Documentation
¶
Overview ¶
Package api exposes an HTTP JSON API for the todo app.
Index ¶
- type Handler
- func (h *Handler) AuthorizePage(w http.ResponseWriter, r *http.Request) bool
- func (h *Handler) Callback(w http.ResponseWriter, r *http.Request)
- func (h *Handler) Close()
- func (h *Handler) MintSession(w http.ResponseWriter, r *http.Request)
- func (h *Handler) OIDCEnabled() bool
- func (h *Handler) Routes() http.Handler
- func (h *Handler) WithDefaultDue(s string) *Handler
- func (h *Handler) WithOIDC(o *OIDC) *Handler
- type OIDC
- type OIDCConfig
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Handler ¶
type Handler struct {
// contains filtered or unexported fields
}
Handler wires the todo HTTP routes. It holds no per-request state beyond the event bus shared by SSE clients.
func New ¶
New returns a configured Handler. apiKey is optional: when empty the API is open; when set, requests must present the key (header) or a browser session cookie (see session.go).
func (*Handler) AuthorizePage ¶ added in v0.5.0
AuthorizePage guards a page load (the SPA document or the docs page). It reports whether the page should be served; when it returns false it has already written the response. With OIDC, a request without a valid session is redirected to the provider to log in. Otherwise it mints a session (when an API key is configured) and lets the page through.
func (*Handler) Callback ¶ added in v0.5.0
func (h *Handler) Callback(w http.ResponseWriter, r *http.Request)
Callback completes a browser login: it checks the state against the flow cookie, exchanges the code (with the PKCE verifier), verifies the ID token and its nonce, mints a session and sends the browser back to the page it started from. Failures end in an error response rather than another redirect, so a misconfiguration can't loop.
func (*Handler) Close ¶ added in v0.3.1
func (h *Handler) Close()
Close tears down the handler's shared infrastructure: it ends every open SSE stream so a graceful server shutdown settles immediately instead of idling out its deadline on long-lived event connections. Call once, when the server is shutting down.
func (*Handler) MintSession ¶ added in v0.3.0
func (h *Handler) MintSession(w http.ResponseWriter, r *http.Request)
MintSession sets a fresh session cookie when an API key or OIDC is configured; a no-op otherwise. main wires it into the SPA handler so loading the UI document bootstraps a session, and requireAuth calls it again on every session-authenticated request for the sliding refresh. The cookie is marked Secure when the request arrived over TLS or through a reverse proxy that advertises HTTPS, so plain-HTTP LAN deployments keep working while TLS ones get the hardened flag.
func (*Handler) OIDCEnabled ¶ added in v0.5.0
OIDCEnabled reports whether OpenID Connect authentication is configured.
func (*Handler) Routes ¶
Routes returns the API routes registered under /api, wrapped in the optional API-key guard. Uses Go 1.22+ method+path patterns so path parameters are available via r.PathValue.
func (*Handler) WithDefaultDue ¶ added in v0.3.4
WithDefaultDue sets a default due/repeating schedule for new todos. The string is parsed at creation time (not here) so relative forms like "tomorrow" or "every monday" resolve against each todo's creation date. Callers should validate the value with schedule.Parse before wiring it up; this method keeps the existing two-argument New signature intact.
func (*Handler) WithOIDC ¶ added in v0.5.0
WithOIDC turns on OpenID Connect authentication. Browser sessions are then only minted by a completed login, never by simply loading the page, and the session cookie covers the whole site so page loads can check it. An API key configured alongside keeps working for API clients.
type OIDC ¶ added in v0.5.0
type OIDC struct {
// contains filtered or unexported fields
}
OIDC verifies browser logins and bearer access tokens against one provider. Create it with NewOIDC and attach it with Handler.WithOIDC.
type OIDCConfig ¶ added in v0.5.0
type OIDCConfig struct {
// Issuer is the provider's issuer URL, used for discovery.
Issuer string
// ClientID and ClientSecret identify this instance to the provider for
// the browser login flow.
ClientID string
ClientSecret string
// SessionKey signs browser session cookies and login state. Keeping it
// stable keeps sessions valid across restarts; changing it ends them.
SessionKey string
// Audience is the value access tokens must carry in their aud claim.
Audience string
}
OIDCConfig holds the settings for OpenID Connect authentication.
Source Files