Documentation
¶
Index ¶
- Variables
- func ApiAuth(next http.HandlerFunc) http.HandlerFunc
- func ApiPermissionBackup(next http.HandlerFunc) http.HandlerFunc
- func ApiPermissionCopyFiles(next http.HandlerFunc) http.HandlerFunc
- func ApiPermissionDownloadAuditLogs(next http.HandlerFunc) http.HandlerFunc
- func ApiPermissionLinkUsers(next http.HandlerFunc) http.HandlerFunc
- func ApiPermissionManageGroups(next http.HandlerFunc) http.HandlerFunc
- func ApiPermissionManageMCPServers(next http.HandlerFunc) http.HandlerFunc
- func ApiPermissionManageRoles(next http.HandlerFunc) http.HandlerFunc
- func ApiPermissionManageScripts(next http.HandlerFunc) http.HandlerFunc
- func ApiPermissionManageTemplates(next http.HandlerFunc) http.HandlerFunc
- func ApiPermissionManageUsers(next http.HandlerFunc) http.HandlerFunc
- func ApiPermissionManageUsersOrSelf(next http.HandlerFunc) http.HandlerFunc
- func ApiPermissionManageUsersOrSpaces(next http.HandlerFunc) http.HandlerFunc
- func ApiPermissionManageVariables(next http.HandlerFunc) http.HandlerFunc
- func ApiPermissionManageVolumes(next http.HandlerFunc) http.HandlerFunc
- func ApiPermissionRestore(next http.HandlerFunc) http.HandlerFunc
- func ApiPermissionRunCommands(next http.HandlerFunc) http.HandlerFunc
- func ApiPermissionTransferSpaces(next http.HandlerFunc) http.HandlerFunc
- func ApiPermissionUseMCPServer(next http.HandlerFunc) http.HandlerFunc
- func ApiPermissionUsePools(next http.HandlerFunc) http.HandlerFunc
- func ApiPermissionUseSpaces(next http.HandlerFunc) http.HandlerFunc
- func ApiPermissionUseTunnels(next http.HandlerFunc) http.HandlerFunc
- func ApiPermissionUseWebAssistant(next http.HandlerFunc) http.HandlerFunc
- func ApiPermissionViewAuditLogs(next http.HandlerFunc) http.HandlerFunc
- func ApiPermissionViewClusterInfo(next http.HandlerFunc) http.HandlerFunc
- func CookieName(name string) string
- func CookieSecure(r *http.Request, cfg *config.ServerConfig) bool
- func DeleteSessionCookie(w http.ResponseWriter, r *http.Request)
- func ExpireCookie(w http.ResponseWriter, r *http.Request, name string)
- func GetBearerToken(w http.ResponseWriter, r *http.Request) string
- func GetCookie(r *http.Request, name string) (*http.Cookie, error)
- func GetSessionFromCookie(r *http.Request) (*model.Session, error)
- func HandlerToHandlerFunc(h http.Handler) http.HandlerFunc
- func HostCookies(cfg *config.ServerConfig) bool
- func Initialize()
- func KnotVersion(next http.Handler) http.Handler
- func MCPServerContext(mcpServer *mcp.Server, scriptToolsProvider ScriptToolsProvider, ...) func(http.Handler) http.Handler
- func OptionalWebAuth(next http.HandlerFunc) http.HandlerFunc
- func SetCookie(w http.ResponseWriter, r *http.Request, name, value string, maxAge int)
- func TokenScopesRequired(next http.HandlerFunc) http.HandlerFunc
- func WebAuth(next http.HandlerFunc) http.HandlerFunc
- type ErrorResponse
- type ScriptToolsProvider
- type SkillProviders
Constants ¶
This section is empty.
