service

package
v0.11.0-cloud1 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 8, 2026 License: Apache-2.0 Imports: 35 Imported by: 0

Documentation

Index

Constants

View Source 
const (
	// Maximum event payload size (1MB)
	MaxEventPayloadSize = 1024 * 1024

	// Gateway event type constants
	EventTypeAPIDeployed   = "api.deployed"
	EventTypeAPIUndeployed = "api.undeployed"
	EventTypeAPIDeleted    = "api.deleted"

	EventTypeLLMProviderDeployed   = "llmprovider.deployed"
	EventTypeLLMProviderUndeployed = "llmprovider.undeployed"
	EventTypeLLMProviderDeleted    = "llmprovider.deleted"

	EventTypeLLMProxyDeployed   = "llmproxy.deployed"
	EventTypeLLMProxyUndeployed = "llmproxy.undeployed"
	EventTypeLLMProxyDeleted    = "llmproxy.deleted"

	EventTypeMCPProxyDeployed   = "mcpproxy.deployed"
	EventTypeMCPProxyUndeployed = "mcpproxy.undeployed"
	EventTypeMCPProxyDeleted    = "mcpproxy.deleted"

	EventTypeWebSubAPIDeployed   = "websub.deployed"
	EventTypeWebSubAPIUndeployed = "websub.undeployed"
	EventTypeWebSubAPIDeleted    = "websub.deleted"

	EventTypeWebBrokerAPIDeployed   = "webbroker.deployed"
	EventTypeWebBrokerAPIUndeployed = "webbroker.undeployed"
	EventTypeWebBrokerAPIDeleted    = "webbroker.deleted"

	EventTypeAPIKeyCreated = "apikey.created"
	EventTypeAPIKeyRevoked = "apikey.revoked"
	EventTypeAPIKeyUpdated = "apikey.updated"

	EventTypeWebSubAPIHmacSecretCreated = "websub.hmacsecret.created"
	EventTypeWebSubAPIHmacSecretUpdated = "websub.hmacsecret.updated"
	EventTypeWebSubAPIHmacSecretDeleted = "websub.hmacsecret.deleted"

	EventTypeSubscriptionCreated = "subscription.created"
	EventTypeSubscriptionUpdated = "subscription.updated"
	EventTypeSubscriptionDeleted = "subscription.deleted"

	EventTypeSubscriptionPlanCreated = "subscriptionPlan.created"
	EventTypeSubscriptionPlanUpdated = "subscriptionPlan.updated"
	EventTypeSubscriptionPlanDeleted = "subscriptionPlan.deleted"
)

Variables

This section is empty.

Functions

This section is empty.

Types

type APIKeyService 

type APIKeyService struct {
	// contains filtered or unexported fields
}

APIKeyService handles API key management operations for external API key injection

func NewAPIKeyService 

func NewAPIKeyService(apiRepo repository.APIRepository, artifactRepo repository.ArtifactRepository, apiKeyRepo repository.APIKeyRepository, gatewayEventsService *GatewayEventsService, auditRepo repository.AuditRepository, hashingAlgorithms []string, slogger *slog.Logger) *APIKeyService

NewAPIKeyService creates a new API key service instance. hashingAlgorithms specifies the algorithms used to hash API keys before storage and broadcast. If empty, defaults to sha256.

func (*APIKeyService) CreateAPIKey 

func (s *APIKeyService) CreateAPIKey(ctx context.Context, apiHandle, kind, orgId, userId string, req *api.CreateAPIKeyRequest) error

CreateAPIKey hashes an external API key and broadcasts it to gateways where the API is deployed. This method is used when external platforms inject API keys to hybrid gateways.

func (*APIKeyService) RevokeAPIKey 

func (s *APIKeyService) RevokeAPIKey(ctx context.Context, apiHandle, kind, orgId, keyName, userId string) error

