Documentation
¶
Index ¶
- Constants
- type App
- func (a *App) AcceptInvite(ctx context.Context, req *connect.Request[aperiov1.AcceptInviteRequest]) (*connect.Response[aperiov1.AcceptInviteResponse], error)
- func (a *App) ApproveSaasResponseAction(ctx context.Context, ...) (*connect.Response[aperiov1.ApproveSaasResponseActionResponse], error)
- func (a *App) BackfillIntegrationSource(ctx context.Context, ...) (*connect.Response[aperiov1.BackfillIntegrationSourceResponse], error)
- func (a *App) BeginMfaEnrollment(ctx context.Context, req *connect.Request[aperiov1.BeginMfaEnrollmentRequest]) (*connect.Response[aperiov1.BeginMfaEnrollmentResponse], error)
- func (a *App) CallApi(ctx context.Context, req *connect.Request[aperiov1.CallApiRequest]) (*connect.Response[aperiov1.CallApiResponse], error)
- func (a *App) CheckHealth(ctx context.Context, _ *connect.Request[aperiov1.CheckHealthRequest]) (*connect.Response[aperiov1.CheckHealthResponse], error)
- func (a *App) ClearIntegrationOAuthClient(ctx context.Context, ...) (*connect.Response[aperiov1.ClearIntegrationOAuthClientResponse], error)
- func (a *App) CreateCustomRule(ctx context.Context, req *connect.Request[aperiov1.CreateCustomRuleRequest]) (*connect.Response[aperiov1.CreateCustomRuleResponse], error)
- func (a *App) CreateExecutiveReport(ctx context.Context, ...) (*connect.Response[aperiov1.CreateExecutiveReportResponse], error)
- func (a *App) CreateIntegration(ctx context.Context, req *connect.Request[aperiov1.CreateIntegrationRequest]) (*connect.Response[aperiov1.CreateIntegrationResponse], error)
- func (a *App) CreateMemberResetLink(ctx context.Context, ...) (*connect.Response[aperiov1.CreateMemberResetLinkResponse], error)
- func (a *App) CreateRiskException(ctx context.Context, req *connect.Request[aperiov1.CreateRiskExceptionRequest]) (*connect.Response[aperiov1.CreateRiskExceptionResponse], error)
- func (a *App) CreateSaasIncident(ctx context.Context, req *connect.Request[aperiov1.CreateSaasIncidentRequest]) (*connect.Response[aperiov1.CreateSaasIncidentResponse], error)
- func (a *App) CreateSecurityAsset(ctx context.Context, req *connect.Request[aperiov1.CreateSecurityAssetRequest]) (*connect.Response[aperiov1.CreateSecurityAssetResponse], error)
- func (a *App) CreateSiemDestination(ctx context.Context, ...) (*connect.Response[aperiov1.CreateSiemDestinationResponse], error)
- func (a *App) CreateTenantMember(ctx context.Context, req *connect.Request[aperiov1.CreateTenantMemberRequest]) (*connect.Response[aperiov1.CreateTenantMemberResponse], error)
- func (a *App) DeleteCustomRule(ctx context.Context, req *connect.Request[aperiov1.DeleteCustomRuleRequest]) (*connect.Response[aperiov1.DeleteCustomRuleResponse], error)
- func (a *App) DeleteExecutiveReport(ctx context.Context, ...) (*connect.Response[aperiov1.DeleteExecutiveReportResponse], error)
- func (a *App) DeleteIntegration(ctx context.Context, req *connect.Request[aperiov1.DeleteIntegrationRequest]) (*connect.Response[aperiov1.DeleteIntegrationResponse], error)
- func (a *App) DeleteSiemDestination(ctx context.Context, ...) (*connect.Response[aperiov1.DeleteSiemDestinationResponse], error)
- func (a *App) DisableMfa(ctx context.Context, req *connect.Request[aperiov1.DisableMfaRequest]) (*connect.Response[aperiov1.DisableMfaResponse], error)
