gateway

Overview ¶

Package gateway is live control of the policy your API applies to every incoming request: CORS, rate limits, cache TTL and allowed methods, changed without a redeploy.

THE GATEWAY IS PLUMBING, AND THIS IS ITS ONE PRODUCT DOOR. The gateway is the trust boundary — validate the IAM JWT, strip client-supplied identity, re-mint X-Org-Id — and it is not a network hop: it is compiled INTO the cloud binary as gateway.Mount, and hanzoai/gateway's own routes.go states the law ("ONE routing source of truth = cloud's mount table, not a second map here"). Plumbing earns no prefix. What earns this one is the thing a customer actually calls: the runtime config plane for that policy, at /v1/gateway/config, and nothing else. It serves GET/PUT over the SAME edge.Store the EdgeCORS/EdgeRateLimit middleware and ScopeRateLimit read live, so an operator retunes the CORS allowlist, the pre-auth per-IP flood cap, or a tenant's authenticated rate ceiling with NO redeploy, replacing config that used to be baked into an image.

TWO IAM-gated scopes (mirrors apps/pricing/enablement.go: global state is SuperAdmin-only, self-service is scoped to the validated tenant):

• PLATFORM policy (CORS origins, per-IP cap + window) — pre-auth edge knobs with no tenant at evaluation time. Writable ONLY by a SuperAdmin (c.IsAdmin() ⟺ owner == admin org). A PUT carrying any platform field is routed to the platform row explicitly (PutPlatform), so it lands correctly even when the SuperAdmin is org-switched to another tenant.
• PER-ORG policy (OrgRPM, the authenticated ceiling; CacheTTLSec + CachePaths, the edge-cache TTL; Methods, the accepted-method allowlist) — a tenant's own row of self-service edge config. An org admin writes its own (org from principal.Org, never a raw header); a SuperAdmin may target any tenant with ?org=<slug>.

The store is owned by BuildDeps (deps.GatewayPolicy) and shared; this subsystem does not open or close it (serve.go closes it once at shutdown), so there is one store, one source of truth. Per-PROJECT rate scoping is NOT duplicated here — it remains ScopeRateLimit's commerce-configured domain (per (org,project,service)).