proxy

Nov 5, 2026

Changes in this version

type Credential

+ InvalidateWithStatus func(int)

type RequestLogData

+ UpstreamAuthCode string

Oct 24, 2026

Changes in this version

+ const ExchangeBodyEventName

+ const ExchangeEventName

+ func RecordExchangeDrop(ctx context.Context)

type Proxy

+ func (p *Proxy) CloseExchangeLog(ctx context.Context)

+ func (p *Proxy) SetExchangeLog(logger *slog.Logger, hosts []string) error

Oct 22, 2026

Changes in this version

type Credential

+ AddHeaders map[string]string

Oct 22, 2026

Changes in this version

+ func ValidateCaptureRequestHeaders(headers []string) error

+ func ValidateCaptureResponseHeaders(headers []string) error

+ type Credential struct

+ AllowInsecure bool

+ Format string

+ Grant string

+ Header string

+ Host string

+ Invalidate func()

+ Match *RequestMatch

+ Name string

+ Postgres *PostgresCredentialConfig

+ Prefix string

+ RemoveHeaders []string

+ Resolver CredentialResolver

+ SetHeaders map[string]string

+ Source SourceConfig

+ UpgradeHint UpgradeHint

+ Value string

+ func (credential Credential) ValidateAgainst(earlier []Credential) error

+ func (credential Credential) ValidateRequestPolicy() error

+ type PostgresCredentialConfig struct

+ Project string

+ ProjectEnv string

+ Resolver string

type Proxy

+ func (p *Proxy) SetCaptureRequestHeaders(headers []string) error

+ func (p *Proxy) SetCaptureResponseHeaders(headers []string) error

+ func (p *Proxy) SetCredentialEntry(credential CredentialHeader) error

+ func (p *Proxy) SetCredentialResolverEntry(credential CredentialHeader, stripHeaders ...string) error

+ func (p *Proxy) UpdateCredentialEntry(credential CredentialHeader) error

type RequestLogData

+ CapturedResponseHeaders http.Header

type RequestMatch

+ func (m RequestMatch) Equal(o RequestMatch) bool

+ type SourceConfig struct

+ ADC bool

+ ActorTokenFrom string

+ ActorTokenType string

+ AppID string

+ BotSubject string

+ ClientID string

+ ClientSecret string

+ ClientSecretEnv string

+ Command string

+ Endpoint string

+ InstallationID string

+ PrivateKeyEnv string

+ PrivateKeyPath string

+ Project string

+ Region string

+ Resource string

+ Scopes string

+ Secret string

+ StaticFallback string

+ SubjectFrom string

+ SubjectHeader string

+ SubjectTokenType string

+ TTL string

+ TargetServiceAccount string

+ Type string

+ Value string

+ Var string

+ Version string

Oct 20, 2026

Changes in this version

type Proxy

+ func (p *Proxy) SetMatchedCredentialResolver(host string, m RequestMatch, resolver CredentialResolver, ...)

+ type RequestMatch struct

+ Header string

+ Methods []string

+ Paths []string

Oct 19, 2026

Changes in this version

+ type CredentialRequiredError struct

+ Grant string

+ Host string

+ Reason string

+ func (e *CredentialRequiredError) Error() string

type ResolverDeclined

+ ExplicitOnly bool

+ Grant string

+ Reason string

Oct 19, 2026

Changes in this version

+ const UpgradeHintHeader

type CredentialHeader

+ UpgradeHint UpgradeHint

+ type ResolverDeclined struct

+ Invalidate func()

+ UpgradeHint UpgradeHint

+ func (*ResolverDeclined) Error() string

+ type UpgradeHint map[string][]string

Oct 13, 2026

Changes in this version

+ func NewOTelHandler(next http.Handler, opts OTelOptions) (http.Handler, error)

+ func ProxyAuth(r *http.Request) (user, pass string, ok bool)

+ func ValidateHostPattern(s string) error

+ type Branding struct

+ ErrorPrefix string

+ GrantHint func(grant string) string

+ HostHint func(port int) string

+ MCPStubPrefix string

+ Name string

+ NetworkHint string

+ PolicyScheme string

type CA

+ func NewCAWithSubject(caDir, organization, commonName string) (*CA, error)

type CredentialHeader

+ AllowInsecure bool

+ Grant string

+ Invalidate func()

+ Name string

+ Value string

type ExtraHeader

+ Name string

+ Value string

type MCPAuthConfig

+ AllowInsecure bool

+ type OTelOptions struct

+ MeterProvider metric.MeterProvider

+ TracerProvider trace.TracerProvider

type Proxy

+ func (p *Proxy) CloseConnections(ctx context.Context) error

+ func (p *Proxy) SetBranding(b Branding)