Variables ¶
var (
HasUsers bool
)
Functions ¶
func ApiAuth ¶
func ApiAuth(next http.HandlerFunc) http.HandlerFunc
func ApiPermissionBackup ¶ added in v0.37.0
func ApiPermissionBackup(next http.HandlerFunc) http.HandlerFunc
ApiPermissionBackup requires the Backup Server permission. A server with no users has no one to hold it: its first user is created first, and takes the Backup User role, so backing up and restoring both start from a token.
func ApiPermissionCopyFiles ¶ added in v0.19.0
func ApiPermissionCopyFiles(next http.HandlerFunc) http.HandlerFunc
func ApiPermissionDownloadAuditLogs ¶ added in v0.24.0
func ApiPermissionDownloadAuditLogs(next http.HandlerFunc) http.HandlerFunc
func ApiPermissionLinkUsers ¶ added in v0.34.0
func ApiPermissionLinkUsers(next http.HandlerFunc) http.HandlerFunc
func ApiPermissionManageGroups ¶
func ApiPermissionManageGroups(next http.HandlerFunc) http.HandlerFunc
func ApiPermissionManageMCPServers ¶ added in v0.29.0
func ApiPermissionManageMCPServers(next http.HandlerFunc) http.HandlerFunc
func ApiPermissionManageRoles ¶
func ApiPermissionManageRoles(next http.HandlerFunc) http.HandlerFunc
func ApiPermissionManageScripts ¶ added in v0.23.0
func ApiPermissionManageScripts(next http.HandlerFunc) http.HandlerFunc
func ApiPermissionManageTemplates ¶
func ApiPermissionManageTemplates(next http.HandlerFunc) http.HandlerFunc
func ApiPermissionManageUsers ¶
func ApiPermissionManageUsers(next http.HandlerFunc) http.HandlerFunc
func ApiPermissionManageUsersOrSelf ¶
func ApiPermissionManageUsersOrSelf(next http.HandlerFunc) http.HandlerFunc
func ApiPermissionManageUsersOrSpaces ¶
func ApiPermissionManageUsersOrSpaces(next http.HandlerFunc) http.HandlerFunc
func ApiPermissionManageVariables ¶
func ApiPermissionManageVariables(next http.HandlerFunc) http.HandlerFunc
func ApiPermissionManageVolumes ¶
func ApiPermissionManageVolumes(next http.HandlerFunc) http.HandlerFunc
func ApiPermissionRestore ¶ added in v0.37.0
func ApiPermissionRestore(next http.HandlerFunc) http.HandlerFunc
ApiPermissionRestore requires the Backup Server permission, as a backup does. There is no open window for a server with no users: restoring into a new server starts by creating its first user, whose token does the restore.
func ApiPermissionRunCommands ¶ added in v0.19.0
func ApiPermissionRunCommands(next http.HandlerFunc) http.HandlerFunc
func ApiPermissionTransferSpaces ¶
func ApiPermissionTransferSpaces(next http.HandlerFunc) http.HandlerFunc
func ApiPermissionUseMCPServer ¶ added in v0.19.0
func ApiPermissionUseMCPServer(next http.HandlerFunc) http.HandlerFunc
func ApiPermissionUsePools ¶ added in v0.28.0
func ApiPermissionUsePools(next http.HandlerFunc) http.HandlerFunc
func ApiPermissionUseSpaces ¶
func ApiPermissionUseSpaces(next http.HandlerFunc) http.HandlerFunc
func ApiPermissionUseTunnels ¶
func ApiPermissionUseTunnels(next http.HandlerFunc) http.HandlerFunc
func ApiPermissionUseWebAssistant ¶ added in v0.19.0
func ApiPermissionUseWebAssistant(next http.HandlerFunc) http.HandlerFunc
func ApiPermissionViewAuditLogs ¶
func ApiPermissionViewAuditLogs(next http.HandlerFunc) http.HandlerFunc
func ApiPermissionViewClusterInfo ¶
func ApiPermissionViewClusterInfo(next http.HandlerFunc) http.HandlerFunc
func CookieName ¶ added in v0.41.0
CookieName is the name knot uses for one of its cookies.
func CookieSecure ¶ added in v0.34.4
func CookieSecure(r *http.Request, cfg *config.ServerConfig) bool
CookieSecure reports whether the web session cookie should carry the Secure attribute: knot terminates TLS itself, or the request arrived encrypted — directly (r.TLS) or behind a proxy that advertises the frontend scheme (X-Forwarded-Proto). A spoofed X-Forwarded-Proto can only ever add Secure, never remove it, so honouring the header is safe. It must stay conditional: plain-HTTP deployments (TLS terminated elsewhere or none) would have a Secure cookie rejected by the browser, breaking sessions — and a Secure deletion cookie is likewise ignored on plain HTTP, which would break logout.
