gateway

Overview ¶

Package gateway is live control of your API edge: CORS, rate limits, cache TTL and allowed methods, changed without a redeploy.

It is the runtime config plane for the cloud edge ("gateway role"), served at /v1/gateway. It serves GET/PUT over the SAME edge.Store the EdgeCORS/EdgeRateLimit middleware and ScopeRateLimit read live, so an operator retunes the CORS allowlist, the pre-auth per-IP flood cap, or a tenant's authenticated rate ceiling with NO redeploy — replacing the gateway's baked-into-an-image KrakenD config.

TWO IAM-gated scopes (mirrors apps/pricing/enablement.go: global state is SuperAdmin-only, self-service is scoped to the validated tenant):

• PLATFORM policy (CORS origins, per-IP cap + window) — pre-auth edge knobs with no tenant at evaluation time. Writable ONLY by a SuperAdmin (c.IsAdmin() ⟺ owner == admin org). A PUT carrying any platform field is routed to the platform row explicitly (PutPlatform), so it lands correctly even when the SuperAdmin is org-switched to another tenant.
• PER-ORG policy (OrgRPM, the authenticated ceiling; CacheTTLSec + CachePaths, the edge-cache TTL; Methods, the accepted-method allowlist) — a tenant's own row of self-service edge config. An org admin writes its own (org from principal.Org, never a raw header); a SuperAdmin may target any tenant with ?org=<slug>.

The store is owned by BuildDeps (deps.GatewayPolicy) and shared; this subsystem does not open or close it (serve.go closes it once at shutdown), so there is one store, one source of truth. Per-PROJECT rate scoping is NOT duplicated here — it remains ScopeRateLimit's commerce-configured domain (per (org,project,service)).