+ func (p *Proxy) SetInsecureCredentialWithGrant(host, headerName, headerValue, grant string)

+ func (p *Proxy) SetInsecureTokenSubstitution(host, placeholder, realToken string)

type TokenSubstitution

+ AllowInsecure bool

Oct 5, 2026

Changes in this version

type Proxy

+ func (p *Proxy) CloseIdleConnections()

Sep 23, 2026

Changes in this version

type PolicyLogData

+ NonBlocking bool

Sep 17, 2026

Changes in this version

+ type CredentialBundle struct

+ Grant string

+ ID string

+ Replacements []HeaderReplacement

+ RequireAll bool

+ Scope CredentialScope

+ type CredentialScope struct

+ Methods []string

+ Origins []string

+ PathPrefixes []string

+ RequireTLS bool

+ type HeaderReplacement struct

+ Name string

+ Placeholder string

+ Value string

type RunContextData

+ CredentialBundles []CredentialBundle

Jul 15, 2026

Changes in this version

+ func SanitizeLogValue(s string) string

type RequestLogData

+ ApplicationName string

Jul 15, 2026

Changes in this version

+ type Demux struct

+ func NewDemux(ln net.Listener) *Demux

+ func (d *Demux) Close() error

+ func (d *Demux) HTTPListener() net.Listener

+ func (d *Demux) PostgresListener() net.Listener

+ func (d *Demux) StopAccepting() error

Jul 15, 2026

Changes in this version

+ func WrapProxyProtocolListener(ln net.Listener) net.Listener

type PostgresServer

+ func (s *PostgresServer) StartListener(ln net.Listener) error

Jul 14, 2026

Changes in this version

type RequestLogData

+ ClientAddr string

Jul 14, 2026

Changes in this version

type Proxy

+ func (p *Proxy) SetCredentialResolverWithStripHeaders(host string, resolver CredentialResolver, stripHeaders ...string)

Jun 12, 2026

Changes in this version

+ type PostgresCredentialResolver interface

+ InvalidatePassword func(host, user, database string)

+ ResolvePassword func(ctx context.Context, host, user, database string) (string, error)

+ type PostgresResolverEntry struct

+ Pattern string

+ Resolver PostgresCredentialResolver

+ type PostgresServer struct

+ func NewPostgresServer(p *Proxy) *PostgresServer

+ func (s *PostgresServer) Addr() string

+ func (s *PostgresServer) Shutdown(ctx context.Context) error

+ func (s *PostgresServer) Start(addr string) error

+ func (s *PostgresServer) Stop()

type Proxy

+ func (p *Proxy) SetPostgresResolver(pattern string, r PostgresCredentialResolver)

type RequestLogData

+ RequestMessages int64

+ ResponseMessages int64

type RunContextData

+ PostgresResolvers []PostgresResolverEntry

+ type StaticPostgresResolver struct

+ func NewStaticPostgresResolver(password string) *StaticPostgresResolver

+ func (s *StaticPostgresResolver) InvalidatePassword(host, user, database string)

+ func (s *StaticPostgresResolver) ResolvePassword(ctx context.Context, host, user, database string) (string, error)

May 11, 2026

Changes in this version

+ func UserIDFromContext(ctx context.Context) string

+ func ValidateCaptureHeaders(headers []string) error

type Proxy

+ func (p *Proxy) SetCaptureHeaders(headers []string) error

type RequestLogData

+ UserID string

Apr 22, 2026

Changes in this version

+ func RequestIDFromContext(ctx context.Context) string

type RequestLogData

+ Denied bool

+ DenyReason string

+ Grants []string

+ Host string

+ Path string

+ RequestID string

+ RequestSize int64

+ RequestType string

+ ResponseSize int64

Apr 21, 2026

Changes in this version

type Proxy

+ func (p *Proxy) SetDelegateAuth(delegate bool)

Apr 21, 2026

Changes in this version

+ type CredentialResolver func(ctx context.Context, proxyReq, innerReq *http.Request, host string) ([]credentialHeader, error)

type Proxy

+ func (p *Proxy) SetCredentialResolver(host string, resolver CredentialResolver)

Apr 21, 2026

Changes in this version

+ const MaxBodySize

+ func FilterHeaders(headers http.Header, injectedHeaders map[string]bool) map[string]string

+ func GetHostsForGrant(grant string) []string

+ func MatchesHostPattern(pattern HostPattern, host string, port int) bool

+ func OTelHandler(next http.Handler) http.Handler

+ func RecordCredentialInjection(ctx context.Context, host, headerName string)

+ func RecordPolicyDenial(ctx context.Context, scope, rule string)

