v1

package
v0.30.0 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Jul 26, 2026 License: MIT Imports: 71 Imported by: 0

Documentation

Index

Constants

View Source
const (
	// The upload memory buffer is 32 MiB.
	// It should be kept low, so RAM usage doesn't get out of control.
	// This is unrelated to maximum upload size limit, which is now set through system setting.
	MaxUploadBufferSizeBytes = 32 << 20
	MebiByte                 = 1024 * 1024
	// ThumbnailCacheFolder is the folder name where the thumbnail images are stored.
	ThumbnailCacheFolder = ".thumbnail_cache"
)
View Source
const (
	// DefaultPageSize is the default page size for requests.
	DefaultPageSize = 50
	// MaxPageSize is the maximum page size for requests.
	MaxPageSize = 1000
)
View Source
const (
	InstanceSettingNamePrefix  = "instance/settings/"
	UserNamePrefix             = "users/"
	MemoNamePrefix             = "memos/"
	MemoShareNamePrefix        = "shares/"
	AttachmentNamePrefix       = "attachments/"
	ReactionNamePrefix         = "reactions/"
	InboxNamePrefix            = "inboxes/"
	IdentityProviderNamePrefix = "identity-providers/"
	WebhookNamePrefix          = "webhooks/"
)
View Source
const MaxAPIRequestBytes = 256 << 20

MaxAPIRequestBytes caps the size of a request body accepted by the API. The in-process MCP endpoint forwards every tool call through these same routes, so it derives its own limit from this constant to keep the two gates in lockstep.

Variables

View Source
var AuthBootstrapMethods = map[string]struct{}{

	"/memos.api.v1.AuthService/SignIn":       {},
	"/memos.api.v1.AuthService/RefreshToken": {},

	"/memos.api.v1.InstanceService/GetInstanceProfile":       {},
	"/memos.api.v1.InstanceService/GetInstanceSetting":       {},
	"/memos.api.v1.InstanceService/BatchGetInstanceSettings": {},

	"/memos.api.v1.IdentityProviderService/ListIdentityProviders": {},

	"/memos.api.v1.UserService/CreateUser": {},

	"/memos.api.v1.MemoService/GetSharedMemo": {},
}

AuthBootstrapMethods is the subset of PublicMethods that stays reachable by anonymous callers even when the instance is private (no InstanceURL configured).

It is the minimum required to render the sign-in page, authenticate, and follow share links, and register when instance settings permit it. Every entry here MUST also exist in PublicMethods.

View Source
var ErrUnauthenticated = errors.New("authentication required")

ErrUnauthenticated is returned by the Authorizer when a request must be rejected for lack of valid credentials. Each transport maps it to its own status code (Connect: CodeUnauthenticated, gRPC-Gateway: HTTP 401).

View Source
var PublicMethods = map[string]struct{}{

	"/memos.api.v1.AuthService/SignIn":       {},
	"/memos.api.v1.AuthService/RefreshToken": {},

	"/memos.api.v1.InstanceService/GetInstanceProfile":       {},
	"/memos.api.v1.InstanceService/GetInstanceSetting":       {},
	"/memos.api.v1.InstanceService/BatchGetInstanceSettings": {},

	"/memos.api.v1.UserService/CreateUser":       {},
	"/memos.api.v1.UserService/GetUser":          {},
	"/memos.api.v1.UserService/BatchGetUsers":    {},
	"/memos.api.v1.UserService/GetUserAvatar":    {},
	"/memos.api.v1.UserService/GetUserStats":     {},
	"/memos.api.v1.UserService/ListAllUserStats": {},

	"/memos.api.v1.IdentityProviderService/ListIdentityProviders": {},

	"/memos.api.v1.MemoService/GetMemo":              {},
	"/memos.api.v1.MemoService/ListMemos":            {},
	"/memos.api.v1.MemoService/ListMemoComments":     {},
	"/memos.api.v1.MemoService/GetLinkMetadata":      {},
	"/memos.api.v1.MemoService/BatchGetLinkMetadata": {},

	"/memos.api.v1.MemoService/GetSharedMemo": {},
}

PublicMethods defines API endpoints that don't require authentication. All other endpoints require a valid session or access token.

This is the SINGLE SOURCE OF TRUTH for public endpoints. Both Connect interceptor and gRPC-Gateway interceptor use this map.

Format: Full gRPC procedure path as returned by req.Spec().Procedure (Connect) or info.FullMethod (gRPC interceptor).