RevokeAPIKey broadcasts API key revocation to all gateways where the API is deployed

func (*APIKeyService) UpdateAPIKey 

func (s *APIKeyService) UpdateAPIKey(ctx context.Context, apiHandle, kind, orgId, keyName, userId string, req *api.UpdateAPIKeyRequest) error

UpdateAPIKey updates/regenerates an API key and broadcasts it to all gateways where the API is deployed. This method is used when external platforms rotates/regenerates API keys on hybrid gateways.

type APIKeyUserService 

type APIKeyUserService struct {
	// contains filtered or unexported fields
}

APIKeyUserService handles listing API keys across artifact types for a given user.

func NewAPIKeyUserService 

func NewAPIKeyUserService(
	apiKeyRepo repository.APIKeyRepository,
	identity *IdentityService,
	slogger *slog.Logger,
) *APIKeyUserService

NewAPIKeyUserService creates a new APIKeyUserService instance.

func (*APIKeyUserService) ListAPIKeysByUser 

func (s *APIKeyUserService) ListAPIKeysByUser(
	ctx context.Context,
	orgID, username string,
	types []string,
) (*api.UserAPIKeyListResponse, error)

ListAPIKeysByUser returns API keys created by the given user within the org, optionally filtered by artifact types.

type APIService 

type APIService struct {
	// contains filtered or unexported fields
}

APIService handles business logic for API operations

func NewAPIService 

func NewAPIService(apiRepo repository.APIRepository, projectRepo repository.ProjectRepository,
	orgRepo repository.OrganizationRepository, gatewayRepo repository.GatewayRepository,
	deploymentRepo repository.DeploymentRepository,
	subscriptionPlanRepo repository.SubscriptionPlanRepository,
	customPolicyRepo repository.CustomPolicyRepository,
	gatewayEventsService *GatewayEventsService, apiUtil *utils.APIUtil,
	slogger *slog.Logger, auditRepo repository.AuditRepository, identity *IdentityService) *APIService

NewAPIService creates a new API service

func (*APIService) AddGatewaysToAPI 

func (s *APIService) AddGatewaysToAPI(apiUUID string, gatewayIds []string, orgUUID string) (*api.RESTAPIGatewayListResponse, error)

AddGatewaysToAPI associates multiple gateways with an API

func (*APIService) AddGatewaysToAPIByHandle 

func (s *APIService) AddGatewaysToAPIByHandle(handle string, gatewayIds []string, orgId string) (*api.RESTAPIGatewayListResponse, error)

AddGatewaysToAPIByHandle associates multiple gateways with an API identified by handle

func (*APIService) CreateAPI 

func (s *APIService) CreateAPI(req *api.CreateRESTAPIRequest, orgUUID, createdBy string) (*api.RESTAPI, error)

CreateAPI creates a new API with validation and business logic

func (*APIService) DeleteAPI 

func (s *APIService) DeleteAPI(apiUUID, orgUUID, deletedBy string) error

DeleteAPI deletes an API

func (*APIService) DeleteAPIByHandle 

func (s *APIService) DeleteAPIByHandle(handle, orgId, deletedBy string) error

DeleteAPIByHandle deletes an API identified by handle

func (*APIService) GetAPIByHandle 

func (s *APIService) GetAPIByHandle(handle, orgId string) (*api.RESTAPI, error)

GetAPIByHandle retrieves an API by its handle

func (*APIService) GetAPIByUUID 

func (s *APIService) GetAPIByUUID(apiUUID, orgUUID string) (*api.RESTAPI, error)

GetAPIByUUID retrieves an API by its ID

func (*APIService) GetAPIGateways 

func (s *APIService) GetAPIGateways(apiUUID, orgUUID string) (*api.RESTAPIGatewayListResponse, error)

GetAPIGateways retrieves all gateways associated with an API including deployment details

func (*APIService) GetAPIGatewaysByHandle 

func (s *APIService) GetAPIGatewaysByHandle(handle, orgId string) (*api.RESTAPIGatewayListResponse, error)

