admission

type Approvals ¶

type Approvals struct {
	// contains filtered or unexported fields
}

Approvals resolves whether the current caller is off the waitlist. It is the ONE approval predicate the native middleware uses, DRY with the @file waitlist-guard (both read approvalStatus == "pending"). Resolution order:

1. global admin (c.IsAdmin()) → approved (admins are never gated)
2. validated header X-User-Approved → its bit (forward-perfect, no lookup)
3. the iam peer (plane.IAMApproval) → approved unless approvalStatus=="pending" — cached per user for ttl; FAIL-OPEN on any error.

func NewApprovals(ttl time.Duration) *Approvals

func (a *Approvals) Approved(c *zip.Ctx) bool

type EnforceConfig ¶

type EnforceConfig struct {
	// WaitlistURL is where an unapproved / unauthenticated browser is bounced
	// (per-brand, e.g. https://waitlist.hanzo.ai). Empty → API-style 403/401 for
	// everyone (no redirect target), so enforcement still holds.
	WaitlistURL string

	// Approvals resolves whether the caller is off the waitlist. When nil, Enforce
	// builds one over the iam peer — which takes no address, so there is nothing
	// else for a deployment to supply.
	Approvals *Approvals

	// ExemptPrefixes are request-path prefixes never gated (health/metrics/auth).
	// A sensible default set is used when empty.
	ExemptPrefixes []string

	// Gate is THE decide: it resolves whether a request host is in waitlist mode,
	// via the ONE policy engine. When nil it is WaitlistModeForHost —
	// host→service→waitlist.<svc>. Injected only in tests. Fail-open by contract:
	// known=false (unmounted / registry error / un-governed host) → not gated.
	Gate func(ctx context.Context, host string) (mode bool, service string, known bool)
}

Enforce is the NATIVE, forward-perfect enforcement point for the waitlist — the single in-binary middleware that reads the registry (in-process, no HTTP hop) and the caller's approval, and applies THE RULE for every request whose Host is a governed service. As product hosts fold into the one-binary cloud, this is the ONE enforcement point (the @file waitlist-guard is the interim gate for hosts not yet cloud-fronted; both read the SAME registry so a toggle governs both).

THE RULE (per request, on a governed host in waitlist mode):

carries a Hanzo API key (pk-/sk-)     → allow (paid inference; possession-gated)
exempt path (health/iam/waitlist)     → allow
unauthenticated                       → 302 waitlist (browser) / 401 (API)
waitlist mode OFF (or host un-governed) → allow (c.Next)
waitlist mode ON  AND approved         → allow (c.Next)
waitlist mode ON  AND NOT approved     → 302 waitlist (browser) / 403 (API)

INTEGRATION POINT — wire in serve.go RIGHT AFTER SanitizeIdentity:

app.Use(IdentityMiddleware(cfg))          // establishes the validated principal
app.Use(admission.Enforce(admission.EnforceConfig{ WaitlistURL: … }))  // ← here

It reads the sanitized X-User-Id / X-User-IsAdmin / X-User-Approved that IdentityMiddleware minted, so it MUST run after it and (like BillingGate) before the subsystem handlers. It is deliberately NOT wired here — the unified-binary agent owns serve.go's boot chain; this package exposes Enforce so the one-line app.Use lands without a merge collision. The decide (WaitlistModeForHost) is resolved PER REQUEST and fail-opens until the flags engine has mounted, so Enforce can be constructed before Mount runs.

WHY NATIVE IS CANONICAL (in-cluster-bypass). The @file edge guard only gates traffic arriving THROUGH the ingress — a pod reaching another service's pod directly in-cluster bypasses it (a cluster-wide baseline NetworkPolicy + Cilium broad-allow union means additive netpols can't seal that). For a waitlist (threat model = external users) edge-only is acceptable, but this native middleware is FORWARD-PERFECT: when the app IS cloud, the gate is IN the request path, so reaching the pod directly STILL hits it — there is no edge to go around. That is the reason the native middleware is the canonical enforcement and the @file guard is purely interim. It is also STATELESS (it reads the sanitized X-User-* headers, sets no cookie), so the multi-apex cookie-domain concern the @file guard must handle does not exist here at all.

Paths that must NEVER be gated (health, the waitlist page's own API, auth callbacks) are skipped via ExemptPrefixes so enforcement can't lock the platform out of its own recovery/observability surface.

type SeedService ¶

type SeedService struct {
	Service     string
	DisplayName string
	Description string
	Hosts       []string
}

SeedService is one row of the launch registry (a hosted service + its hosts). Mode is intentionally absent — the launch posture (gated) is waitlistDef's Default "true".

type ServiceInput ¶

type ServiceInput struct {
	Service      string   `json:"service"`
	DisplayName  string   `json:"displayName"`
	Description  string   `json:"description"`
	Hosts        []string `json:"hosts"`
	WaitlistMode bool     `json:"waitlistMode"`
}

ServiceInput is the admin onboard/edit payload for /v1/admin/services. WaitlistMode sets the launch switch for a NEW service; a re-register PRESERVES the live switch.

type ServiceRow ¶

type ServiceRow struct {
	Service     string   `json:"service"`
	DisplayName string   `json:"displayName"`
	Description string   `json:"description"`
	Hosts       []string `json:"hosts"`
	CreatedAt   int64    `json:"createdAt"`
	UpdatedAt   int64    `json:"updatedAt"`
	UpdatedBy   string   `json:"updatedBy"`
}

ServiceRow is one hosted service in the registry (host→service + metadata). The waitlist MODE is intentionally absent — it is the platform switch waitlist.<svc>, read through the engine; ListWaitlistServices composes the two into a ServiceView.

type ServiceView ¶

type ServiceView struct {
	ServiceRow
	WaitlistMode bool `json:"waitlistMode"`
}

ServiceView is one service as the admin board renders it: the registry row plus its LIVE waitlist mode (the waitlist.<svc> switch evaluated through the engine).

func ListWaitlistServices(ctx context.Context) ([]ServiceView, error)

func SetWaitlistMode(ctx context.Context, service string, mode bool, actor string) (ServiceView, error)

func UpsertWaitlistService(ctx context.Context, in ServiceInput, actor string) (ServiceView, error)