View Source
var SupportedThumbnailMimeTypes = []string{
	"image/png",
	"image/jpeg",
}

Functions

func BuildUserName added in v0.27.0

func BuildUserName(username string) string

BuildUserName returns the canonical public resource name for a user.

func ExtractAttachmentUIDFromName added in v0.25.0

func ExtractAttachmentUIDFromName(name string) (string, error)

ExtractAttachmentUIDFromName returns the attachment UID from a resource name.

func ExtractIdentityProviderUIDFromName added in v0.27.0

func ExtractIdentityProviderUIDFromName(name string) (string, error)

func ExtractInboxIDFromName

func ExtractInboxIDFromName(name string) (int32, error)

ExtractInboxIDFromName returns the inbox ID from a resource name.

func ExtractInstanceSettingKeyFromName added in v0.25.3

func ExtractInstanceSettingKeyFromName(name string) (string, error)

func ExtractMemoReactionIDFromName added in v0.26.0

func ExtractMemoReactionIDFromName(name string) (string, int32, error)

ExtractMemoReactionIDFromName returns the memo UID and reaction ID from a resource name. e.g., "memos/abc/reactions/123" -> ("abc", 123).

func ExtractMemoUIDFromName added in v0.24.0

func ExtractMemoUIDFromName(name string) (string, error)

ExtractMemoUIDFromName returns the memo UID from a resource name. e.g., "memos/uuid" -> "uuid".

func ExtractUserIDFromName

func ExtractUserIDFromName(name string) (int32, error)

ExtractUserIDFromName returns the uid from a resource name.

func GetNameParentTokens

func GetNameParentTokens(name string, tokenPrefixes ...string) ([]string, error)

GetNameParentTokens returns the tokens from a resource name.

func IsAuthBootstrapMethod added in v0.30.0

func IsAuthBootstrapMethod(procedure string) bool

IsAuthBootstrapMethod reports whether an anonymous request to procedure is one of the fixed endpoints allowed while the instance is private.

func IsPublicMethod added in v0.26.0

func IsPublicMethod(procedure string) bool

IsPublicMethod checks if a procedure path is public (no authentication required). Returns true for public methods, false for protected methods.

func RegisterSSERoutes added in v0.27.0

func RegisterSSERoutes(router sseRouteRegistrar, hub *SSEHub, storeInstance *store.Store, secret string)

RegisterSSERoutes registers the SSE endpoint on the given Echo router.

func ResolveUserByName added in v0.27.0

func ResolveUserByName(ctx context.Context, stores *store.Store, name string) (*store.User, error)

ResolveUserByName resolves a username-based user resource name to a store user.

func SaveAttachmentBlob added in v0.25.0

func SaveAttachmentBlob(ctx context.Context, profile *profile.Profile, stores *store.Store, create *store.Attachment) error

SaveAttachmentBlob saves the blob of attachment based on the storage config.

func SetResponseHeader added in v0.26.0

func SetResponseHeader(ctx context.Context, key, value string) error

SetResponseHeader sets a header in the response.

This function works for both gRPC and Connect protocols:

  • For gRPC: Uses grpc.SetHeader to set headers in gRPC metadata
  • For Connect: Stores in HeaderCarrier for Connect wrapper to apply later

The protocol is automatically detected based on whether a HeaderCarrier exists in the context (injected by Connect wrappers).

func ValidateAndGenerateUID added in v0.27.0

func ValidateAndGenerateUID(provided string) (string, error)

ValidateAndGenerateUID validates a user-provided UID or generates a new one. If provided is empty, a new shortuuid is generated. If provided is non-empty, it is validated against base.UIDMatcher.

func WithHeaderCarrier added in v0.26.0

func WithHeaderCarrier(ctx context.Context) context.Context

WithHeaderCarrier adds a header carrier to the context.

Types

type APIV1Service

func NewAPIV1Service

func NewAPIV1Service(secret string, profile *profile.Profile, store *store.Store) *APIV1Service

func (*APIV1Service) BatchDeleteAttachments added in v0.27.0

func (s *APIV1Service) BatchDeleteAttachments(ctx context.Context, request *v1pb.BatchDeleteAttachmentsRequest) (*emptypb.Empty, error)

func (*APIV1Service) BatchGetInstanceSettings added in v0.29.0

BatchGetInstanceSettings returns multiple instance settings in request order.

func (*APIV1Service) BatchGetLinkMetadata added in v0.29.0

BatchGetLinkMetadata gets metadata for links.

func (*APIV1Service) BatchGetUsers added in v0.27.0

func (*APIV1Service) Check added in v0.24.2

func (*APIV1Service) CreateAttachment added in v0.25.0

func (s *APIV1Service) CreateAttachment(ctx context.Context, request *v1pb.CreateAttachmentRequest) (*v1pb.Attachment, error)

func (*APIV1Service) CreateIdentityProvider

func (s *APIV1Service) CreateIdentityProvider(ctx context.Context, request *v1pb.CreateIdentityProviderRequest) (*v1pb.IdentityProvider, error)

func (*APIV1Service) CreateLinkedIdentity added in v0.28.0

func (s *APIV1Service) CreateLinkedIdentity(ctx context.Context, request *v1pb.CreateLinkedIdentityRequest) (*v1pb.LinkedIdentity, error)

func (*APIV1Service) CreateMemo

func (s *APIV1Service) CreateMemo(ctx context.Context, request *v1pb.CreateMemoRequest) (*v1pb.Memo, error)

func (*APIV1Service) CreateMemoComment

func (s *APIV1Service) CreateMemoComment(ctx context.Context, request *v1pb.CreateMemoCommentRequest) (*v1pb.Memo, error)

CreateMemoComment creates a comment on an existing memo.

func (*APIV1Service) CreateMemoShare added in v0.27.0

func (s *APIV1Service) CreateMemoShare(ctx context.Context, request *v1pb.CreateMemoShareRequest) (*v1pb.MemoShare, error)

CreateMemoShare creates an opaque share link for a memo. Only the memo's creator or an admin may call this.

func (*APIV1Service) CreatePersonalAccessToken added in v0.26.0

CreatePersonalAccessToken creates a new Personal Access Token (PAT) for a user.

