Documentation
¶
Overview ¶
Package routers @APIVersion 1.503.0 @Title IAM RESTful API @Description Swagger Docs of IAM Backend API @Contact support@hanzo.ai @SecurityDefinition AccessToken apiKey Authorization header @Schemes https,http @ExternalDocs Find out more about IAM @ExternalDocsUrl https://github.com/hanzoai/iam
Index ¶
- func AfterRecordMessage(ctx *context.Context)
- func ApiFilter(ctx *context.Context)
- func AutoSigninFilter(ctx *context.Context)
- func CorsFilter(ctx *context.Context)
- func FieldValidationFilter(ctx *context.Context)
- func InitAPI()
- func PrometheusFilter(ctx *context.Context)
- func RecordMessage(ctx *context.Context)
- func SecureCookieFilter(ctx *context.Context)
- func StaticFilter(ctx *context.Context)
- func T(ctx *context.Context, error string) string
- func TimeoutFilter(ctx *context.Context)
- func V1IAMRewriteFilter(ctx *context.Context)
- type Object
- type ObjectWithOrg
- type OrganizationThemeCookie
- type Response
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func AfterRecordMessage ¶
func AutoSigninFilter ¶
func CorsFilter ¶
func FieldValidationFilter ¶
func PrometheusFilter ¶
func RecordMessage ¶
func SecureCookieFilter ¶
SecureCookieFilter is a BeforeRouter filter that ensures session cookies are emitted with the Secure flag when the app runs behind a TLS-terminating proxy (e.g. Kubernetes ingress, Cloudflare, AWS ALB).
Beego v2's session manager determines the Secure flag via isSecure(req), which checks (1) ManagerConfig.Secure is true AND (2) req.URL.Scheme == "https" or req.TLS != nil. Behind a reverse proxy both conditions fail because EnableHTTPS is false and the Go process never sees TLS.
This filter solves it in two steps:
On the first request it calls GlobalSessions.SetSecure(true) so the session manager's config.Secure flag is enabled (one-time init).
On every request where X-Forwarded-Proto is "https", it sets req.URL.Scheme = "https" so isSecure(req) returns true and Beego natively adds "; Secure" to the session cookie.
func StaticFilter ¶
func TimeoutFilter ¶
func V1IAMRewriteFilter ¶
V1IAMRewriteFilter rewrites /v1/iam/* requests to the underlying Casdoor route so the canonical /<version>/<service>/<path> pattern works without duplicating every route in router.go.
Most API endpoints live under /api/*. A few intentionally live at root because standards expect them unprefixed. The filter maps:
/v1/iam/login/oauth/* → /login/oauth/* (OAuth2 standard path) /v1/iam/oauth/* → /oauth/* (OAuth2 + OIDC aliases) /v1/iam/.well-known/* → /.well-known/* (OIDC discovery + JWKS) /v1/iam/X → /api/X (everything else)
Source Files