Documentation
¶
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func BearerAuth ¶
BearerAuth returns middleware that validates Bearer token authentication. It checks the env-var token first (backwards compatible), then falls back to the KeyStore if provided. If both token and keyStore are empty/nil, the middleware is a no-op (passes through).
Types ¶
type APIKey ¶
type APIKey struct {
Name string `yaml:"name"`
Hash string `yaml:"hash"` // SHA-256 hex of the plaintext key
Projects []string `yaml:"projects"` // empty = all projects
CreatedAt string `yaml:"created_at"` // RFC3339
}
APIKey represents a stored API key with metadata.
type APIRegistrar ¶
APIRegistrar can register REST API routes on an http.ServeMux.
type Config ¶
type Config struct {
Addr string // listen address, e.g. ":8080"
AuthToken string //nolint:gosec // G117: config field, not a hardcoded secret
KeyStore *KeyStore // YAML-backed API key store (may be nil)
MCPHandler http.Handler // optional MCP protocol handler; nil keeps the 501 placeholder
APIHandler APIRegistrar // optional REST API handler; nil keeps the 501 placeholder
}
Config holds server configuration.
type KeyStore ¶
type KeyStore struct {
// contains filtered or unexported fields
}
KeyStore manages API keys stored in a YAML file.
func NewKeyStore ¶
NewKeyStore loads a KeyStore from the given YAML file path. If the file does not exist, it is created with an empty key list.
func (*KeyStore) Create ¶
Create generates a new API key, stores its hash, and returns the plaintext. The plaintext is only available at creation time.
func (*KeyStore) Validate ¶
Validate checks a plaintext token against all stored key hashes. Returns the matching APIKey and true if found, or nil and false otherwise. Uses constant-time comparison to prevent timing attacks.
func (*KeyStore) ValidateForProject ¶
ValidateForProject checks a plaintext token and verifies it has access to the given project. Unscoped keys (empty Projects) have access to all projects.
type Server ¶
type Server struct {
// contains filtered or unexported fields
}
Server is the main HTTP server.
func (*Server) Addr ¶
Addr returns the address the server is listening on. This is useful in tests when Addr is ":0" (random port). Safe for concurrent use.
Source Files