- func (a *App) EnableMfa(ctx context.Context, req *connect.Request[aperiov1.EnableMfaRequest]) (*connect.Response[aperiov1.EnableMfaResponse], error)
- func (a *App) ExecuteSaasResponseAction(ctx context.Context, ...) (*connect.Response[aperiov1.ExecuteSaasResponseActionResponse], error)
- func (a *App) ForceSyncIntegration(ctx context.Context, ...) (*connect.Response[aperiov1.ForceSyncIntegrationResponse], error)
- func (a *App) GetCurrentSession(ctx context.Context, req *connect.Request[aperiov1.GetCurrentSessionRequest]) (*connect.Response[aperiov1.GetCurrentSessionResponse], error)
- func (a *App) GetDashboardMetrics(ctx context.Context, req *connect.Request[aperiov1.GetDashboardMetricsRequest]) (*connect.Response[aperiov1.GetDashboardMetricsResponse], error)
- func (a *App) GetEmailDomainHealth(ctx context.Context, ...) (*connect.Response[aperiov1.GetEmailDomainHealthResponse], error)
- func (a *App) GetExecutiveReport(ctx context.Context, req *connect.Request[aperiov1.GetExecutiveReportRequest]) (*connect.Response[aperiov1.GetExecutiveReportResponse], error)
- func (a *App) GetFinding(ctx context.Context, req *connect.Request[aperiov1.GetFindingRequest]) (*connect.Response[aperiov1.GetFindingResponse], error)
- func (a *App) GetGoogleMailboxScanConfig(ctx context.Context, ...) (*connect.Response[aperiov1.GetGoogleMailboxScanConfigResponse], error)
- func (a *App) GetGoogleWorkspaceBigQueryConfig(ctx context.Context, ...) (*connect.Response[aperiov1.GetGoogleWorkspaceBigQueryConfigResponse], error)
- func (a *App) GetIntegrationChecks(ctx context.Context, ...) (*connect.Response[aperiov1.GetIntegrationChecksResponse], error)
- func (a *App) GetIntegrationOAuthClient(ctx context.Context, ...) (*connect.Response[aperiov1.GetIntegrationOAuthClientResponse], error)
- func (a *App) GetIntegrationSyncStatus(ctx context.Context, ...) (*connect.Response[aperiov1.GetIntegrationSyncStatusResponse], error)
- func (a *App) GetOperationalHealth(ctx context.Context, ...) (*connect.Response[aperiov1.GetOperationalHealthResponse], error)
- func (a *App) GetSaasIncident(ctx context.Context, req *connect.Request[aperiov1.GetSaasIncidentRequest]) (*connect.Response[aperiov1.GetSaasIncidentResponse], error)
- func (a *App) GetSecurityOverview(ctx context.Context, req *connect.Request[aperiov1.GetSecurityOverviewRequest]) (*connect.Response[aperiov1.GetSecurityOverviewResponse], error)
- func (a *App) GetTenantSettings(ctx context.Context, req *connect.Request[aperiov1.GetTenantSettingsRequest]) (*connect.Response[aperiov1.GetTenantSettingsResponse], error)
- func (a *App) Handler() http.Handler
- func (a *App) ListAuditLogs(ctx context.Context, req *connect.Request[aperiov1.ListAuditLogsRequest]) (*connect.Response[aperiov1.ListAuditLogsResponse], error)
- func (a *App) ListConnectorCatalog(ctx context.Context, ...) (*connect.Response[aperiov1.ListConnectorCatalogResponse], error)
- func (a *App) ListConnectorRules(ctx context.Context, req *connect.Request[aperiov1.ListConnectorRulesRequest]) (*connect.Response[aperiov1.ListConnectorRulesResponse], error)
- func (a *App) ListDetectionPacks(ctx context.Context, req *connect.Request[aperiov1.ListDetectionPacksRequest]) (*connect.Response[aperiov1.ListDetectionPacksResponse], error)
- func (a *App) ListEmailDomainHealth(ctx context.Context, ...) (*connect.Response[aperiov1.ListEmailDomainHealthResponse], error)