Use cases: - User manually creates token in settings for mobile app - User creates token for CLI tool - User creates token for third-party integration

Token properties: - Random string with memos_pat_ prefix - SHA-256 hash stored in database - Optional expiration time (can be never-expiring) - User-provided description for identification

Security considerations: - Full token is only shown ONCE (in this response) - User should copy and store it securely - Token can be revoked by deleting it from settings

Authentication: Required (session cookie or access token) Authorization: User can only create tokens for themselves.

func (*APIV1Service) CreateShortcut added in v0.24.0

func (s *APIV1Service) CreateShortcut(ctx context.Context, request *v1pb.CreateShortcutRequest) (*v1pb.Shortcut, error)

func (*APIV1Service) CreateUser

func (s *APIV1Service) CreateUser(ctx context.Context, request *v1pb.CreateUserRequest) (*v1pb.User, error)

func (*APIV1Service) CreateUserWebhook added in v0.25.1

func (s *APIV1Service) CreateUserWebhook(ctx context.Context, request *v1pb.CreateUserWebhookRequest) (*v1pb.UserWebhook, error)

func (*APIV1Service) DeleteAttachment added in v0.25.0

func (s *APIV1Service) DeleteAttachment(ctx context.Context, request *v1pb.DeleteAttachmentRequest) (*emptypb.Empty, error)

func (*APIV1Service) DeleteIdentityProvider

func (s *APIV1Service) DeleteIdentityProvider(ctx context.Context, request *v1pb.DeleteIdentityProviderRequest) (*emptypb.Empty, error)

func (*APIV1Service) DeleteLinkedIdentity added in v0.28.0

func (s *APIV1Service) DeleteLinkedIdentity(ctx context.Context, request *v1pb.DeleteLinkedIdentityRequest) (*emptypb.Empty, error)

func (*APIV1Service) DeleteMemo

func (s *APIV1Service) DeleteMemo(ctx context.Context, request *v1pb.DeleteMemoRequest) (*emptypb.Empty, error)

func (*APIV1Service) DeleteMemoReaction

func (s *APIV1Service) DeleteMemoReaction(ctx context.Context, request *v1pb.DeleteMemoReactionRequest) (*emptypb.Empty, error)

func (*APIV1Service) DeleteMemoShare added in v0.27.0

func (s *APIV1Service) DeleteMemoShare(ctx context.Context, request *v1pb.DeleteMemoShareRequest) (*emptypb.Empty, error)

DeleteMemoShare revokes a share link. Only the memo's creator or an admin may call this.

func (*APIV1Service) DeletePersonalAccessToken added in v0.26.0

func (s *APIV1Service) DeletePersonalAccessToken(ctx context.Context, request *v1pb.DeletePersonalAccessTokenRequest) (*emptypb.Empty, error)

DeletePersonalAccessToken revokes a Personal Access Token.

This endpoint: 1. Removes the token from the user's access tokens list 2. Immediately invalidates the token (subsequent API calls with it will fail)

Use cases: - User revokes a compromised token - User removes token for unused app/device - User cleans up old tokens

Authentication: Required (session cookie or access token) Authorization: User can only delete their own tokens.

func (*APIV1Service) DeleteShortcut added in v0.24.0

func (s *APIV1Service) DeleteShortcut(ctx context.Context, request *v1pb.DeleteShortcutRequest) (*emptypb.Empty, error)

func (*APIV1Service) DeleteUser

func (s *APIV1Service) DeleteUser(ctx context.Context, request *v1pb.DeleteUserRequest) (*emptypb.Empty, error)

func (*APIV1Service) DeleteUserNotification added in v0.25.3

func (s *APIV1Service) DeleteUserNotification(ctx context.Context, request *v1pb.DeleteUserNotificationRequest) (*emptypb.Empty, error)

DeleteUserNotification permanently deletes a notification. Only the notification owner can delete their notifications.

func (*APIV1Service) DeleteUserWebhook added in v0.25.1

func (s *APIV1Service) DeleteUserWebhook(ctx context.Context, request *v1pb.DeleteUserWebhookRequest) (*emptypb.Empty, error)

func (*APIV1Service) DispatchMemoCommentCreatedWebhook added in v0.27.0

func (s *APIV1Service) DispatchMemoCommentCreatedWebhook(ctx context.Context, commentMemo *v1pb.Memo, relatedMemoCreatorID int32) error

DispatchMemoCommentCreatedWebhook dispatches webhook to the related memo owner when a comment is created.

func (*APIV1Service) DispatchMemoCreatedWebhook

func (s *APIV1Service) DispatchMemoCreatedWebhook(ctx context.Context, memo *v1pb.Memo) error

DispatchMemoCreatedWebhook dispatches a webhook when a memo is created.

