Documentation
¶
Index ¶
- func BearerAuth(token string, keyStore *KeyStore) func(http.Handler) http.Handler
- type APIKey
- type APIRegistrar
- type Config
- type KeyStore
- func (ks *KeyStore) Create(name string, projects []string) (string, error)
- func (ks *KeyStore) CreateScoped(name string, projects []string, scope, workerID string) (plaintext string, err error)
- func (ks *KeyStore) List() []APIKey
- func (ks *KeyStore) Revoke(name string) error
- func (ks *KeyStore) Validate(token string) (*APIKey, bool)
- func (ks *KeyStore) ValidateForProject(token, project string) bool
- func (ks *KeyStore) ValidateWorker(token, workerID string) bool
- type PressureProvider
- type Server
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func BearerAuth ¶
BearerAuth returns middleware that validates Bearer token authentication. It checks the env-var token first (backwards compatible), then falls back to the KeyStore if provided. If both token and keyStore are empty/nil, the middleware is a no-op (passes through).
Types ¶
type APIKey ¶
type APIKey struct {
Name string `yaml:"name"`
Hash string `yaml:"hash"` // SHA-256 hex of the plaintext key
Projects []string `yaml:"projects"` // empty = all projects
Scope string `yaml:"scope,omitempty"` // "admin", "worker", or "" (default = admin)
WorkerID string `yaml:"worker_id,omitempty"` // required when scope=worker
CreatedAt string `yaml:"created_at"` // RFC3339
}
APIKey represents a stored API key with metadata.
type APIRegistrar ¶
APIRegistrar can register REST API routes on an http.ServeMux.
type Config ¶
type Config struct {
Addr string // listen address, e.g. ":8080"
AuthToken string //nolint:gosec // G117: config field, not a hardcoded secret
KeyStore *KeyStore // YAML-backed API key store (may be nil)
MCPHandler http.Handler // optional MCP protocol handler; nil keeps the 501 placeholder
APIHandler APIRegistrar // optional REST API handler; nil keeps the 501 placeholder
PressureProvider PressureProvider // optional; /healthz omits pressure field when nil
}
Config holds server configuration.
type KeyStore ¶
type KeyStore struct {
// contains filtered or unexported fields
}
KeyStore manages API keys stored in a YAML file.
func NewKeyStore ¶
NewKeyStore loads a KeyStore from the given YAML file path. If the file does not exist, it is created with an empty key list.
func (*KeyStore) Create ¶
Create generates a new API key, stores its hash, and returns the plaintext. The plaintext is only available at creation time.
func (*KeyStore) CreateScoped ¶ added in v0.1.13
func (ks *KeyStore) CreateScoped(name string, projects []string, scope, workerID string) (plaintext string, err error)
CreateScoped generates a new API key with scope and optional worker ID. Scope must be "admin", "worker", or "" (treated as admin). When scope is "worker", workerID is required.
func (*KeyStore) Validate ¶
Validate checks a plaintext token against all stored key hashes. Returns the matching APIKey and true if found, or nil and false otherwise. Uses constant-time comparison to prevent timing attacks.
func (*KeyStore) ValidateForProject ¶
ValidateForProject checks a plaintext token and verifies it has access to the given project. Unscoped keys (empty Projects) have access to all projects.
func (*KeyStore) ValidateWorker ¶ added in v0.1.13
ValidateWorker checks a token, verifies it is authorized for worker operations, and that the workerID matches the key's WorkerID field. Admin-scoped keys (scope="" or scope="admin") pass unconditionally.
type PressureProvider ¶ added in v0.1.11
type PressureProvider interface {
Pressure() string
}
PressureProvider returns the current resource pressure level string ("low", "moderate", "high", or "critical"). Used by /healthz.
type Server ¶
type Server struct {
// contains filtered or unexported fields
}
Server is the main HTTP server.
func (*Server) Addr ¶
Addr returns the address the server is listening on. This is useful in tests when Addr is ":0" (random port). Safe for concurrent use.
Source Files