httpx

func DefaultLookupIP ¶

func DefaultLookupIP(ctx context.Context, host string) ([]net.IP, error)

func GetClientBaseURL ¶

func GetClientBaseURL(origin, forwardedHost, forwardedProto, host, appURL string) string

GetClientBaseURL determines the client's base URL from request headers. It checks Origin, X-Forwarded-Host/Proto, and Host headers. If none provide a valid URL, it falls back to the configured appURL.

func GetIntQueryParam ¶

func GetIntQueryParam(r *http.Request, name string, required bool) (int, error)

GetIntQueryParam reads and parses an integer query parameter from the request URL. If `required` is true and the parameter is missing, or if parsing fails, an error is returned.

func GetQueryParam ¶

func GetQueryParam(r *http.Request, name string, required bool) (string, error)

GetQueryParam reads a string query parameter from the request URL. If `required` is true and the parameter is missing or empty, an error is returned.

func NewHTTPClient ¶

func NewHTTPClient() *http.Client

func NewHTTPClientWithTimeout ¶

func NewHTTPClientWithTimeout(timeout time.Duration) *http.Client

func NewSafeOutboundHTTPClient ¶

func NewSafeOutboundHTTPClient(base *http.Client, lookupIP LookupIPFunc) (*http.Client, error)

func RunAuthorizedAggregateStream ¶ added in v2.4.0

func RunAuthorizedAggregateStream[T any](
	ctx context.Context,
	ps *authz.PermissionSet,
	permission string,
	config agg.Config[T],
	localProducer agg.Producer[T],
	remoteProducer agg.Producer[T],
) error

RunAuthorizedAggregateStream selects local and remote producers from the caller's effective permissions before starting an aggregate stream. Remote producers must still filter individual environments with PermissionSet.Allows.

func SetJSONStreamHeaders ¶

func SetJSONStreamHeaders(headers HeaderSetter)

func ValidateOutboundHTTPURL ¶

func ValidateOutboundHTTPURL(rawURL string) (*url.URL, error)

ValidateOutboundHTTPURL parses and validates an outbound HTTP(S) target URL. It intentionally performs syntactic hardening (scheme/host/credentials) without restricting private network ranges, because environment agents may be deployed on trusted private subnets.

func ValidateSafeRemoteURL ¶

func ValidateSafeRemoteURL(ctx context.Context, rawURL string, lookupIP LookupIPFunc) (*url.URL, error)

func ValidateWebSocketOrigin ¶

func ValidateWebSocketOrigin(appURL string) func(r *http.Request) bool

ValidateWebSocketOrigin validates the Origin header for WebSocket connections to prevent CSRF attacks. It checks: 1. Same-origin requests (Origin matches Host) 2. Allowed origins from appURL 3. Handles empty Origin headers (some clients don't send it)