func (*APIV1Service) DispatchMemoDeletedWebhook

func (s *APIV1Service) DispatchMemoDeletedWebhook(ctx context.Context, memo *v1pb.Memo) error

DispatchMemoDeletedWebhook dispatches webhook when memo is deleted.

func (*APIV1Service) DispatchMemoUpdatedWebhook

func (s *APIV1Service) DispatchMemoUpdatedWebhook(ctx context.Context, memo *v1pb.Memo) error

DispatchMemoUpdatedWebhook dispatches webhook when memo is updated.

func (*APIV1Service) GetAttachment added in v0.25.0

func (s *APIV1Service) GetAttachment(ctx context.Context, request *v1pb.GetAttachmentRequest) (*v1pb.Attachment, error)

func (*APIV1Service) GetAttachmentBlob added in v0.25.0

func (s *APIV1Service) GetAttachmentBlob(attachment *store.Attachment) ([]byte, error)

func (*APIV1Service) GetCurrentUser added in v0.22.1

GetCurrentUser returns the authenticated user's information. Validates the access token and returns user details.

Authentication: Required (access token). Returns: User information.

func (*APIV1Service) GetIdentityProvider

func (s *APIV1Service) GetIdentityProvider(ctx context.Context, request *v1pb.GetIdentityProviderRequest) (*v1pb.IdentityProvider, error)

func (*APIV1Service) GetInstanceAdmin added in v0.26.0

func (s *APIV1Service) GetInstanceAdmin(ctx context.Context) (*v1pb.User, error)

func (*APIV1Service) GetInstanceProfile added in v0.25.3

GetInstanceProfile returns the instance profile.

func (*APIV1Service) GetInstanceSetting added in v0.25.3

func (s *APIV1Service) GetInstanceSetting(ctx context.Context, request *v1pb.GetInstanceSettingRequest) (*v1pb.InstanceSetting, error)

func (*APIV1Service) GetInstanceStats added in v0.29.0

GetInstanceStats returns resource usage statistics. Admin only.

func (*APIV1Service) GetLinkMetadata

func (*APIV1Service) GetLinkMetadata(_ context.Context, request *v1pb.GetLinkMetadataRequest) (*v1pb.LinkMetadata, error)

GetLinkMetadata gets metadata for a link.

func (*APIV1Service) GetLinkedIdentity added in v0.28.0

func (s *APIV1Service) GetLinkedIdentity(ctx context.Context, request *v1pb.GetLinkedIdentityRequest) (*v1pb.LinkedIdentity, error)

func (*APIV1Service) GetMemo

func (s *APIV1Service) GetMemo(ctx context.Context, request *v1pb.GetMemoRequest) (*v1pb.Memo, error)

func (*APIV1Service) GetSharedMemo added in v0.30.0

func (s *APIV1Service) GetSharedMemo(ctx context.Context, request *v1pb.GetSharedMemoRequest) (*v1pb.Memo, error)

GetSharedMemo resolves a share token to its memo. No authentication required. Returns NOT_FOUND for invalid or expired tokens (no information leakage).

func (*APIV1Service) GetShortcut added in v0.25.0

func (s *APIV1Service) GetShortcut(ctx context.Context, request *v1pb.GetShortcutRequest) (*v1pb.Shortcut, error)

func (*APIV1Service) GetUser

func (s *APIV1Service) GetUser(ctx context.Context, request *v1pb.GetUserRequest) (*v1pb.User, error)

func (*APIV1Service) GetUserSetting

func (s *APIV1Service) GetUserSetting(ctx context.Context, request *v1pb.GetUserSettingRequest) (*v1pb.UserSetting, error)

func (*APIV1Service) GetUserStats added in v0.23.1

func (s *APIV1Service) GetUserStats(ctx context.Context, request *v1pb.GetUserStatsRequest) (*v1pb.UserStats, error)

func (*APIV1Service) GetUserWebhookSigningSecret added in v0.30.0

GetUserWebhookSigningSecret reveals the signing secret for a single webhook. This is the only endpoint that returns the secret value; it is gated to the webhook owner (or an admin) and the secret is never included in list/create/update responses.

func (*APIV1Service) ListAllUserStats added in v0.23.1

func (*APIV1Service) ListAttachments added in v0.25.0

func (*APIV1Service) ListLinkedIdentities added in v0.28.0

func (*APIV1Service) ListMemoAttachments added in v0.25.0

func (*APIV1Service) ListMemoComments

func (*APIV1Service) ListMemoReactions

func (*APIV1Service) ListMemoRelations

func (*APIV1Service) ListMemoShares added in v0.27.0

ListMemoShares lists all share links for a memo. Only the memo's creator or an admin may call this.

func (*APIV1Service) ListMemos

func (s *APIV1Service) ListMemos(ctx context.Context, request *v1pb.ListMemosRequest) (*v1pb.ListMemosResponse, error)

func (*APIV1Service) ListPersonalAccessTokens added in v0.26.0

func (*APIV1Service) ListShortcuts added in v0.24.0

func (*APIV1Service) ListUserNotifications added in v0.25.3

func (*APIV1Service) ListUserSettings added in v0.25.1

func (*APIV1Service) ListUserWebhooks added in v0.25.1

func (*APIV1Service) ListUsers

func (s *APIV1Service) ListUsers(ctx context.Context, request *v1pb.ListUsersRequest) (*v1pb.ListUsersResponse, error)

func (*APIV1Service) RefreshToken added in v0.26.0

RefreshToken exchanges a valid refresh token for a new access token.