- func (a *App) ListExecutiveReports(ctx context.Context, ...) (*connect.Response[aperiov1.ListExecutiveReportsResponse], error)
- func (a *App) ListFindings(ctx context.Context, req *connect.Request[aperiov1.ListFindingsRequest]) (*connect.Response[aperiov1.ListFindingsResponse], error)
- func (a *App) ListIntegrations(ctx context.Context, req *connect.Request[aperiov1.ListIntegrationsRequest]) (*connect.Response[aperiov1.ListIntegrationsResponse], error)
- func (a *App) ListRiskExceptions(ctx context.Context, req *connect.Request[aperiov1.ListRiskExceptionsRequest]) (*connect.Response[aperiov1.ListRiskExceptionsResponse], error)
- func (a *App) ListSaasIncidents(ctx context.Context, req *connect.Request[aperiov1.ListSaasIncidentsRequest]) (*connect.Response[aperiov1.ListSaasIncidentsResponse], error)
- func (a *App) ListSecurityAssets(ctx context.Context, req *connect.Request[aperiov1.ListSecurityAssetsRequest]) (*connect.Response[aperiov1.ListSecurityAssetsResponse], error)
- func (a *App) ListShadowItOauthAppGrants(ctx context.Context, ...) (*connect.Response[aperiov1.ListShadowItOauthAppGrantsResponse], error)
- func (a *App) ListShadowItOauthApps(ctx context.Context, ...) (*connect.Response[aperiov1.ListShadowItOauthAppsResponse], error)
- func (a *App) ListSiemCatalog(ctx context.Context, req *connect.Request[aperiov1.ListSiemCatalogRequest]) (*connect.Response[aperiov1.ListSiemCatalogResponse], error)
- func (a *App) ListSiemDestinations(ctx context.Context, ...) (*connect.Response[aperiov1.ListSiemDestinationsResponse], error)
- func (a *App) ListTenantMembers(ctx context.Context, req *connect.Request[aperiov1.ListTenantMembersRequest]) (*connect.Response[aperiov1.ListTenantMembersResponse], error)
- func (a *App) ListWorkspaces(ctx context.Context, req *connect.Request[aperiov1.ListWorkspacesRequest]) (*connect.Response[aperiov1.ListWorkspacesResponse], error)
- func (a *App) Login(ctx context.Context, req *connect.Request[aperiov1.LoginRequest]) (*connect.Response[aperiov1.LoginResponse], error)
- func (a *App) LogoutCurrentSession(ctx context.Context, ...) (*connect.Response[aperiov1.LogoutCurrentSessionResponse], error)
- func (a *App) ProposeSaasResponseAction(ctx context.Context, ...) (*connect.Response[aperiov1.ProposeSaasResponseActionResponse], error)
- func (a *App) RefreshEmailDomainHealth(ctx context.Context, ...) (*connect.Response[aperiov1.RefreshEmailDomainHealthResponse], error)
- func (a *App) RemediateFinding(ctx context.Context, req *connect.Request[aperiov1.RemediateFindingRequest]) (*connect.Response[aperiov1.RemediateFindingResponse], error)
- func (a *App) RequestPasswordReset(ctx context.Context, ...) (*connect.Response[aperiov1.RequestPasswordResetResponse], error)
- func (a *App) ResetPassword(ctx context.Context, req *connect.Request[aperiov1.ResetPasswordRequest]) (*connect.Response[aperiov1.ResetPasswordResponse], error)
- func (a *App) RunIntegrationSourceSync(ctx context.Context, ...) (*connect.Response[aperiov1.RunIntegrationSourceSyncResponse], error)
- func (a *App) SetIntegrationOAuthClient(ctx context.Context, ...) (*connect.Response[aperiov1.SetIntegrationOAuthClientResponse], error)
- func (a *App) Signup(ctx context.Context, req *connect.Request[aperiov1.SignupRequest]) (*connect.Response[aperiov1.SignupResponse], error)
