Documentation
¶
Overview ¶
Package routing implements JSON-configured URL-level authorization for varwof-core.
It replaces the hardcoded switch-case in mux.go with a configurable route table. Each route maps (method, path pattern) → required permission + constraints.
Adding a new API endpoint = adding a JSON entry. No code change needed.
Index ¶
- type RouteRule
- type RouteRules
- func (rr *RouteRules) AllRules() []RouteRule
- func (rr *RouteRules) Compile() error
- func (rr *RouteRules) Count() int
- func (rr *RouteRules) DefaultRule() *RouteRule
- func (rr *RouteRules) IsPublic(path string) bool
- func (rr *RouteRules) Match(method, path string) *RouteRule
- func (rr *RouteRules) MatchWithParams(method, path string) (*RouteRule, map[string]string)
- func (rr *RouteRules) RemovePublic(path string)
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type RouteRule ¶
type RouteRule struct {
Method string `json:"method"` // HTTP method: GET/POST/PUT/DELETE/PATCH/* (wildcard)
Path string `json:"path"` // URL path pattern: /api/v1/cert/{ca}/{serial}
Permission string `json:"permission"` // Required permission: cert:issue, cert:revoke, etc.
Description string `json:"description,omitempty"` // Human-readable description (for audit/docs)
CAScope bool `json:"ca_scope,omitempty"` // Enable CA scope check (enterprise mode)
RequireRole []string `json:"require_role,omitempty"` // Additional role whitelist (above permission)
AllowAIC *bool `json:"allow_aic,omitempty"` // Allow AIC agent access (nil = true)
MaxValidity string `json:"max_validity,omitempty"` // Max cert validity for issuance (e.g. "720h", "30d")
}
RouteRule defines a single authorization rule for an API endpoint.
type RouteRules ¶
type RouteRules struct {
Version string `json:"version"`
Rules []RouteRule `json:"rules"`
DefaultPermission string `json:"default_permission,omitempty"`
PublicPaths []string `json:"public_paths,omitempty"`
// contains filtered or unexported fields
}
RouteRules is the full authorization configuration.
func LoadData ¶
func LoadData(data []byte) (*RouteRules, error)
LoadData parses route rules from JSON bytes.
func LoadFile ¶
func LoadFile(path string) (*RouteRules, error)
LoadFile reads and parses a route rules JSON file.
func (*RouteRules) AllRules ¶
func (rr *RouteRules) AllRules() []RouteRule
AllRules returns a copy of the raw rules (for introspection/management API).
func (*RouteRules) Compile ¶
func (rr *RouteRules) Compile() error
Compile pre-parses all rules for fast matching. Called automatically by Load*.
func (*RouteRules) Count ¶
func (rr *RouteRules) Count() int
Count returns the number of compiled rules.
func (*RouteRules) DefaultRule ¶
func (rr *RouteRules) DefaultRule() *RouteRule
DefaultRule returns a synthetic rule carrying the configured default permission (M21 fix: DefaultPermission was dead config). It allows the server to enforce a deny-by-default permission for unmatched routes instead of silently falling back to a hardcoded chain. Returns nil when no default is configured.
func (*RouteRules) IsPublic ¶
func (rr *RouteRules) IsPublic(path string) bool
IsPublic returns true if the path is in the public paths list (no auth required). Supports glob patterns ending with /* (prefix match).
func (*RouteRules) Match ¶
func (rr *RouteRules) Match(method, path string) *RouteRule
Match finds the first rule matching (method, path). Returns nil if no rule matches (caller should decide: deny or fallback).
func (*RouteRules) MatchWithParams ¶
func (rr *RouteRules) MatchWithParams(method, path string) (*RouteRule, map[string]string)
MatchWithParams is like Match but also returns extracted path parameters.
func (*RouteRules) RemovePublic ¶
func (rr *RouteRules) RemovePublic(path string)
RemovePublic removes an exact path from the public (no-auth) allowlist. A trailing "/*" prefix rule covering it is left untouched; callers needing a full eviction must also prune the wildcard. Used to force /metrics through authentication even when a routes file re-introduces it into public_paths (defense in depth: the config gate in mux.ServeHTTP stays the primary control).
Source Files