Documentation
¶
Overview ¶
Package server puts the relay on the network: the data plane as a WebSocket at /v1/data, the control API as Connect handlers (gRPC, gRPC-Web and the Connect protocol on one handler), and /v1/info.
Two handlers, never one: Public is what students reach (the LAN, or the internet); it never grants the admin role, whatever credential arrives. Admin is mounted on the Unix socket and loopback, or on a separate --admin-listen, and requires the admin token or the OpenID Connect teacher role.
Index ¶
Constants ¶
const FlowMapBuilt = false
FlowMapBuilt reports whether this binary carries the flow-map page.
Variables ¶
var Version = "devel"
Version is the relay's release, reported by /v1/info.
Functions ¶
func NormalizeOrigin ¶ added in v0.3.0
NormalizeOrigin checks an allowlist entry: scheme://host[:port], http or https, nothing else (no path, no wildcard).
func TokenFromSubprotocols ¶
TokenFromSubprotocols finds the session token a client offered as a "bearer.<token>" subprotocol.
Types ¶
type Config ¶
type Config struct {
Relay *relay.Relay
// AdminToken is the teacher's admin credential (Admin handler only).
AdminToken string
// OIDC, when set, verifies OpenID Connect tokens: on Join and
// RefreshSession (the identity), and on the Admin handler with the
// TeacherGroup.
OIDC *oidc.Verifier
TeacherGroup string
// AllowedOrigins are the browser origins (scheme://host[:port], e.g.
// "https://go-wasmcontainers.github.io") allowed besides the relay's own:
// CORS on the public RPCs a page needs (Join, RefreshSession, the flow
// views) and the Origin check of the data WebSocket. Never "*"; empty
// means same-origin only.
AllowedOrigins []string
// AllowedHosts, when set, are the only Host headers served (DNS
// rebinding); ports are ignored.
AllowedHosts []string
// PreAuthPerMinute bounds Join calls and WebSocket upgrades per source
// address (default 30); MaxHandshakes bounds concurrent upgrades still
// waiting for their HELLO (default 32).
PreAuthPerMinute int
MaxHandshakes int
// TLSMode is reported by /v1/info ("acme", "files", "internal", "off").
TLSMode string
Logf func(format string, args ...any)
}
Config configures the HTTP side of a relay.
type Principal ¶
type Principal struct {
Admin bool
Session *auth.Claims // a student's (or the teacher's) session token
Identity *relay.Identity // an OpenID Connect identity
MapClass string // a flow-map ticket's class: WatchFlowMap on it, nothing else
}
Principal is who is calling, as the handler established it.
type Server ¶
type Server struct {
// contains filtered or unexported fields
}
Server serves one relay.
func (*Server) Admin ¶
Admin is the handler for the teacher: Unix socket, loopback, or a separate admin listener.
func (*Server) AdminTrusted ¶
AdminTrusted is Admin for a listener whose callers are trusted by construction (a Unix socket only its owner can open): no token needed.
Source Files