This endpoint implements refresh token rotation with sliding window sessions: 1. Extracts the refresh token from the HttpOnly cookie (memos_refresh) 2. Validates the refresh token against the database (checking expiry and revocation) 3. Rotates the refresh token: generates a new one with fresh 30-day expiry 4. Generates a new short-lived access token (15 minutes) 5. Sets the new refresh token as HttpOnly cookie 6. Returns the new access token and its expiry time

Token rotation provides: - Sliding window sessions: active users stay logged in indefinitely - Better security: stolen refresh tokens become invalid after legitimate refresh

Authentication: Requires valid refresh token in cookie (public endpoint) Returns: New access token and expiry timestamp.

func (*APIV1Service) RegisterGateway

func (s *APIV1Service) RegisterGateway(ctx context.Context, echoServer *echo.Echo) error

RegisterGateway registers the gRPC-Gateway and Connect handlers with the given Echo instance.

func (*APIV1Service) SetMemoAttachments added in v0.25.0

func (s *APIV1Service) SetMemoAttachments(ctx context.Context, request *v1pb.SetMemoAttachmentsRequest) (*emptypb.Empty, error)

func (*APIV1Service) SetMemoRelations

func (s *APIV1Service) SetMemoRelations(ctx context.Context, request *v1pb.SetMemoRelationsRequest) (*emptypb.Empty, error)

func (*APIV1Service) SignIn

func (s *APIV1Service) SignIn(ctx context.Context, request *v1pb.SignInRequest) (*v1pb.SignInResponse, error)

SignIn authenticates a user with credentials and returns tokens. On success, returns an access token and sets a refresh token cookie.

Supports two authentication methods: 1. Password-based authentication (username + password). 2. SSO authentication (OAuth2 authorization code).

Authentication: Not required (public endpoint). Returns: User info, access token, and token expiry.

func (*APIV1Service) SignOut

SignOut terminates the user's authentication. Revokes the refresh token and clears the authentication cookie.

Authentication: Required (access token). Returns: Empty response on success.

func (*APIV1Service) TestInstanceEmailSetting added in v0.29.0

func (s *APIV1Service) TestInstanceEmailSetting(ctx context.Context, request *v1pb.TestInstanceEmailSettingRequest) (*emptypb.Empty, error)

func (*APIV1Service) Transcribe added in v0.27.0

Transcribe transcribes an audio file using an instance AI provider.

func (*APIV1Service) UpdateAttachment added in v0.25.0

func (s *APIV1Service) UpdateAttachment(ctx context.Context, request *v1pb.UpdateAttachmentRequest) (*v1pb.Attachment, error)

func (*APIV1Service) UpdateIdentityProvider

func (s *APIV1Service) UpdateIdentityProvider(ctx context.Context, request *v1pb.UpdateIdentityProviderRequest) (*v1pb.IdentityProvider, error)

func (*APIV1Service) UpdateInstanceSetting added in v0.25.3

func (s *APIV1Service) UpdateInstanceSetting(ctx context.Context, request *v1pb.UpdateInstanceSettingRequest) (*v1pb.InstanceSetting, error)

func (*APIV1Service) UpdateMemo

func (s *APIV1Service) UpdateMemo(ctx context.Context, request *v1pb.UpdateMemoRequest) (*v1pb.Memo, error)

UpdateMemo updates an existing memo.

func (*APIV1Service) UpdateShortcut added in v0.24.0

func (s *APIV1Service) UpdateShortcut(ctx context.Context, request *v1pb.UpdateShortcutRequest) (*v1pb.Shortcut, error)

func (*APIV1Service) UpdateUser

func (s *APIV1Service) UpdateUser(ctx context.Context, request *v1pb.UpdateUserRequest) (*v1pb.User, error)

func (*APIV1Service) UpdateUserNotification added in v0.25.3

func (s *APIV1Service) UpdateUserNotification(ctx context.Context, request *v1pb.UpdateUserNotificationRequest) (*v1pb.UserNotification, error)

UpdateUserNotification updates a notification's status (e.g., marking as read/archived). Only the notification owner can update their notifications.

func (*APIV1Service) UpdateUserSetting

func (s *APIV1Service) UpdateUserSetting(ctx context.Context, request *v1pb.UpdateUserSettingRequest) (*v1pb.UserSetting, error)

func (*APIV1Service) UpdateUserWebhook added in v0.25.1

func (s *APIV1Service) UpdateUserWebhook(ctx context.Context, request *v1pb.UpdateUserWebhookRequest) (*v1pb.UserWebhook, error)

func (*APIV1Service) UpsertMemoReaction

func (s *APIV1Service) UpsertMemoReaction(ctx context.Context, request *v1pb.UpsertMemoReactionRequest) (*v1pb.Reaction, error)

type AuthInterceptor added in v0.26.0

type AuthInterceptor struct {
	// contains filtered or unexported fields
}

AuthInterceptor enforces authentication and anonymous-access policy for Connect handlers by delegating to the shared Authorizer. Role-based authorization (admin checks) remains in the service layer.