GetAPIGatewaysByHandle retrieves all gateways associated with an API identified by handle

func (*APIService) GetAPIsByOrganization 

func (s *APIService) GetAPIsByOrganization(orgUUID string, projectHandle string) ([]api.RESTAPI, error)

GetAPIsByOrganization retrieves all APIs for an organization with optional project filter. projectHandle, when provided, is the project's handle (not UUID).

func (*APIService) HandleExistsCheck 

func (s *APIService) HandleExistsCheck(orgUUID string) func(string) bool

HandleExistsCheck returns a function that checks if an API handle exists in the organization. This is designed to be used with utils.GenerateHandle for handle generation with collision detection.

func (*APIService) UpdateAPI 

func (s *APIService) UpdateAPI(apiUUID string, req *api.RESTAPI, orgUUID, updatedBy string) (*api.RESTAPI, error)

UpdateAPI updates an existing API

func (*APIService) UpdateAPIByHandle 

func (s *APIService) UpdateAPIByHandle(handle string, req *api.RESTAPI, orgId, updatedBy string) (*api.RESTAPI, error)

UpdateAPIByHandle updates an existing API identified by handle

type AddApplicationAssociationsRequest 

type AddApplicationAssociationsRequest struct {
	Associations []ApplicationAssociationSelector `json:"associations"`
}

type ApplicationAssociation 

type ApplicationAssociation struct {
	Id          string     `json:"id"`
	DisplayName string     `json:"displayName"`
	Version     string     `json:"version"`
	Kind        string     `json:"kind"`
	CreatedAt   *time.Time `json:"createdAt,omitempty"`
	UpdatedAt   *time.Time `json:"updatedAt,omitempty"`
}

type ApplicationAssociationListResponse 

type ApplicationAssociationListResponse struct {
	Count      int                      `json:"count"`
	List       []ApplicationAssociation `json:"list"`
	Pagination api.Pagination           `json:"pagination"`
}

type ApplicationAssociationSelector 

type ApplicationAssociationSelector struct {
	Id   string `json:"id"`
	Kind string `json:"kind"`
}

type ApplicationService 

type ApplicationService struct {
	// contains filtered or unexported fields
}

func NewApplicationService 

func NewApplicationService(
	appRepo repository.ApplicationRepository,
	projectRepo repository.ProjectRepository,
	orgRepo repository.OrganizationRepository,
	apiRepo repository.APIRepository,
	gatewayEventsService *GatewayEventsService,
	auditRepo repository.AuditRepository,
	identity *IdentityService,
	slogger *slog.Logger,
) *ApplicationService

func (*ApplicationService) AddApplicationAssociations 

func (s *ApplicationService) AddApplicationAssociations(appIDOrHandle string, req *AddApplicationAssociationsRequest, orgID string) (*ApplicationAssociationListResponse, error)

func (*ApplicationService) AddMappedAPIKeys 

func (s *ApplicationService) AddMappedAPIKeys(appIDOrHandle string, req *api.AddApplicationAPIKeysRequest, orgID, userID string) (*api.MappedAPIKeyListResponse, error)

func (*ApplicationService) CreateApplication 

func (s *ApplicationService) CreateApplication(req *api.CreateApplicationRequest, orgID, createdBy string) (*api.Application, error)

func (*ApplicationService) CreateApplicationFromWebhook 

func (s *ApplicationService) CreateApplicationFromWebhook(handle, name, description, appType, orgID string) (*api.Application, error)

CreateApplicationFromWebhook creates an application reconciled from a Developer Portal application.created/updated event. DP applications carry no project.

