator authentication.Authenticator, challenge authentication.Challenge, securityConfig apihttp.SecurityConfig, ) (http.Handler, error)
NewAdministrativeHandler composes browser admission and fail-closed authentication middleware around the administrative API. Missing credentials become an explicit anonymous principal so health endpoints can remain public; administrative endpoints still reject that principal.
Types ¶
type Config ¶
type Config struct {
ReadHeaderTimeout time.Duration
ReadTimeout time.Duration
WriteTimeout time.Duration
IdleTimeout time.Duration
ShutdownTimeout time.Duration
MaxHeaderBytes int
}
Config bounds HTTP admission and graceful shutdown.
type Server ¶
type Server struct {
// contains filtered or unexported fields
}
Server serves one preconfigured listener without supervising other processes.
type StaticAccess ¶
type StaticAccess struct {
Extractor *authhttp.Extractor
Authenticator authentication.Authenticator
Authorizer *controlauthz.Authorizer
Challenge authentication.Challenge
}
StaticAccess is a coherent authentication and authorization configuration.
func LoadStaticAccess ¶
func LoadStaticAccess(reader io.Reader, maxBytes int64) (*StaticAccess, error)
LoadStaticAccess reads one strict, bounded JSON access document without retaining or formatting its source bytes in errors.
func LoadStaticAccessFile ¶
func LoadStaticAccessFile(path string, maxBytes int64) (*StaticAccess, error)
LoadStaticAccessFile opens one access document without disclosing its path or contents through returned errors.
func NewStaticAccess ¶
NewStaticAccess builds bounded API-key authentication and deny-overrides ACL authorization from immutable startup configuration.
Source Files