func NewAuthInterceptor added in v0.26.0

func NewAuthInterceptor(authorizer *Authorizer) *AuthInterceptor

NewAuthInterceptor creates a new auth interceptor backed by the shared Authorizer.

func (*AuthInterceptor) WrapStreamingClient added in v0.26.0

func (*AuthInterceptor) WrapStreamingHandler added in v0.26.0

func (*AuthInterceptor) WrapUnary added in v0.26.0

func (in *AuthInterceptor) WrapUnary(next connect.UnaryFunc) connect.UnaryFunc

type Authorizer added in v0.30.0

type Authorizer struct {
	// contains filtered or unexported fields
}

Authorizer is the single source of truth for method-level access control.

It authenticates a request from its Authorization header and decides whether the (possibly anonymous) caller may reach a given RPC procedure. The Connect interceptor and the gRPC-Gateway middleware share one Authorizer so both transports enforce identical rules.

Role-based authorization (admin checks) stays in the service layer; this type governs only authentication and anonymous access.

func NewAuthorizer added in v0.30.0

func NewAuthorizer(store *store.Store, secret string, profile *profile.Profile) *Authorizer

NewAuthorizer creates an Authorizer backed by the given store, token secret, and instance profile.

func (*Authorizer) Authenticate added in v0.30.0

func (a *Authorizer) Authenticate(ctx context.Context, authHeader string) *auth.AuthResult

Authenticate resolves the caller from the Authorization header, returning nil for an anonymous request. It never enforces policy — pair it with CheckAccess.

func (*Authorizer) CheckAccess added in v0.30.0

func (a *Authorizer) CheckAccess(ctx context.Context, procedure string, result *auth.AuthResult) error

CheckAccess enforces method-level access policy for procedure given the authentication result (nil = anonymous). It returns nil when the request is permitted and ErrUnauthenticated otherwise.

Policy:

  • Authenticated caller (access token or PAT): always permitted here.
  • Anonymous + protected method: denied.
  • Anonymous + public method, open instance: permitted.
  • Anonymous + public method, private instance (no InstanceURL): permitted only for the auth-bootstrap set.

type ConnectServiceHandler added in v0.26.0

type ConnectServiceHandler struct {
	*APIV1Service
}

ConnectServiceHandler wraps APIV1Service to implement Connect handler interfaces. It adapts the existing gRPC service implementations to work with Connect's request/response wrapper types.

This wrapper pattern allows us to: - Reuse existing gRPC service implementations - Support both native gRPC and Connect protocols - Maintain a single source of truth for business logic.

func NewConnectServiceHandler added in v0.26.0

func NewConnectServiceHandler(svc *APIV1Service) *ConnectServiceHandler

NewConnectServiceHandler creates a new Connect service handler.