func (*ApplicationService) DeleteApplication 

func (s *ApplicationService) DeleteApplication(appIDOrHandle, orgID, actor string) error

func (*ApplicationService) GetApplicationByID 

func (s *ApplicationService) GetApplicationByID(appIDOrHandle, orgID string) (*api.Application, error)

func (*ApplicationService) GetApplicationsByOrganization 

func (s *ApplicationService) GetApplicationsByOrganization(orgID, projectHandle string, limit, offset int) (*api.ApplicationListResponse, error)

func (*ApplicationService) HandleExistsCheck 

func (s *ApplicationService) HandleExistsCheck(orgID string) func(string) bool

func (*ApplicationService) ListApplicationAssociations 

func (s *ApplicationService) ListApplicationAssociations(appIDOrHandle, orgID string, limit, offset int) (*ApplicationAssociationListResponse, error)

func (*ApplicationService) ListMappedAPIKeys 

func (s *ApplicationService) ListMappedAPIKeys(appIDOrHandle, orgID string, limit, offset int) (*api.MappedAPIKeyListResponse, error)

func (*ApplicationService) ListMappedAPIKeysForAssociation 

func (s *ApplicationService) ListMappedAPIKeysForAssociation(appIDOrHandle, associationIDOrHandle, orgID string, limit, offset int) (*api.MappedAPIKeyListResponse, error)

func (*ApplicationService) RemoveApplicationAssociation 

func (s *ApplicationService) RemoveApplicationAssociation(appIDOrHandle, associationIDOrHandle, orgID string) error

func (*ApplicationService) RemoveMappedAPIKey 

func (s *ApplicationService) RemoveMappedAPIKey(appIDOrHandle, keyID, entityID, orgID, userID string) error

func (*ApplicationService) SetAPIKeyApplication 

func (s *ApplicationService) SetAPIKeyApplication(keyName, artifactRef, kind, appIDOrHandle, orgID, userID string) error

SetAPIKeyApplication reconciles which application an API key belongs to, from a Developer Portal apikey.application_updated event. keyName + artifactRef (artifact UUID or handle) + kind identify the key; kind scopes the resolution to the artifact table backing that kind, so a handle shared across kinds resolves unambiguously. Because a Developer Portal key belongs to at most one application, this first removes the key from any application it is currently mapped to, then — when appIDOrHandle is non-empty — maps it to that application and broadcasts the change to the deployed gateways. A blank appIDOrHandle dissociates the key.

func (*ApplicationService) UpdateApplication 

func (s *ApplicationService) UpdateApplication(appIDOrHandle string, req *api.Application, orgID, userID string) (*api.Application, error)

type ArtifactImportService 

type ArtifactImportService struct {
	// contains filtered or unexported fields
}

ArtifactImportService resolves the correct importer for a pushed artifact and runs the shared pre/post processing (gateway auth, project resolution, deployment/status persistence).

func NewArtifactImportService 

func NewArtifactImportService(
	apiRepo repository.APIRepository,
	providerRepo repository.LLMProviderRepository,
	templateRepo repository.LLMProviderTemplateRepository,
	proxyRepo repository.LLMProxyRepository,
	mcpProxyRepo repository.MCPProxyRepository,
	artifactRepo repository.ArtifactRepository,
	deploymentRepo repository.DeploymentRepository,
	gatewayRepo repository.GatewayRepository,
	projectRepo repository.ProjectRepository,
	cfg *config.Server,
	slogger *slog.Logger,
	mcpServerInfo MCPServerInfoFetcher,
) *ArtifactImportService

NewArtifactImportService builds the import service and registers an importer for every supported artifact kind. Adding a new kind is a matter of registering a new importer here — no changes to the endpoint or orchestrator are required.

func (*ArtifactImportService) Import 

func (s *ArtifactImportService) Import(orgID, gatewayID string, req dto.ImportGatewayArtifactRequest) (*dto.ImportGatewayArtifactResponse, error)

Import is the entry point for the DP->CP push. It authenticates the gateway, resolves the importer by kind, resolves the project when required, delegates to the importer, and persists deployment/status for deployable kinds.

func (*ArtifactImportService) ImportArtifacts 

func (s *ArtifactImportService) ImportArtifacts(orgID, gatewayID string, reqs []dto.ImportGatewayArtifactRequest) *dto.ImportGatewayArtifactsResponse

