Documentation
¶
Overview ¶
Package scripthttp exposes managed-script review over the admin REST API: the script list, a script's version history, one version with the capabilities its code reaches for, and the approval action that makes a version executable.
Approval is the load-bearing control of the whole feature — nothing runs unattended except a version somebody approved, and approving binds the capability grant that run is confined to — so it is a first-class REST action from the moment execution exists rather than something a later UI introduces. The human review surface is built on these routes.
It lives beside the other version-review seam (internal/httpserver/ versionhttp) rather than inside pkg/admin so that package stays within its size budget; the composition root mounts it under the admin path prefix wrapped in the admin authentication middleware and injects the identity accessor, so this package never imports the admin surface.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type ContractReader ¶
type ContractReader interface {
Contract(ctx context.Context, id string) (*script.Contract, error)
}
ContractReader composes one script's contract document: the record, the approved version's parameter contract and approval stamp, the cadence, and the last successful run. It is the same document a reference to a script resolves to (#1302), so the portal page and an agent's fetch describe a script identically.
type Deps ¶
type Deps struct {
Scripts script.Store
Versions script.VersionStore
Approvals script.ApprovalStore
Reviews script.ReviewStore
Rejections script.RejectionStore
// Schedules is the cadence store. Nil leaves the schedule routes unmounted,
// which is the honest shape for a deployment that cannot keep a schedule.
Schedules script.ScheduleStore
// Runs is the run history. Nil leaves the portal run routes unmounted: a
// deployment that keeps no runs has no history to show.
Runs script.RunStore
// Contracts composes one script's contract document for the portal detail
// route. Nil leaves that route unmounted.
Contracts ContractReader
// LatestRuns reports each script's most recent run for the portal listing.
// Nil leaves the listing's last-run column empty rather than unmounting it.
LatestRuns LatestRunReader
// AdminEmail returns the authenticated administrator's email, which is
// stamped on the approval.
AdminEmail func(r *http.Request) string
// PortalUser resolves the authenticated portal caller, or nil when the
// request carries no user. Nil leaves the portal routes unmounted, which is
// what the admin surface passes.
PortalUser func(r *http.Request) *PortalIdentity
}
Deps carries the collaborators the review handlers need. Every store except Schedules is required; a deployment without them does not mount these routes.
type Handler ¶
type Handler struct {
// contains filtered or unexported fields
}
Handler serves the script review routes.
func (*Handler) RegisterAdmin ¶
func (h *Handler) RegisterAdmin(mux *http.ServeMux, prefix string, wrap func(http.Handler) http.Handler)
RegisterAdmin mounts the review routes under prefix, each wrapped in the admin authentication middleware.
func (*Handler) RegisterPortal ¶
RegisterPortal mounts the portal read routes, wrapped in the portal authentication middleware. Every handler goes through portalHandler, which resolves the caller and answers 401 once for all of them.
The run routes are mounted only where the deployment keeps runs, the detail route only where a contract can be composed, and the schedule routes only where the deployment keeps schedules; a deployment missing any of them serves the rest rather than failing per request.
type LatestRunReader ¶
type LatestRunReader interface {
LatestRuns(ctx context.Context, scriptIDs []string) (map[string]script.Run, error)
}
LatestRunReader returns the most recent run of each named script, keyed by script id and omitting the scripts that have never run. It is a listing capability rather than a history one: the alternative is one query per row.
type PortalIdentity ¶
type PortalIdentity struct {
UserID string
Email string
Persona string
IsAdmin bool
// Roles is the authority this caller holds. It is recorded on any version
// they author (#1307): approving a version binds exactly the roles its
// author held, which is what keeps approval from being a way to hand a
// script more access than the person who wrote it.
Roles []string
}
PortalIdentity is the portal caller, resolved by the accessor the composition root injects. IsAdmin carries the administrator's unrestricted reach into this surface: an admin sees every script and every run, which is the same authority the admin API already gives them.
Source Files