Documentation
¶
Overview ¶
Package middleware provides HTTP middleware for the MCP Kubernetes server. These middleware functions handle security headers, CORS, and other cross-cutting concerns.
Index ¶
- Constants
- func CORS(allowedOrigins []string) func(http.Handler) http.Handler
- func HTTPMetrics(provider *instrumentation.Provider) func(http.Handler) http.Handler
- func RequireIdentity(auditor *security.Auditor, logger *slog.Logger) func(http.Handler) http.Handler
- func SecurityHeaders(hstsEnabled bool) func(http.Handler) http.Handler
- func ValidateAllowedOrigins(originsEnv string) ([]string, error)
Constants ¶
const EventTokenMissingIdentity = "token_missing_identity"
EventTokenMissingIdentity is the audit event type emitted when a structurally valid bearer token reaches /mcp without an email claim, so Kubernetes impersonation cannot proceed.
Variables ¶
This section is empty.
Functions ¶
func HTTPMetrics ¶ added in v0.0.139
HTTPMetrics creates middleware that records HTTP request metrics. It records the total number of requests and request duration for each method/path/status combination.
The middleware normalizes paths to prevent high cardinality: - /mcp/{session_id} -> /mcp/:session (for session-based endpoints) - UUID patterns are replaced with :uuid - Numeric IDs are replaced with :id
The provider parameter can be nil, in which case the middleware is a no-op that just passes through to the next handler.
func RequireIdentity ¶ added in v0.2.1
func RequireIdentity(auditor *security.Auditor, logger *slog.Logger) func(http.Handler) http.Handler
RequireIdentity rejects requests whose validated UserInfo carries no email claim. Without an email there is no Impersonate-User to send to the Kubernetes API; the request would otherwise pass through and fail later with a misleading "unknown resource type" error from the discovery client.
Must be wired after the OAuth ValidateToken middleware so UserInfo is on the context. Requests without UserInfo are passed through unchanged (ValidateToken already handled those).
func SecurityHeaders ¶
SecurityHeaders adds comprehensive security headers to all HTTP responses
func ValidateAllowedOrigins ¶
ValidateAllowedOrigins validates and normalizes allowed CORS origins
Types ¶
This section is empty.
Source Files