Documentation
¶
Index ¶
- Constants
- func AllCapabilities() []string
- func AuthMiddleware(users *auth.UserStore, sessions *auth.BrowserSessions, cfg config.Config) echo.MiddlewareFunc
- func ConfigureClientIP(e *echo.Echo, rawCIDRs string) error
- func GetCurrentUser(c *echo.Context) *auth.User
- func HTTPErrorHandler(c *echo.Context, err error)
- func HasCapability(user auth.User, capability Capability) bool
- func RegisterAlertRoutes(e *echo.Echo, store *alert.Store, engine *alert.Engine)
- func RegisterAnnotationRoutes(e *echo.Echo, service AnnotationReader)
- func RegisterAuthMiddleware(e *echo.Echo, users *auth.UserStore, sessions *auth.BrowserSessions, ...)
- func RegisterAuthRoutes(e *echo.Echo, users *auth.UserStore, codes *auth.CodeStore, setup *auth.Setup, ...)
- func RegisterDashboardRoutes(e *echo.Echo, dashboards *dashboard.Service)
- func RegisterFanQLRoutes(e *echo.Echo, parser query.Parser, engine QueryEngine)
- func RegisterHealthRoutes(e *echo.Echo, duck *engine.Duck, cfg config.Config)
- func RegisterIntelligenceRoutes(e *echo.Echo, snapshots IntelligenceSnapshots)
- func RegisterOIDCRoutes(ctx context.Context, e *echo.Echo, cfg config.Config, users *appauth.UserStore, ...) error
- func RegisterQueryRoutes(e *echo.Echo, engine QueryEngine)
- func RegisterSettingsRoutes(e *echo.Echo, cfg config.Config, store *settings.Store, audit *auth.AuditStore)
- func RegisterTraceRoutes(e *echo.Echo, queries TraceQueries, retentionDays int)
- func RegisterUserRoutes(e *echo.Echo, users *auth.UserStore, smtp auth.SMTPConfig, cfg config.Config)
- func RequestOwner(c *echo.Context) (string, error)
- func RequireCapability(capability Capability) echo.MiddlewareFunc
- func RoleCapabilities() map[string][]string
- type AnnotationReader
- type AuthHandler
- func (h *AuthHandler) LoginLink(c *echo.Context) error
- func (h *AuthHandler) Logout(c *echo.Context) error
- func (h *AuthHandler) Me(c *echo.Context) error
- func (h *AuthHandler) Setup(c *echo.Context) error
- func (h *AuthHandler) Start(c *echo.Context) error
- func (h *AuthHandler) Status(c *echo.Context) error
- func (h *AuthHandler) Verify(c *echo.Context) error
- type Capability
- type CheckResult
- type DashboardHandler
- type FanQLHandler
- type HealthHandler
- type HealthResponse
- type IntelligenceSnapshots
- type MCPAuthorization
- func (h *MCPAuthorization) AuthorizationServerMetadata(c *echo.Context) error
- func (h *MCPAuthorization) Authorize(c *echo.Context) error
- func (h *MCPAuthorization) ListConnections(c *echo.Context) error
- func (h *MCPAuthorization) ProtectBrowserMCP(sessions *appauth.BrowserSessions, next http.Handler) echo.HandlerFunc
- func (h *MCPAuthorization) ProtectMCP(next http.Handler) http.Handler
- func (h *MCPAuthorization) ProtectedResourceMetadata(c *echo.Context) error
- func (h *MCPAuthorization) Register(e *echo.Echo)
- func (h *MCPAuthorization) RegisterClient(c *echo.Context) error
- func (h *MCPAuthorization) RevokeConnection(c *echo.Context) error
- func (h *MCPAuthorization) Token(c *echo.Context) error
- type OIDCHandler
- type QueryEngine
- type QueryHandler
- type RouteDoc
- type SettingsHandler
- type TraceHandler
- type TraceQueries
- type UserHandler
- func (h *UserHandler) CreateUser(c *echo.Context) error
- func (h *UserHandler) DeleteUser(c *echo.Context) error
- func (h *UserHandler) ListUsers(c *echo.Context) error
- func (h *UserHandler) RevokeAccess(c *echo.Context) error
- func (h *UserHandler) UpdateRole(c *echo.Context) error
- func (h *UserHandler) UpdateStatus(c *echo.Context) error
- func (h *UserHandler) UpdateUser(c *echo.Context) error
Constants ¶
const ( RoutePolicyPublic = "public" RoutePolicyAuthenticated = "authenticated" RoutePolicyCapability = "capability" RoutePolicyServiceCredential = "service-credential" RoutePolicyProtocol = "protocol" )
RoutePolicyPublic and friends name the policy kinds in the form the documentation uses. The internal constants are an unexported iota, which is right for a switch and useless in a table.
Variables ¶
This section is empty.