- func (a *App) StartGoogleWorkspaceOAuth(ctx context.Context, ...) (*connect.Response[aperiov1.StartGoogleWorkspaceOAuthResponse], error)
- func (a *App) SwitchWorkspace(ctx context.Context, req *connect.Request[aperiov1.SwitchWorkspaceRequest]) (*connect.Response[aperiov1.SwitchWorkspaceResponse], error)
- func (a *App) TestSiemDestination(ctx context.Context, req *connect.Request[aperiov1.TestSiemDestinationRequest]) (*connect.Response[aperiov1.TestSiemDestinationResponse], error)
- func (a *App) UpdateCustomRule(ctx context.Context, req *connect.Request[aperiov1.UpdateCustomRuleRequest]) (*connect.Response[aperiov1.UpdateCustomRuleResponse], error)
- func (a *App) UpdateFindingStatus(ctx context.Context, req *connect.Request[aperiov1.UpdateFindingStatusRequest]) (*connect.Response[aperiov1.UpdateFindingStatusResponse], error)
- func (a *App) UpdateGoogleMailboxScanConfig(ctx context.Context, ...) (*connect.Response[aperiov1.UpdateGoogleMailboxScanConfigResponse], error)
- func (a *App) UpdateGoogleWorkspaceBigQueryConfig(ctx context.Context, ...) (*connect.Response[aperiov1.UpdateGoogleWorkspaceBigQueryConfigResponse], error)
- func (a *App) UpdateIntegrationChecks(ctx context.Context, ...) (*connect.Response[aperiov1.UpdateIntegrationChecksResponse], error)
- func (a *App) UpdateMemberRole(ctx context.Context, req *connect.Request[aperiov1.UpdateMemberRoleRequest]) (*connect.Response[aperiov1.UpdateMemberRoleResponse], error)
- func (a *App) UpdateRiskException(ctx context.Context, req *connect.Request[aperiov1.UpdateRiskExceptionRequest]) (*connect.Response[aperiov1.UpdateRiskExceptionResponse], error)
- func (a *App) UpdateSaasIncidentStatus(ctx context.Context, ...) (*connect.Response[aperiov1.UpdateSaasIncidentStatusResponse], error)
- func (a *App) UpdateSecurityAsset(ctx context.Context, req *connect.Request[aperiov1.UpdateSecurityAssetRequest]) (*connect.Response[aperiov1.UpdateSecurityAssetResponse], error)
- func (a *App) UpdateTenantSettings(ctx context.Context, ...) (*connect.Response[aperiov1.UpdateTenantSettingsResponse], error)
- func (a *App) ValidateGoogleWorkspaceBigQueryConfig(ctx context.Context, ...) (*connect.Response[aperiov1.ValidateGoogleWorkspaceBigQueryConfigResponse], ...)
- func (a *App) WithCerebroContextClient(runtimeID string, client saasCerebroContextClient) *App
- func (a *App) WithCerebroMCPServerURL(serverURL string) *App
- func (a *App) WithCerebroOAuthIssuerURL(issuerURL string) *App
- func (a *App) WithCerebroSourceID(sourceID string) *App
- func (a *App) WithCerebroWebURL(webURL string) *App
- type GoogleOAuthResolver
Constants ¶
const GoogleWorkspaceBigQuerySyncWakeChannel = "aperio_google_workspace_bigquery_sync_requested"
GoogleWorkspaceBigQuerySyncWakeChannel is the Postgres LISTEN/NOTIFY channel the google-workspace-bigquery-sync worker subscribes to for out-of-cycle BigQuery export ingestion after config save or manual force-sync.
const GoogleWorkspaceDirectorySyncWakeChannel = "aperio_google_workspace_directory_sync_requested"
GoogleWorkspaceDirectorySyncWakeChannel wakes the Directory users sync worker for a targeted integration.
const GoogleWorkspaceOAuthSyncWakeChannel = "aperio_google_workspace_oauth_sync_requested"
GoogleWorkspaceOAuthSyncWakeChannel wakes the OAuth grants sync worker for a targeted integration.