ImportArtifacts imports a batch of gateway-pushed artifacts. It creates them in dependency order (see artifactImportOrder) and is continue-on-error: a failure to import one artifact is recorded against that artifact's dpid and does not abort the rest. The returned response maps each artifact's dpid to its per-artifact result (a non-empty Error marks a failure) alongside total/success/failed counts.

type DeploymentService 

type DeploymentService struct {
	// contains filtered or unexported fields
}

DeploymentService handles business logic for API deployment operations

func NewDeploymentService 

func NewDeploymentService(
	apiRepo repository.APIRepository,
	artifactRepo repository.ArtifactRepository,
	deploymentRepo repository.DeploymentRepository,
	gatewayRepo repository.GatewayRepository,
	orgRepo repository.OrganizationRepository,
	gatewayEventsService *GatewayEventsService,
	auditRepo repository.AuditRepository,
	apiUtil *utils.APIUtil,
	cfg *config.Server,
	slogger *slog.Logger,
) *DeploymentService

NewDeploymentService creates a new deployment service

func (*DeploymentService) DeleteDeployment 

func (s *DeploymentService) DeleteDeployment(apiUUID, deploymentID, orgUUID, actor string) error

DeleteDeployment permanently deletes an undeployed deployment artifact

func (*DeploymentService) DeleteDeploymentByHandle 

func (s *DeploymentService) DeleteDeploymentByHandle(apiHandle, deploymentID, orgUUID, actor string) error

DeleteDeploymentByHandle deletes a deployment using API handle

func (*DeploymentService) DeployAPI 

func (s *DeploymentService) DeployAPI(apiUUID string, req *api.DeployRequest, orgUUID, createdBy string) (*api.DeploymentResponse, error)

DeployAPI creates a new immutable deployment artifact and deploys it to a gateway

func (*DeploymentService) DeployAPIByHandle 

func (s *DeploymentService) DeployAPIByHandle(apiHandle string, req *api.DeployRequest, orgUUID, createdBy string) (*api.DeploymentResponse, error)

DeployAPIByHandle creates a new immutable deployment artifact using API handle

func (*DeploymentService) GetDeployment 

func (s *DeploymentService) GetDeployment(apiUUID, deploymentID, orgUUID string) (*api.DeploymentResponse, error)

GetDeployment retrieves a specific deployment by ID

func (*DeploymentService) GetDeploymentByHandle 

func (s *DeploymentService) GetDeploymentByHandle(apiHandle, deploymentID, orgUUID string) (*api.DeploymentResponse, error)

GetDeploymentByHandle retrieves a single deployment using API handle

func (*DeploymentService) GetDeploymentContent 

func (s *DeploymentService) GetDeploymentContent(apiUUID, deploymentID, orgUUID string) ([]byte, error)

GetDeploymentContent retrieves the immutable content of a deployment

func (*DeploymentService) GetDeploymentContentByHandle 

func (s *DeploymentService) GetDeploymentContentByHandle(apiHandle, deploymentID, orgUUID string) ([]byte, error)

GetDeploymentContentByHandle retrieves deployment artifact content using API handle

func (*DeploymentService) GetDeployments 

func (s *DeploymentService) GetDeployments(apiUUID, orgUUID string, gatewayID *string, status *string) (*api.DeploymentListResponse, error)

GetDeployments retrieves all deployments for an API with optional filters

func (*DeploymentService) GetDeploymentsByHandle 

func (s *DeploymentService) GetDeploymentsByHandle(apiHandle, gatewayID, status, orgUUID string) (*api.DeploymentListResponse, error)

GetDeploymentsByHandle retrieves deployments for an API using handle

func (*DeploymentService) HandleDeploymentAck 

func (s *DeploymentService) HandleDeploymentAck(gatewayID, orgID string, ack *model.DeploymentAckPayload) error

HandleDeploymentAck processes a deployment acknowledgement from the gateway. It validates the ack, checks the performed_at concurrency token, and transitions the deployment status accordingly.