func (*ConnectServiceHandler) BatchDeleteAttachments added in v0.27.0

func (*ConnectServiceHandler) BatchGetInstanceSettings added in v0.29.0

func (*ConnectServiceHandler) BatchGetLinkMetadata added in v0.29.0

func (*ConnectServiceHandler) BatchGetUsers added in v0.27.0

func (*ConnectServiceHandler) CreateAttachment added in v0.26.0

func (*ConnectServiceHandler) CreateIdentityProvider added in v0.26.0

func (*ConnectServiceHandler) CreateLinkedIdentity added in v0.28.0

func (*ConnectServiceHandler) CreateMemo added in v0.26.0

func (*ConnectServiceHandler) CreateMemoComment added in v0.26.0

func (*ConnectServiceHandler) CreateMemoShare added in v0.27.0

func (*ConnectServiceHandler) CreatePersonalAccessToken added in v0.26.0

func (*ConnectServiceHandler) CreateShortcut added in v0.26.0

func (*ConnectServiceHandler) CreateUser added in v0.26.0

func (*ConnectServiceHandler) CreateUserWebhook added in v0.26.0

func (*ConnectServiceHandler) DeleteAttachment added in v0.26.0

func (*ConnectServiceHandler) DeleteIdentityProvider added in v0.26.0

func (*ConnectServiceHandler) DeleteLinkedIdentity added in v0.28.0

func (*ConnectServiceHandler) DeleteMemo added in v0.26.0

func (*ConnectServiceHandler) DeleteMemoReaction added in v0.26.0

func (*ConnectServiceHandler) DeleteMemoShare added in v0.27.0

func (*ConnectServiceHandler) DeletePersonalAccessToken added in v0.26.0

func (*ConnectServiceHandler) DeleteShortcut added in v0.26.0

func (*ConnectServiceHandler) DeleteUser added in v0.26.0

func (*ConnectServiceHandler) DeleteUserNotification added in v0.26.0

func (*ConnectServiceHandler) DeleteUserWebhook added in v0.26.0

func (*ConnectServiceHandler) GetAttachment added in v0.26.0

func (*ConnectServiceHandler) GetCurrentUser added in v0.26.0

func (*ConnectServiceHandler) GetIdentityProvider added in v0.26.0

func (*ConnectServiceHandler) GetInstanceProfile added in v0.26.0

func (*ConnectServiceHandler) GetInstanceSetting added in v0.26.0

func (*ConnectServiceHandler) GetInstanceStats added in v0.29.0

func (*ConnectServiceHandler) GetLinkMetadata added in v0.29.0

func (*ConnectServiceHandler) GetLinkedIdentity added in v0.28.0

func (*ConnectServiceHandler) GetMemo added in v0.26.0

func (*ConnectServiceHandler) GetSharedMemo added in v0.30.0

func (*ConnectServiceHandler) GetShortcut added in v0.26.0

func (*ConnectServiceHandler) GetUser added in v0.26.0

func (*ConnectServiceHandler) GetUserSetting added in v0.26.0

func (*ConnectServiceHandler) GetUserStats added in v0.26.0

func (*ConnectServiceHandler) GetUserWebhookSigningSecret added in v0.30.0

func (*ConnectServiceHandler) ListAllUserStats added in v0.26.0

func (*ConnectServiceHandler) ListAttachments added in v0.26.0

func (*ConnectServiceHandler) ListIdentityProviders added in v0.26.0

func (*ConnectServiceHandler) ListLinkedIdentities added in v0.28.0

func (*ConnectServiceHandler) ListMemoAttachments added in v0.26.0

func (*ConnectServiceHandler) ListMemoComments added in v0.26.0

func (*ConnectServiceHandler) ListMemoReactions added in v0.26.0

func (*ConnectServiceHandler) ListMemoRelations added in v0.26.0

func (*ConnectServiceHandler) ListMemoShares added in v0.27.0

func (*ConnectServiceHandler) ListMemos added in v0.26.0

func (*ConnectServiceHandler) ListPersonalAccessTokens added in v0.26.0

func (*ConnectServiceHandler) ListShortcuts added in v0.26.0

func (*ConnectServiceHandler) ListUserNotifications added in v0.26.0

func (*ConnectServiceHandler) ListUserSettings added in v0.26.0

func (*ConnectServiceHandler) ListUserWebhooks added in v0.26.0

func (*ConnectServiceHandler) ListUsers added in v0.26.0

func (*ConnectServiceHandler) RefreshToken added in v0.26.0

func (*ConnectServiceHandler) RegisterConnectHandlers added in v0.26.0

func (s *ConnectServiceHandler) RegisterConnectHandlers(mux *http.ServeMux, opts ...connect.HandlerOption)

RegisterConnectHandlers registers all Connect service handlers on the given mux.

func (*ConnectServiceHandler) SetMemoAttachments added in v0.26.0

func (*ConnectServiceHandler) SetMemoRelations added in v0.26.0

func (*ConnectServiceHandler) SignIn added in v0.26.0

func (*ConnectServiceHandler) SignOut added in v0.26.0

func (*ConnectServiceHandler) TestInstanceEmailSetting added in v0.29.0

func (*ConnectServiceHandler) Transcribe added in v0.27.0

func (*ConnectServiceHandler) UpdateAttachment added in v0.26.0

func (*ConnectServiceHandler) UpdateIdentityProvider added in v0.26.0

func (*ConnectServiceHandler) UpdateInstanceSetting added in v0.26.0

func (*ConnectServiceHandler) UpdateMemo added in v0.26.0

func (*ConnectServiceHandler) UpdateShortcut added in v0.26.0

func (*ConnectServiceHandler) UpdateUser added in v0.26.0

func (*ConnectServiceHandler) UpdateUserNotification added in v0.26.0

func (*ConnectServiceHandler) UpdateUserSetting added in v0.26.0

func (*ConnectServiceHandler) UpdateUserWebhook added in v0.26.0

func (*ConnectServiceHandler) UpsertMemoReaction added in v0.26.0

type HeaderCarrier added in v0.26.0

type HeaderCarrier struct {
	// contains filtered or unexported fields
}

HeaderCarrier stores headers that need to be set in the response.

Problem: The codebase supports two protocols simultaneously:

  • Native gRPC: Uses grpc.SetHeader() to set response headers
  • Connect-RPC: Uses connect.Response.Header().Set() to set response headers

Solution: HeaderCarrier provides a protocol-agnostic way to set headers.

  • Service methods call SetResponseHeader() regardless of protocol
  • For gRPC requests: SetResponseHeader uses grpc.SetHeader directly
  • For Connect requests: SetResponseHeader stores headers in HeaderCarrier
  • Connect wrappers extract headers from HeaderCarrier and apply to response

This allows service methods to work with both protocols without knowing which one is being used.

func GetHeaderCarrier added in v0.26.0

func GetHeaderCarrier(ctx context.Context) *HeaderCarrier

GetHeaderCarrier retrieves the header carrier from the context. Returns nil if no carrier is present.

func (*HeaderCarrier) All added in v0.26.0

func (h *HeaderCarrier) All() map[string]string

All returns all headers.

func (*HeaderCarrier) Get added in v0.26.0

func (h *HeaderCarrier) Get(key string) string

Get retrieves a header from the carrier.

func (*HeaderCarrier) Set added in v0.26.0

func (h *HeaderCarrier) Set(key, value string)

Set adds a header to the carrier.

type LoggingInterceptor added in v0.26.0

type LoggingInterceptor struct {
	// contains filtered or unexported fields
}

LoggingInterceptor logs Connect RPC requests with appropriate log levels.