const GoogleWorkspaceSyncWakeChannel = "aperio_google_workspace_sync_requested"
GoogleWorkspaceSyncWakeChannel is the Postgres LISTEN/NOTIFY channel name the google-workspace-poller subscribes to so freshly-connected integrations trigger an out-of-cycle poll instead of waiting up to a full poll interval for the next ticker fire. The payload is the integration_connections.id.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type App ¶
type App struct {
// contains filtered or unexported fields
}
App owns the Go/ConnectRPC HTTP surface. It deliberately keeps only infrastructural dependencies here so endpoint implementations stay easy to move from the current TypeScript API into Go one route at a time.
func NewApp ¶
NewApp wires routes but does not open network sockets. Tests can mount the returned handler directly, while cmd/aperio decides how to listen in runtime.
func (*App) AcceptInvite ¶
func (*App) ApproveSaasResponseAction ¶
func (*App) BackfillIntegrationSource ¶
func (*App) BeginMfaEnrollment ¶
func (*App) CallApi ¶
func (a *App) CallApi( ctx context.Context, req *connect.Request[aperiov1.CallApiRequest], ) (*connect.Response[aperiov1.CallApiResponse], error)
CheckHealth is the first ConnectRPC method exposed by the Go service. It matches Cerebro's generated-handler pattern and gives TypeScript clients a stable endpoint to verify transport compatibility.
func (*App) CheckHealth ¶
func (*App) ClearIntegrationOAuthClient ¶
func (*App) CreateCustomRule ¶
func (*App) CreateExecutiveReport ¶
func (*App) CreateIntegration ¶
func (*App) CreateMemberResetLink ¶
func (*App) CreateRiskException ¶
func (*App) CreateSaasIncident ¶
func (*App) CreateSecurityAsset ¶
func (*App) CreateSiemDestination ¶
func (*App) CreateTenantMember ¶
func (*App) DeleteCustomRule ¶
func (*App) DeleteExecutiveReport ¶
func (*App) DeleteIntegration ¶
func (*App) DeleteSiemDestination ¶
func (*App) DisableMfa ¶
func (*App) ExecuteSaasResponseAction ¶
func (*App) ForceSyncIntegration ¶
func (*App) GetCurrentSession ¶
func (*App) GetDashboardMetrics ¶
func (a *App) GetDashboardMetrics( ctx context.Context, req *connect.Request[aperiov1.GetDashboardMetricsRequest], ) (*connect.Response[aperiov1.GetDashboardMetricsResponse], error)
GetDashboardMetrics is the first product endpoint migrated behind ConnectRPC. It preserves the existing tenant cookie model so the web client can opt in via NEXT_PUBLIC_CONNECT_API_BASE_URL without changing login flow.
func (*App) GetEmailDomainHealth ¶
func (*App) GetExecutiveReport ¶
func (*App) GetFinding ¶
func (*App) GetGoogleMailboxScanConfig ¶
func (*App) GetGoogleWorkspaceBigQueryConfig ¶
func (*App) GetIntegrationChecks ¶
func (*App) GetIntegrationOAuthClient ¶
func (*App) GetIntegrationSyncStatus ¶
func (*App) GetOperationalHealth ¶
func (a *App) GetOperationalHealth(ctx context.Context, req *connect.Request[aperiov1.GetOperationalHealthRequest]) (*connect.Response[aperiov1.GetOperationalHealthResponse], error)
GetOperationalHealth returns tenant-scoped connector, queue, SIEM, and rule receipts. Unlike /readyz and CheckHealth, this endpoint is deliberately authenticated because its state is an operator view rather than a process liveness signal.
func (*App) GetSaasIncident ¶
func (*App) GetSecurityOverview ¶
func (*App) GetTenantSettings ¶
func (*App) Handler ¶
Handler returns the complete HTTP handler stack. CORS is applied outside the route mux so every ConnectRPC method and the liveness endpoint share the same browser boundary.