func (*DeploymentService) RestoreDeployment 

func (s *DeploymentService) RestoreDeployment(apiUUID, deploymentID, gatewayID, orgUUID, actor string) (*api.DeploymentResponse, error)

RestoreDeployment restores a previous deployment (can be ARCHIVED or UNDEPLOYED)

func (*DeploymentService) RestoreDeploymentByHandle 

func (s *DeploymentService) RestoreDeploymentByHandle(apiHandle, deploymentID, gatewayHandle, orgUUID, actor string) (*api.DeploymentResponse, error)

RestoreDeploymentByHandle restores a previous deployment using API handle

func (*DeploymentService) UndeployDeployment 

func (s *DeploymentService) UndeployDeployment(apiUUID, deploymentID, gatewayID, orgUUID, actor string) (*api.DeploymentResponse, error)

UndeployDeployment undeploys an active deployment

func (*DeploymentService) UndeployDeploymentByHandle 

func (s *DeploymentService) UndeployDeploymentByHandle(apiHandle, deploymentID, gatewayHandle, orgUUID, actor string) (*api.DeploymentResponse, error)

UndeployDeploymentByHandle undeploys a deployment using the API handle and the gateway handle. Deploy/attach both identify the gateway by handle, so undeploy resolves the handle to the gateway UUID here to keep the contract consistent.

type DeploymentTimeoutConfig 

type DeploymentTimeoutConfig struct {
	Enabled  bool          // Whether the timeout job runs
	Interval time.Duration // How often the job runs (default: 1 minute)
	Timeout  time.Duration // How long before a transitional status is considered stale (default: 5 minutes)
}

DeploymentTimeoutConfig holds configuration for the timeout background job

type DeploymentTimeoutService 

type DeploymentTimeoutService struct {
	// contains filtered or unexported fields
}

DeploymentTimeoutService runs a background goroutine that marks stale DEPLOYING/UNDEPLOYING entries as either resolved or failed based on config.

func NewDeploymentTimeoutService 

func NewDeploymentTimeoutService(
	deploymentRepo repository.DeploymentRepository,
	config DeploymentTimeoutConfig,
	slogger *slog.Logger,
) *DeploymentTimeoutService

NewDeploymentTimeoutService creates a new timeout service

func (*DeploymentTimeoutService) Start 

func (s *DeploymentTimeoutService) Start(ctx context.Context)

Start begins the background timeout job. It blocks until ctx is cancelled.

type EventDispatcher 

type EventDispatcher struct {
	// contains filtered or unexported fields
}

EventDispatcher bridges the EventHub to WebSocket delivery. It maintains exactly one EventHub subscription per gateway per platform-api instance, regardless of how many WebSocket connections that gateway has to this instance. This enables HA: any replica can publish an event; only the replica holding the WebSocket connection will actually deliver it.

Connection lifecycle is derived directly from the Manager's connection map (the authoritative source of truth) rather than a local ref-count. A local counter can desync when deliver() calls manager.Unregister() for a failed send while the deliver loop is still iterating: an onDisconnect for an old connection fires after a new connection (and new subscription) has already been established, decrementing the counter for the wrong lifecycle and tearing down the live goroutine.

func NewEventDispatcher 

func NewEventDispatcher(hub eventhub.EventHub, manager *ws.Manager, logger *slog.Logger) *EventDispatcher

NewEventDispatcher creates an EventDispatcher backed by the given EventHub.

func (*EventDispatcher) OnGatewayConnected 

func (d *EventDispatcher) OnGatewayConnected(gatewayID string) error

OnGatewayConnected is called whenever a WebSocket connection for gatewayID is registered on this instance. On the first connection it subscribes to the EventHub and starts a dispatch goroutine. Subsequent connections for the same gateway return immediately — deliver() fans out to all connections returned by manager.GetConnections(), so a single subscription covers every replica of the gateway on this platform-api instance.

func (*EventDispatcher) OnGatewayDisconnected 

func (d *EventDispatcher) OnGatewayDisconnected(gatewayID string) error

OnGatewayDisconnected is called whenever a WebSocket connection for gatewayID is removed from this instance. It consults the Manager's live connection map: if connections remain the subscription is kept alive; only when the Manager reports zero connections for this gateway is the EventHub subscription torn down.