Functions ¶
func AllCapabilities ¶
func AllCapabilities() []string
AllCapabilities lists every capability the middleware knows, sorted. Derived from the role table rather than restated, so a capability that exists but is granted to nobody cannot appear here and a new one needs no edit.
func AuthMiddleware ¶
func AuthMiddleware(users *auth.UserStore, sessions *auth.BrowserSessions, cfg config.Config) echo.MiddlewareFunc
func ConfigureClientIP ¶
ConfigureClientIP trusts forwarded client addresses only from explicitly configured proxy networks. Direct clients cannot opt themselves into trust.
func HTTPErrorHandler ¶
HTTPErrorHandler is the product error boundary, including router failures. Protocol handlers and operational probes write their own responses.
func HasCapability ¶
func HasCapability(user auth.User, capability Capability) bool
func RegisterAlertRoutes ¶
RegisterAlertRoutes registers alert management REST endpoints.
func RegisterAnnotationRoutes ¶
func RegisterAnnotationRoutes(e *echo.Echo, service AnnotationReader)
func RegisterAuthMiddleware ¶
func RegisterAuthMiddleware(e *echo.Echo, users *auth.UserStore, sessions *auth.BrowserSessions, audit *auth.AuditStore, cfg config.Config)
func RegisterAuthRoutes ¶
func RegisterDashboardRoutes ¶
func RegisterFanQLRoutes ¶
func RegisterFanQLRoutes(e *echo.Echo, parser query.Parser, engine QueryEngine)
func RegisterHealthRoutes ¶
RegisterHealthRoutes registers health check endpoints
func RegisterIntelligenceRoutes ¶
func RegisterIntelligenceRoutes(e *echo.Echo, snapshots IntelligenceSnapshots)
RegisterIntelligenceRoutes exposes the detector's latest completed snapshot.
func RegisterOIDCRoutes ¶
func RegisterOIDCRoutes(ctx context.Context, e *echo.Echo, cfg config.Config, users *appauth.UserStore, identities *appauth.IdentityStore, sessions *appauth.BrowserSessions, audit *appauth.AuditStore) error
func RegisterQueryRoutes ¶
func RegisterQueryRoutes(e *echo.Echo, engine QueryEngine)
func RegisterSettingsRoutes ¶
func RegisterTraceRoutes ¶
func RegisterTraceRoutes(e *echo.Echo, queries TraceQueries, retentionDays int)
func RegisterUserRoutes ¶
func RegisterUserRoutes(e *echo.Echo, users *auth.UserStore, smtp auth.SMTPConfig, cfg config.Config)
RegisterUserRoutes registers user management endpoints.
func RequireCapability ¶
func RequireCapability(capability Capability) echo.MiddlewareFunc
func RoleCapabilities ¶
RoleCapabilities returns each role's capabilities, sorted, in the string form a table wants. The underlying map is a set of empty structs keyed by type, which is the right shape for a lookup and the wrong shape for a document.
Types ¶
type AnnotationReader ¶
type AnnotationReader interface {
Read(context.Context, annotations.Request) (annotations.Response, error)
}
type AuthHandler ¶
type AuthHandler struct {
// contains filtered or unexported fields
}
type Capability ¶
type Capability string
const ( ReadTelemetry Capability = "telemetry:read" ManageOwnDashboards Capability = "dashboards:manage-own" ManageAlerts Capability = "alerts:manage" RunAgent Capability = "agent:run" ReadIngestMetadata Capability = "ingest:read-metadata" ManageIngest Capability = "ingest:manage" ManageUsers Capability = "users:manage" ReadOperations Capability = "operations:read" )
type CheckResult ¶
type CheckResult struct {
Status string `json:"status"`
LatencyMs int64 `json:"latency_ms,omitempty"`
Error string `json:"error,omitempty"`
Detail string `json:"detail,omitempty"`
UpdatedAt string `json:"updated_at,omitempty"`
}
CheckResult represents a single health check result
type DashboardHandler ¶
type DashboardHandler struct {
// contains filtered or unexported fields
}
type FanQLHandler ¶
type FanQLHandler struct {
// contains filtered or unexported fields
}
type HealthHandler ¶
type HealthHandler struct {
// contains filtered or unexported fields
}
HealthHandler handles health check endpoints
func NewHealthHandler ¶
func NewHealthHandler(duck *engine.Duck, cfg config.Config) *HealthHandler
NewHealthHandler creates a new health handler
type HealthResponse ¶
type HealthResponse struct {
Status string `json:"status"`
Checks map[string]CheckResult `json:"checks"`
RuntimeSizing config.RuntimeSizing `json:"runtime_sizing"`
}
HealthResponse represents the full health check response
type IntelligenceSnapshots ¶
type IntelligenceSnapshots interface {
LatestSnapshot() *intelligence.Snapshot
}
IntelligenceSnapshots is the read side of the detector used by HTTP and other consumers. Keeping the interface narrow makes the endpoint independent of how snapshots are generated or retained.
