Documentation
¶
Overview ¶
Package upstream provides HTTP helpers for fetching workspace-scoped data from the rysh-server using the local upstream API key.
Index ¶
Constants ¶
const APIKeyHeader = "X-API-Key"
APIKeyHeader is the header rysh-server's transparent NATS proxy reads the workspace API key from on the WebSocket upgrade.
Variables ¶
This section is empty.
Functions ¶
func FetchWorkspaceID ¶
func FetchWorkspaceID(up config.UpstreamConfig) (string, error)
FetchWorkspaceID is FetchWorkspaceInfo when only the namespace token matters.
func NATSAPIKeyHeader ¶ added in v0.2.11
NATSAPIKeyHeader is the dial option that authenticates an upstream NATS connection through rysh-server's transparent proxy (/workspaces/<ws>/nats): the workspace API key rides in the X-API-Key upgrade header, sent on the first connect and every reconnect — never as ?api_key= in the URL, which access logs record (F-86). rysh-server has read the header there since its first commit, so this works against every server version. An empty key adds nothing.
func ResolveWorkspaceID ¶
func ResolveWorkspaceID(up config.UpstreamConfig) string
ResolveWorkspaceID returns the upstream NATS namespace token for the given upstream config. When the configured workspace value is already a UUID it is returned unchanged (no network call). Otherwise — when sharing is enabled and an api_key is present — it resolves the workspace id from the server via the api key. On any failure it falls back to the configured value so the CLI still starts (sharing simply won't line up until the id is correct).
Types ¶
type ConnectionCredentials ¶
type ConnectionCredentials struct {
ConnectionID string `json:"connection_id"`
WorkspaceID string `json:"workspace_id"`
Name string `json:"name"`
ConnectionType string `json:"connection_type"`
Config map[string]string `json:"config"`
Secrets map[string]string `json:"secrets"`
}
ConnectionCredentials carries decrypted secrets plus public config for an external connection of a given type, fetched from the rysh-server.
func FetchConnectionCredentials ¶
func FetchConnectionCredentials(cfg config.Config, connType string) (*ConnectionCredentials, error)
FetchConnectionCredentials retrieves the decrypted credentials for the workspace's enabled connection of the given type (e.g. "slack", "whatsapp"). Returns an error if upstream is not configured, the request fails, or the workspace has no enabled connection of that type.
type CredentialsForbiddenError ¶ added in v0.2.11
type CredentialsForbiddenError struct{ Message string }
CredentialsForbiddenError is a 403 from the credentials fetch: the server refused this key, e.g. one belonging to an observer — channel credentials need the member role or higher (D-10 / E31-R piece 6). It is told apart from every other failure so the caller can refuse to start the channel instead of starting it without its token. Message is the server's own explanation (the "error" field of its JSON body, else the raw body).
func (*CredentialsForbiddenError) Error ¶ added in v0.2.11
func (e *CredentialsForbiddenError) Error() string
type RemoteShare ¶
type RemoteShare struct {
}
RemoteShare represents a shared entity returned by the upstream server.
func FetchRemoteShares ¶
func FetchRemoteShares(cfg config.Config) ([]RemoteShare, error)
FetchRemoteShares retrieves all active shares in the workspace from the upstream server. The workspace API key scopes the query to the key's workspace only.
type WorkspaceInfo ¶ added in v0.2.4
WorkspaceInfo is what /api/server-info tells a client about the workspace its API key belongs to: the Name a human recognises, and the ID that is the only thing usable on the wire.
func FetchWorkspaceInfo ¶ added in v0.2.4
func FetchWorkspaceInfo(up config.UpstreamConfig) (WorkspaceInfo, error)
FetchWorkspaceInfo queries the upstream server's /api/server-info endpoint with the workspace API key and returns the workspace name and id (UUID). The id is the globally unique NATS namespace token (ws.{id}.*); workspace names are unique per user, so the name cannot be used on the wire.
Its errors are written for a human to read as one line — `##upstream connect` prints them verbatim. A user who mistyped a URL should see that, not a wrapped *url.Error with an HTTP body glued to the end of it.
Source Files