product

Overview ¶

Package product exposes the read-only Search and Vector product surfaces the Hanzo console panels call at api.cloud.hanzo.ai, per HIP-0106.

The console's Search/Indexes and Vector panels call https://api.hanzo.ai/v1/search-docs/* and /v1/vector/* with a bearer key (HANZO_SEARCH_API_KEY / HANZO_VECTOR_API_KEY). cloud-api is the single edge that owns those paths: this subsystem proxies them to the in-cluster Meilisearch (search.hanzo.svc) and Qdrant (vector.hanzo.svc) services and translates each upstream response into the exact JSON shape the console's tRPC routers decode. No search/vector logic is reimplemented — this is a shape-translating proxy.

Auth: the gateway middleware (order 80) bypasses these paths via AUTH_PUBLIC_PATHS (the bearer is an opaque service key, not a JWT). This subsystem enforces the key itself with a constant-time compare against the configured upstream master key, so the endpoints are never open.

Module boundary: search lives in the Meilisearch service, vectors in Qdrant. This wrapper is glue; it holds no index/collection state.