Documentation
¶
Index ¶
- func APIKeyMiddleware(jwtSecret string, next http.Handler) http.Handler
- func APIKeyRoleFromToken(token, jwtSecret string) string
- func AllowlistCORSMiddleware(getOrigins func(*http.Request) []string, next http.Handler) http.Handler
- func DevMiddleware(next http.Handler) http.Handler
- func ManagedCORSMiddleware(corsEnv string, manifestFor func(*http.Request) *proxy.RouteManifest, ...) http.Handler
- func NewACMEManager(domain, cacheDir string) (*autocert.Manager, error)
- func ParseCSV(s string) []string
- func StandaloneTLSConfig(m *autocert.Manager) *tls.Config
- func TenantMiddleware(secret string, next http.Handler) http.Handler
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func APIKeyMiddleware ¶ added in v1.4.0
APIKeyMiddleware rejects data-plane requests that do not carry a valid project API key. Without it, an unkeyed request reaches PostgREST and is executed as the anon role, leaving the whole API surface reachable by anyone who knows the project ref — unattributable and impossible to rate limit or revoke.
func APIKeyRoleFromToken ¶ added in v1.4.0
APIKeyRoleFromToken verifies a key against the project's JWT secret and returns its role. An unverifiable key, or one whose role is not a PostgREST role, yields "".
func AllowlistCORSMiddleware ¶
func AllowlistCORSMiddleware(getOrigins func(*http.Request) []string, next http.Handler) http.Handler
AllowlistCORSMiddleware reflects Access-Control-Allow-Origin only when the request Origin is in the list returned by getOrigins (non-empty). If getOrigins returns nil/empty, next is invoked with no CORS headers (same-origin only from the browser's perspective).
func DevMiddleware ¶
DevMiddleware wraps next with development-mode behaviour:
- Permissive CORS (reflect any Origin; required with AllowCredentials)
- No TLS (TLS is not applied by this wrapper; bind plain HTTP in dev)
Vite HMR at /_vite/* is mounted on the chi outer mux in dev mode (see cmd.buildOuterMux) so requests are included in the outer JSON access log on stderr.
func ManagedCORSMiddleware ¶
func ManagedCORSMiddleware(corsEnv string, manifestFor func(*http.Request) *proxy.RouteManifest, next http.Handler) http.Handler
ManagedCORSMiddleware wraps next with an Origin allowlist built from corsEnv (SUPATYPE_CORS_ALLOW_ORIGINS) and the per-request route manifest (cors_allowed_origins). Runs outside TenantMiddleware so browsers can complete OPTIONS preflight without HMAC headers.
func NewACMEManager ¶
NewACMEManager returns an autocert.Manager configured for domain. Certificates are cached in cacheDir (created if absent). Use Manager.TLSConfig() as the http.Server.TLSConfig. Use Manager.HTTPHandler(nil) on SUPATYPE_ACME_HTTP_ADDR (default :80) for the HTTP-01 ACME challenge.
func StandaloneTLSConfig ¶
StandaloneTLSConfig returns a *tls.Config suitable for use with http.Server.TLSConfig in standalone mode.
Types ¶
This section is empty.
Source Files