type MCPAuthorization ¶
type MCPAuthorization struct {
// contains filtered or unexported fields
}
func NewMCPAuthorization ¶
func NewMCPAuthorization(store *appauth.OAuthStore, users *appauth.UserStore, resourceURL string) (*MCPAuthorization, error)
func (*MCPAuthorization) AuthorizationServerMetadata ¶
func (h *MCPAuthorization) AuthorizationServerMetadata(c *echo.Context) error
func (*MCPAuthorization) ListConnections ¶
func (h *MCPAuthorization) ListConnections(c *echo.Context) error
func (*MCPAuthorization) ProtectBrowserMCP ¶
func (h *MCPAuthorization) ProtectBrowserMCP(sessions *appauth.BrowserSessions, next http.Handler) echo.HandlerFunc
ProtectBrowserMCP adapts an already-authenticated browser session to the standard MCP transport identity consumed by the SDK. The public /mcp route remains OAuth bearer-only; this adapter is used only by the same-origin /api/mcp route after AuthMiddleware has validated the session and CSRF header.
func (*MCPAuthorization) ProtectMCP ¶
func (h *MCPAuthorization) ProtectMCP(next http.Handler) http.Handler
func (*MCPAuthorization) ProtectedResourceMetadata ¶
func (h *MCPAuthorization) ProtectedResourceMetadata(c *echo.Context) error
func (*MCPAuthorization) Register ¶
func (h *MCPAuthorization) Register(e *echo.Echo)
func (*MCPAuthorization) RegisterClient ¶
func (h *MCPAuthorization) RegisterClient(c *echo.Context) error
func (*MCPAuthorization) RevokeConnection ¶
func (h *MCPAuthorization) RevokeConnection(c *echo.Context) error
type OIDCHandler ¶
type OIDCHandler struct {
// contains filtered or unexported fields
}
type QueryEngine ¶
type QueryEngine interface {
Exemplars(context.Context, query.ExemplarRequest) (query.ExemplarResponse, error)
Run(context.Context, query.RunRequest) ([]query.Result, error)
ResolveVariables(context.Context, query.ResolveRequest) (map[string][]query.Option, error)
Schema(context.Context, query.SchemaRequest) (*query.Schema, error)
}
type QueryHandler ¶
type QueryHandler struct {
// contains filtered or unexported fields
}
type RouteDoc ¶
type RouteDoc struct {
Method string
Path string
// Policy is one of the RoutePolicy* constants above.
Policy string
// Capability is set only when Policy is RoutePolicyCapability or
// RoutePolicyServiceCredential; empty otherwise.
Capability string
}
RouteDoc is what a reader needs to know before calling a route: whether it needs a credential, and if so which capability that credential must carry.
func DescribeRoute ¶
DescribeRoute reports how the middleware would classify this method and path. The second return is false when the pair reaches no case — which for a registered route means the method is not permitted on it.
type SettingsHandler ¶
type SettingsHandler struct {
// contains filtered or unexported fields
}
func (*SettingsHandler) GetIngest ¶
func (h *SettingsHandler) GetIngest(c *echo.Context) error
GetIngest returns the current ingest config: whether a token is set (but not the token itself) and the endpoint collectors should use.
func (*SettingsHandler) RotateIngestToken ¶
func (h *SettingsHandler) RotateIngestToken(c *echo.Context) error
RotateIngestToken issues a new token, persists only its hash, and returns the plaintext exactly once in the response.
type TraceHandler ¶
type TraceHandler struct {
// contains filtered or unexported fields
}
type TraceQueries ¶
type TraceQueries interface {
Trace(context.Context, observability.Scope, string, string, int) (observability.Result[observability.TraceDetail], error)
}
type UserHandler ¶
type UserHandler struct {
// contains filtered or unexported fields
}
UserHandler handles admin user management endpoints.
func (*UserHandler) CreateUser ¶
func (h *UserHandler) CreateUser(c *echo.Context) error
CreateUser adds a new user (admin only).
func (*UserHandler) DeleteUser ¶
func (h *UserHandler) DeleteUser(c *echo.Context) error
DeleteUser removes a user (admin only).
func (*UserHandler) ListUsers ¶
func (h *UserHandler) ListUsers(c *echo.Context) error
ListUsers returns all users.
func (*UserHandler) RevokeAccess ¶
func (h *UserHandler) RevokeAccess(c *echo.Context) error
RevokeAccess invalidates existing browser sessions and OAuth tokens. The account remains active and can sign in again.
func (*UserHandler) UpdateRole ¶
func (h *UserHandler) UpdateRole(c *echo.Context) error
UpdateRole modifies a user's role (admin only).
func (*UserHandler) UpdateStatus ¶
func (h *UserHandler) UpdateStatus(c *echo.Context) error
UpdateStatus modifies a user's status (admin only).
func (*UserHandler) UpdateUser ¶
func (h *UserHandler) UpdateUser(c *echo.Context) error
UpdateUser modifies only a user's profile (admin only).
Source Files