Documentation
¶
Overview ¶
Package main — allowlist.go Known-safe auth middleware names and exempt route patterns. Adding an entry to either list requires a PR with documented rationale.
endpoint-auth-checker — static analysis tool that enforces auth middleware on every HTTP route.
Usage:
endpoint-auth-checker --dirs plugins/,plugins-pro/paid/,web/backend/ --fail-on-unknown --annotation-format github
Exit codes:
0 — no violations (or --fail-on-unknown not set) 1 — one or more routes lack a recognized auth middleware 2 — scan error (missing or unreadable directory, or no .go file scanned)
Scope: the tool scans only the directories it is given and skips vendor/ and testdata/ below each root. Its CI workflow runs it on its own fixtures only; cli's own HTTP routes are not scanned there (see the workflow header).
Package main — middleware.go Classifies a route's middleware chain against the allowlist.
Package main — reporter.go Formats CheckResult violations for different output modes.
Package main — scanner.go AST walker that finds HTTP route registrations across chi/gin/echo/mux patterns.
Source Files