Documentation
¶
Overview ¶
Package middleware contains the Chi middleware stack applied to every incoming HTTP request: CORS, Auth (JWT extraction), Rate Limit, and Permission (perm.Engine.CheckAction).
See PRD §12.2 and TAD §3.2 for the ordering specification. Implemented in Phase 6.
Index ¶
- func Auth(provider auth.Provider) func(http.Handler) http.Handler
- func CORS(allowedOrigins []string) func(http.Handler) http.Handler
- func Permission(permEngine perm.Engine) func(http.Handler) http.Handler
- func RateLimit(limit int, window time.Duration, store cache.Store) func(http.Handler) http.Handler
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func Auth ¶
Auth middleware extracts authentication credentials from the Authorization header and injects auth.Identity into context.Context via auth.NewContext. The ?access_token= query parameter is accepted as a fallback so browsers can authenticate the agent WebSocket (TAD §6.2) without a custom header; it is never returned in URLs by the UI.
func Permission ¶
Permission checks document-level CRUD permissions for REST endpoints using perm.Engine.
Types ¶
This section is empty.
Source Files
Click to show internal directories.
Click to hide internal directories.