Documentation
¶
Overview ¶
Package proxy is the pure, dependency-free reverse-proxy mechanism behind the /v1/auto subsystem. It is split from the cloud-registration wrapper (clients/auto) so the tenant-boundary behavior — the validated-principal gate and the outbound identity re-stamping the header-trusting auto engine depends on — is unit-testable WITHOUT linking the cloud root package (which transitively pulls conflicting SQLite drivers into a test binary). Separation of concerns: this file is the security mechanism; clients/auto only wires it into cloud.Registry.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var EngineTrustHeaders = []string{"X-Org-Id", "X-User-Id", "X-User-Email"}
EngineTrustHeaders are the identity headers the auto engine reads. The proxy re-derives them from the gate-validated inbound request so the engine sees only server-authoritative values.
var StrippedHeaders = []string{
"X-Roles", "X-User-Permissions", "X-Phone-Number", "X-User-IsAdmin",
"X-User-Role", "X-User-Roles", "X-User-Name", "X-Tenant-Id", "X-Tenant-ID", "X-Org",
}
StrippedHeaders are identity aliases an attacker might smuggle that we delete on the outbound request (a superset beyond what the engine needs) so nothing identity-ish that cloud's SanitizeIdentity didn't set can reach the header-trusting engine.
Functions ¶
func Gate ¶
Gate refuses any request with no validated principal (empty X-User-Id, the signal cloud's SanitizeIdentity sets only from a verified credential) before it reaches the header-trusting engine. This closes the anonymous-forge path (a client-restored X-Org-Id with no credential) that would otherwise drive a victim org's workflows.
func NewHandler ¶
NewHandler builds the reverse-proxy handler targeting the auto engine at rawURL. Pure (URL in, handler out). The path is forwarded UNCHANGED: /v1/auto/* maps to /v1/auto/* on the engine. The Director re-stamps the outbound identity headers from the (gate-validated) inbound values, deleting every identity alias first, so the engine — which trusts X-Org-Id absolutely — only ever receives the validated tenant.
Types ¶
This section is empty.
Source Files