func DeleteSessionCookie ¶
func DeleteSessionCookie(w http.ResponseWriter, r *http.Request)
func ExpireCookie ¶ added in v0.41.0
func ExpireCookie(w http.ResponseWriter, r *http.Request, name string)
ExpireCookie deletes one of knot's cookies under both names, so one left from before the server's URL changed scheme goes too.
func GetBearerToken ¶
func GetBearerToken(w http.ResponseWriter, r *http.Request) string
func GetCookie ¶ added in v0.41.0
GetCookie reads one of knot's cookies. On an https server only the prefixed name counts, so a cookie planted under the plain name is ignored.
func HandlerToHandlerFunc ¶ added in v0.23.0
func HandlerToHandlerFunc(h http.Handler) http.HandlerFunc
HandlerToHandlerFunc converts an http.Handler to an http.HandlerFunc This is useful when you need to use an http.Handler with middleware that expects http.HandlerFunc
func HostCookies ¶ added in v0.41.0
func HostCookies(cfg *config.ServerConfig) bool
HostCookies reports whether knot's cookies take the __Host- prefix. It follows the server's public URL rather than the request, so every server in a zone behind a load balancer that ends TLS agrees on the name, with or without X-Forwarded-Proto. The prefix needs Secure, which a browser only keeps over https; over plain http the names stay unprefixed.
func Initialize ¶
func Initialize()
func KnotVersion ¶ added in v0.41.0
KnotVersion stamps every reply with the server's version and refuses requests from a knot command on another major.minor version: the two name fields on the wire alike only within a minor version, so a mismatch would otherwise lose fields without a word.
func MCPServerContext ¶ added in v0.23.0
func MCPServerContext(mcpServer *mcp.Server, scriptToolsProvider ScriptToolsProvider, skillProviders SkillProviders) func(http.Handler) http.Handler
MCPServerContext adds the MCP server and request-scoped script tools and skills to the request context
func OptionalWebAuth ¶ added in v0.23.7
func OptionalWebAuth(next http.HandlerFunc) http.HandlerFunc
OptionalWebAuth injects the authenticated user into the context if a valid session cookie is present, but never redirects — unauthenticated requests pass through with no user in context.
func SetCookie ¶ added in v0.41.0
SetCookie sets one of knot's cookies, host-only and HttpOnly. maxAge 0 makes it last as long as the browser session.
func TokenScopesRequired ¶ added in v0.28.0
func TokenScopesRequired(next http.HandlerFunc) http.HandlerFunc
TokenScopesRequired wraps a handler with token-scope enforcement. If the request was authenticated via a scoped API token (i.e. the token in context has a non-empty Scopes slice), the request path must be covered by at least one of the token's scopes. Tokens with no scopes (nil/empty — the default for all pre-scopes tokens) are unrestricted. Session cookies and agent tokens bypass this check entirely.
func WebAuth ¶
func WebAuth(next http.HandlerFunc) http.HandlerFunc
Types ¶
type ErrorResponse ¶
type ErrorResponse struct {
Error string `json:"error" msgpack:"error"`
}
type ScriptToolsProvider ¶ added in v0.23.0
ScriptToolsProvider is a callback function that returns the request-scoped ToolProviders for script tools. Returned as a slice — not merged into one mcp.NewMultiProvider — so each stays individually visible to mcp.GetToolProviders(ctx): a provider that also implements an optional interface (e.g. lmchatkit.SourcedToolProvider) needs to be discoverable by type assertion, which a MultiProvider wrapper would hide.
type SkillProviders ¶ added in v0.36.0
type SkillProviders func(ctx context.Context, user *model.User) (skills mcp.SkillProvider, resources mcp.ResourceProvider)
SkillProviders is a callback function that returns the request-scoped skills surface for a user: entries for skills/list and skills/get, plus the resource reads those entries point at (the same object usually, hence the two returns). Either may be nil when the user has no skills.
Source Files