server

func CORS ¶

func CORS() gin.HandlerFunc

CORS returns a Gin middleware that allows requests from the origins listed in the CONTEXO_CORS_ORIGINS env var (comma-separated). Defaults to allowing localhost:5173 and localhost:3000 for local dev when unset.

Sets Allow-Origin only when the request's Origin matches the allow-list, so unauthenticated origins get no special treatment. Allow-Credentials is NOT set because the API uses Bearer tokens, not cookies.

func MaxBody ¶ added in v0.5.0

func MaxBody(limit int64) gin.HandlerFunc

MaxBody caps the request body so a single client cannot exhaust server memory with a multi-gigabyte push body. Reads past the limit fail, and the handler surfaces that as a 4xx. GET/DELETE requests carry no body, so this is a no-op for them.

func NewRouter ¶

func NewRouter(h *handler.Handler, resolver *auth.Resolver, v1Extras []func(v1 *gin.RouterGroup), rootExtras []func(root *gin.RouterGroup)) *gin.Engine

NewRouter wires the git-backed Contexo endpoints. CORS runs first (handles preflight OPTIONS without auth); /v1/auth/google is unauthenticated (it establishes the session). All other /v1/* requires a Bearer token that the resolver can map to a user_id (session JWT, PAT, or legacy API key).

v1Extras and rootExtras are open-core seam hooks. v1Extras mount cloud-only routes on the authenticated /v1 group (they see the resolved user_id). rootExtras mount on the engine root, outside the auth middleware, for routes that authenticate themselves — e.g. payment webhooks verified by signature. The OSS server passes nil for both and behaves identically.

func RateLimit ¶ added in v0.5.0

func RateLimit(rl *rateLimiter) gin.HandlerFunc

RateLimit returns middleware that rejects requests from a client IP that has exhausted its bucket with 429. /health is always exempt so uptime checks are never throttled.