func (*App) ListAuditLogs ¶
func (*App) ListConnectorCatalog ¶
func (*App) ListConnectorRules ¶
func (*App) ListDetectionPacks ¶
func (a *App) ListDetectionPacks( ctx context.Context, req *connect.Request[aperiov1.ListDetectionPacksRequest], ) (*connect.Response[aperiov1.ListDetectionPacksResponse], error)
ListDetectionPacks returns every detection pack the worker knows about, each hydrated with the rules it owns. The shape is intentionally flat so the operator UI can render the catalog in a single render pass without follow-up requests. Provider filter is optional; an empty provider returns every pack in display order.
func (*App) ListEmailDomainHealth ¶
func (*App) ListExecutiveReports ¶
func (*App) ListFindings ¶
func (*App) ListIntegrations ¶
func (*App) ListRiskExceptions ¶
func (*App) ListSaasIncidents ¶
func (*App) ListSecurityAssets ¶
func (*App) ListShadowItOauthAppGrants ¶
func (*App) ListShadowItOauthApps ¶
func (*App) ListSiemCatalog ¶
func (*App) ListSiemDestinations ¶
func (*App) ListTenantMembers ¶
func (*App) ListWorkspaces ¶
func (*App) LogoutCurrentSession ¶
func (*App) ProposeSaasResponseAction ¶
func (*App) RefreshEmailDomainHealth ¶
func (*App) RemediateFinding ¶
func (*App) RequestPasswordReset ¶
func (*App) ResetPassword ¶
func (*App) RunIntegrationSourceSync ¶
func (*App) SetIntegrationOAuthClient ¶
func (*App) StartGoogleWorkspaceOAuth ¶
func (*App) SwitchWorkspace ¶
func (*App) TestSiemDestination ¶
func (*App) UpdateCustomRule ¶
func (*App) UpdateFindingStatus ¶
func (*App) UpdateGoogleMailboxScanConfig ¶
func (*App) UpdateGoogleWorkspaceBigQueryConfig ¶
func (*App) UpdateIntegrationChecks ¶
func (*App) UpdateMemberRole ¶
func (*App) UpdateRiskException ¶
func (*App) UpdateSaasIncidentStatus ¶
func (*App) UpdateSecurityAsset ¶
func (*App) UpdateTenantSettings ¶
func (*App) ValidateGoogleWorkspaceBigQueryConfig ¶
func (*App) WithCerebroContextClient ¶
func (*App) WithCerebroMCPServerURL ¶
func (*App) WithCerebroOAuthIssuerURL ¶
func (*App) WithCerebroSourceID ¶
func (*App) WithCerebroWebURL ¶
type GoogleOAuthResolver ¶
GoogleOAuthResolver is a small, dependency-free adapter that satisfies internal/googleworkspacepoller.OAuthResolver without forcing that package to import bootstrap (which would create an import cycle: bootstrap → poller → bootstrap). The resolver reads per-tenant client credentials from integration_oauth_clients, falls back to the operator env vars, and decrypts the stored client_secret using the same AAD scheme the rest of the bootstrap package uses (oauthClientSecretAAD).
func (GoogleOAuthResolver) ResolveGoogleOAuthClient ¶
func (r GoogleOAuthResolver) ResolveGoogleOAuthClient(ctx context.Context, organizationID string) (poolerOAuthConfig, bool)
ResolveGoogleOAuthClient returns the per-organization Google OAuth client id / secret pair. The bool is false when neither a per-tenant row nor the operator env fallback is configured, in which case the caller should skip the integration with a log line rather than fail loudly.
Source Files
¶
- app.go
- catalog.go
- cerebro_oauth_metadata.go
- cerebro_web_links.go
- compat_api.go
- compliance_report.go
- connector_rules.go
- detection_packs.go
- disabled_check_metadata.go
- email_domain_health.go
- event_bus.go
- executive_reports.go
- finding_cerebro_context.go
- google_oauth.go
- google_oauth_resolver.go
- oauth_clients.go
- operational_health.go
- remediation.go
- remediation_actions.go
- saas_cerebro_context.go
- saas_dr.go
- security_cerebro_context.go
- security_overview.go
- sync_status.go
- typed_compat.go