Log levels: - INFO: Successful requests and expected client errors (not found, permission denied, etc.) - ERROR: Server errors (internal, unavailable, etc.)

func NewLoggingInterceptor added in v0.26.0

func NewLoggingInterceptor(logStacktrace bool) *LoggingInterceptor

NewLoggingInterceptor creates a new logging interceptor.

func (*LoggingInterceptor) WrapStreamingClient added in v0.26.0

func (*LoggingInterceptor) WrapStreamingHandler added in v0.26.0

func (*LoggingInterceptor) WrapUnary added in v0.26.0

type MetadataInterceptor added in v0.26.0

type MetadataInterceptor struct{}

MetadataInterceptor converts Connect HTTP headers to gRPC metadata.

This ensures service methods can use metadata.FromIncomingContext() to access headers like User-Agent, X-Forwarded-For, etc., regardless of whether the request came via Connect RPC or gRPC-Gateway.

func NewMetadataInterceptor added in v0.26.0

func NewMetadataInterceptor() *MetadataInterceptor

NewMetadataInterceptor creates a new metadata interceptor.

func (*MetadataInterceptor) WrapStreamingClient added in v0.26.0

func (*MetadataInterceptor) WrapStreamingHandler added in v0.26.0

func (*MetadataInterceptor) WrapUnary added in v0.26.0

type RecoveryInterceptor added in v0.26.0

type RecoveryInterceptor struct {
	// contains filtered or unexported fields
}

RecoveryInterceptor recovers from panics in Connect handlers and returns an internal error.

func NewRecoveryInterceptor added in v0.26.0

func NewRecoveryInterceptor(logStacktrace bool) *RecoveryInterceptor

NewRecoveryInterceptor creates a new recovery interceptor.

func (*RecoveryInterceptor) WrapStreamingClient added in v0.26.0

func (*RecoveryInterceptor) WrapStreamingHandler added in v0.26.0

func (*RecoveryInterceptor) WrapUnary added in v0.26.0

type SSEClient added in v0.27.0

type SSEClient struct {
	// contains filtered or unexported fields
}

SSEClient represents a single SSE connection.

type SSEEvent added in v0.27.0

type SSEEvent struct {
	Type SSEEventType `json:"type"`
	// Name is the affected resource name (e.g., "memos/xxxx").
	// For reaction events, this is the memo resource name that the reaction belongs to.
	Name string `json:"name"`
	// Parent is the parent memo resource name when the affected resource is a comment.
	Parent string `json:"parent,omitempty"`
	// Visibility and CreatorID are used only for server-side delivery filtering.
	Visibility store.Visibility `json:"-"`
	CreatorID  int32            `json:"-"`
}

SSEEvent represents a change event sent to SSE clients.

func (*SSEEvent) JSON added in v0.27.0

func (e *SSEEvent) JSON() []byte

JSON returns the JSON representation of the event. Returns nil if marshaling fails (error is logged).

type SSEEventType added in v0.27.0

type SSEEventType string

SSEEventType represents the type of change event.

const (
	SSEEventMemoCreated        SSEEventType = "memo.created"
	SSEEventMemoUpdated        SSEEventType = "memo.updated"
	SSEEventMemoDeleted        SSEEventType = "memo.deleted"
	SSEEventMemoCommentCreated SSEEventType = "memo.comment.created"
	SSEEventReactionUpserted   SSEEventType = "reaction.upserted"
	SSEEventReactionDeleted    SSEEventType = "reaction.deleted"
)

type SSEHub added in v0.27.0

type SSEHub struct {
	// contains filtered or unexported fields
}

SSEHub manages SSE client connections and broadcasts events. It is safe for concurrent use.

func NewSSEHub added in v0.27.0

func NewSSEHub() *SSEHub

NewSSEHub creates a new SSE hub.

func (*SSEHub) Broadcast added in v0.27.0

func (h *SSEHub) Broadcast(event *SSEEvent)

Broadcast sends an event to all connected clients. Slow clients that have a full buffer will have the event dropped to avoid blocking the broadcaster.

func (*SSEHub) Close added in v0.27.0

func (h *SSEHub) Close()

Close disconnects all subscribed SSE clients.

func (*SSEHub) Subscribe added in v0.27.0

func (h *SSEHub) Subscribe(userID int32, role store.Role) *SSEClient

Subscribe registers a new client and returns it. The caller must call Unsubscribe when done.

func (*SSEHub) Unsubscribe added in v0.27.0

func (h *SSEHub) Unsubscribe(c *SSEClient)

Unsubscribe removes a client and closes its channel.

Directories

Path Synopsis

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL