Documentation
¶
Index ¶
- func EmbeddedAssets() fs.FS
- func NormalizeBasePath(p string) string
- type Config
- type Server
- func (s *Server) HandleCallback(w http.ResponseWriter, r *http.Request)
- func (s *Server) HandleInfo(w http.ResponseWriter, r *http.Request)
- func (s *Server) HandleLogin(w http.ResponseWriter, r *http.Request)
- func (s *Server) HandleLogout(w http.ResponseWriter, r *http.Request)
- func (s *Server) HandleSession(w http.ResponseWriter, r *http.Request)
- func (s *Server) HandleTokenLogin(w http.ResponseWriter, r *http.Request)
- func (s *Server) Handler() http.Handler
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func EmbeddedAssets ¶
EmbeddedAssets returns the compiled-in console frontend, rooted at the asset directory so it can be used directly as Config.StaticFS.
func NormalizeBasePath ¶
NormalizeBasePath makes a base-path flag value safe to concatenate: no trailing slash (else cookie paths become /console//) and a guaranteed leading slash.
Types ¶
type Config ¶
type Config struct {
ControlPlaneURL string
AdminToken string
// StaticDir serves frontend assets from disk (live-editable, used by the
// ui-dev workflow). It takes precedence over StaticFS.
StaticDir string
// StaticFS serves frontend assets from an fs.FS, e.g. EmbeddedAssets().
StaticFS fs.FS
BasePath string
// ExternalURL is the origin browsers reach this console on, e.g.
// "https://console.example". When set it decides the OIDC redirect_uri and
// whether session cookies are marked Secure, instead of the Host and
// X-Forwarded-Proto headers, which a client controls and a proxy may drop.
ExternalURL string
}
type Server ¶
type Server struct {
// contains filtered or unexported fields
}
func (*Server) HandleCallback ¶
func (s *Server) HandleCallback(w http.ResponseWriter, r *http.Request)
func (*Server) HandleInfo ¶
func (s *Server) HandleInfo(w http.ResponseWriter, r *http.Request)
func (*Server) HandleLogin ¶
func (s *Server) HandleLogin(w http.ResponseWriter, r *http.Request)
func (*Server) HandleLogout ¶
func (s *Server) HandleLogout(w http.ResponseWriter, r *http.Request)
func (*Server) HandleSession ¶
func (s *Server) HandleSession(w http.ResponseWriter, r *http.Request)
HandleSession reports whether a session cookie is present. It deliberately does not return the cookie's value: the credential is stored HttpOnly so an XSS in the console cannot exfiltrate mesh admin rights, and handing the raw token back to any same-origin fetch would undo exactly that. The SPA never needs it, since the reverse proxy injects the cookie as Authorization for /api/ calls.
func (*Server) HandleTokenLogin ¶
func (s *Server) HandleTokenLogin(w http.ResponseWriter, r *http.Request)
HandleTokenLogin exchanges a token the operator pasted into the console for an httpOnly session cookie, so the credential is never reachable from JavaScript and an XSS in the console cannot exfiltrate mesh admin rights.
Source Files