Documentation
¶
Overview ¶
Package server is Console's HTTP layer. It exposes a JSON API over the flag and status engines and a small server-rendered dashboard (htmx) on top of the same App. It owns no business logic: every handler is a thin adapter that decodes a request, calls an engine, and encodes the result.
Index ¶
Constants ¶
const RequestIDHeader = "X-Request-Id"
RequestIDHeader is the header used to accept and echo the request ID.
Variables ¶
This section is empty.
Functions ¶
func NewLogger ¶ added in v0.8.0
NewLogger builds the process logger writing to w in the given format ("json" for JSON lines, anything else text). Validate the format with config.Config.Validate first.
func PrincipalFrom ¶ added in v0.8.0
PrincipalFrom returns the authenticated Principal stored in ctx by the auth middleware. ok is false when auth is disabled or the route is exempt.
func RequestID ¶ added in v0.8.0
RequestID returns the request ID stored in ctx by the request-ID middleware, or "" if there is none. The auth audit log consumes it.
func WithRequestID ¶ added in v0.8.0
WithRequestID returns ctx carrying id as the request ID, as the request-ID middleware does. It lets out-of-tree Recorder adapters (contrib/otel) test request-ID propagation without standing up the HTTP stack.
Types ¶
type Server ¶
type Server struct {
// contains filtered or unexported fields
}
Server wires an App to an http.ServeMux and the dashboard templates. Construct it with New, register routes with Routes, and obtain the wrapped handler with Handler.
func New ¶
New builds a Server over a. It parses the embedded dashboard templates and registers all routes; the returned Server is ready to serve.
func (*Server) Handler ¶
Handler returns the mux wrapped with metrics (outermost), request-ID, logging, panic-recovery, security-headers and auth middleware. Request-ID sits inside metrics but outside logging/recovery so every log line and auth failure carries an ID; auth sits inside metrics so failures are counted. The auth middleware is a pass-through unless WithAuthenticator was given one.
func (*Server) ListenAndServe ¶
ListenAndServe serves the dashboard and API on addr until the process exits.
Console serves plain HTTP by design: it binds loopback by default and expects TLS to be terminated by a reverse proxy or ingress when exposed to a network (see SECURITY.md). It never terminates TLS itself, so the semgrep use-tls rule is suppressed here intentionally.
func (*Server) MetricsHandler ¶ added in v0.8.0
MetricsHandler returns a handler serving only GET /metrics, for the optional dedicated metrics listener (CONSOLE_METRICS_ADDR). It returns nil when metrics are disabled. It runs the same middleware chain as Handler (metrics, request ID, logging, recovery, security headers) and the same auth middleware against the shared routeScopes table, so with an authenticator configured GET /metrics requires the read scope (401/403 otherwise), exactly as on the main listener. Without one (auth disabled) it is unauthenticated.
func (*Server) Routes ¶
func (s *Server) Routes()
Routes registers every API and UI route on the mux. It is safe to call once during construction.
func (*Server) WithAuthenticator ¶ added in v0.8.0
func (s *Server) WithAuthenticator(a auth.Authenticator) *Server
WithAuthenticator enables authentication and scope enforcement using a and returns s. A nil a (the default) leaves the middleware an inert pass-through so behaviour is unchanged until configuration supplies an Authenticator. Call before Handler.
Source Files