+ func RegisterGrantHosts(grant string, hosts []string)

+ type CA struct

+ func LoadCA(certPEM, keyPEM []byte) (*CA, error)

+ func NewCA(caDir string) (*CA, error)

+ func (ca *CA) CertPEM() []byte

+ func (ca *CA) GenerateCert(host string) (*tls.Certificate, error)

+ type ContextResolver func(token string) (*RunContextData, bool)

+ type CredentialHeader = credentialHeader

+ type CredentialStore interface

+ GetToken func(provider string) (string, error)

+ type ExtraHeader = extraHeader

+ type HostPattern = hostPattern

+ func ParseHostPattern(pattern string) HostPattern

+ type MCPAuthConfig struct

+ Grant string

+ Header string

+ type MCPServerConfig struct

+ Auth *MCPAuthConfig

+ Name string

+ URL string

+ type PathRulesChecker func(host string, port int) bool

+ type PolicyLogData struct

+ Ctx context.Context

+ Message string

+ Operation string

+ Rule string

+ RunID string

+ Scope string

+ type PolicyLogger func(data PolicyLogData)

+ type Proxy struct

+ func NewProxy() *Proxy

+ func (p *Proxy) AddExtraHeader(host, headerName, headerValue string)

+ func (p *Proxy) AddRelay(name, targetURL string) error

+ func (p *Proxy) AddResponseTransformer(host string, transformer ResponseTransformer)

+ func (p *Proxy) RemoveRequestHeader(host, headerName string)

+ func (p *Proxy) ResolveContext(token string) (*RunContextData, bool)

+ func (p *Proxy) ServeHTTP(w http.ResponseWriter, r *http.Request)

+ func (p *Proxy) SetAWSHandler(h http.Handler)

+ func (p *Proxy) SetAuthToken(token string)

+ func (p *Proxy) SetCA(ca *CA)

+ func (p *Proxy) SetContextResolver(resolver ContextResolver)

+ func (p *Proxy) SetCredential(host, authHeader string)

+ func (p *Proxy) SetCredentialHeader(host, headerName, headerValue string)

+ func (p *Proxy) SetCredentialStore(store CredentialStore)

+ func (p *Proxy) SetCredentialWithGrant(host, headerName, headerValue, grant string)

+ func (p *Proxy) SetLogger(logger RequestLogger)

+ func (p *Proxy) SetMCPServers(servers []MCPServerConfig)

+ func (p *Proxy) SetNetworkPolicy(policy string, allows []string, grants []string)

+ func (p *Proxy) SetNetworkPolicyWithRules(policy string, allows []string, grants []string, checker RequestChecker, ...)

+ func (p *Proxy) SetPolicyLogger(logger PolicyLogger)

+ func (p *Proxy) SetTokenSubstitution(host, placeholder, realToken string)

+ func (p *Proxy) SetUpstreamCAs(pool *x509.CertPool)

+ type RequestChecker func(host string, port int, method, path string) bool

+ type RequestLogData struct

+ AuthInjected bool

+ Ctx context.Context

+ Duration time.Duration

+ Err error

+ InjectedHeaders map[string]bool

+ Method string

+ RequestBody []byte

+ RequestHeaders http.Header

+ ResponseBody []byte

+ ResponseHeaders http.Header

+ RunID string

+ StatusCode int

+ URL string

+ type RequestLogger func(data RequestLogData)

+ type ResponseTransformer func(req, resp any) (any, bool)

+ type RunContextData struct

+ AWSHandler http.Handler

+ AllowedHostPorts []int

+ AllowedHosts []hostPattern

+ CredStore CredentialStore

+ Credentials map[string][]credentialHeader

+ ExtraHeaders map[string][]extraHeader

+ HostGateway string

+ HostGatewayIP string

+ KeepEngines map[string]*keeplib.Engine

+ MCPServers []MCPServerConfig

+ PathRulesCheck PathRulesChecker

+ Policy string

+ RemoveHeaders map[string][]string

+ RequestCheck RequestChecker

+ ResponseTransformers map[string][]ResponseTransformer

+ RunID string

+ TokenSubstitutions map[string]*tokenSubstitution

+ type Server struct

+ func NewServer(proxy *Proxy) *Server

+ func (s *Server) Addr() string

+ func (s *Server) Port() string

+ func (s *Server) Proxy() *Proxy

+ func (s *Server) SetBindAddr(addr string)

+ func (s *Server) SetPort(port int)

+ func (s *Server) Start() error

+ func (s *Server) Stop(ctx context.Context) error

+ type TokenSubstitution = tokenSubstitution

+ func NewTokenSubstitution(placeholder, realToken string) *TokenSubstitution