Using the Manager as the source of truth prevents the desync that a local ref-count introduces: a stale onDisconnect (from a connection removed during a previous deliver loop iteration) can fire after a new connection has already been established, and would incorrectly tear down the fresh subscription if counted locally.

func (*EventDispatcher) Shutdown 

func (d *EventDispatcher) Shutdown()

Shutdown stops all dispatch goroutines and releases resources. Call during graceful shutdown.

type GatewayArtifactImporter 

type GatewayArtifactImporter interface {
	// Kind returns the artifact kind string this importer handles (see constants).
	Kind() string
	// RequiresProject reports whether metadata.project must be present and resolvable.
	RequiresProject() bool
	// Import creates or updates the artifact and returns the persisted result.
	Import(ctx *ImportContext) (*ImportResult, error)
}

GatewayArtifactImporter is the contract every artifact kind implements so the DP->CP import flow stays generic and open to new kinds.

type GatewayEventsService 

type GatewayEventsService struct {
	// contains filtered or unexported fields
}

GatewayEventsService handles broadcasting events to connected gateways via EventHub. Publishing to the EventHub persists the event to the shared DB so any platform-api replica can pick it up and deliver it to the gateway WebSocket it holds.

func NewGatewayEventsService 

func NewGatewayEventsService(hub eventhub.EventHub, identity *IdentityService, slogger *slog.Logger) *GatewayEventsService

NewGatewayEventsService creates a new gateway events service backed by the EventHub.

func (*GatewayEventsService) BroadcastAPIDeletionEvent 

func (s *GatewayEventsService) BroadcastAPIDeletionEvent(gatewayID string, deletion *model.APIDeletionEvent) error

BroadcastAPIDeletionEvent sends an API deletion event to target gateway.

func (*GatewayEventsService) BroadcastAPIKeyCreatedEvent 

func (s *GatewayEventsService) BroadcastAPIKeyCreatedEvent(gatewayID, userId string, event *model.APIKeyCreatedEvent) error

BroadcastAPIKeyCreatedEvent sends an API key created event to target gateway.

func (*GatewayEventsService) BroadcastAPIKeyRevokedEvent 

func (s *GatewayEventsService) BroadcastAPIKeyRevokedEvent(gatewayID, userId string, event *model.APIKeyRevokedEvent) error

BroadcastAPIKeyRevokedEvent sends an API key revoked event to target gateway.

func (*GatewayEventsService) BroadcastAPIKeyUpdatedEvent 

func (s *GatewayEventsService) BroadcastAPIKeyUpdatedEvent(gatewayID, userId string, event *model.APIKeyUpdatedEvent) error

BroadcastAPIKeyUpdatedEvent sends an API key updated event to target gateway.

func (*GatewayEventsService) BroadcastApplicationUpdatedEvent 

func (s *GatewayEventsService) BroadcastApplicationUpdatedEvent(gatewayID, userId string, event *model.ApplicationUpdatedEvent) error

BroadcastApplicationUpdatedEvent sends an application updated event to target gateway.

func (*GatewayEventsService) BroadcastDeploymentEvent 

func (s *GatewayEventsService) BroadcastDeploymentEvent(gatewayID string, deployment *model.DeploymentEvent) error

BroadcastDeploymentEvent sends an API deployment event to target gateway.

func (*GatewayEventsService) BroadcastLLMProviderDeletionEvent 

func (s *GatewayEventsService) BroadcastLLMProviderDeletionEvent(gatewayID string, deletion *model.LLMProviderDeletionEvent) error

BroadcastLLMProviderDeletionEvent sends an LLM provider deletion event to target gateway.

func (*GatewayEventsService) BroadcastLLMProviderDeploymentEvent 

func (s *GatewayEventsService) BroadcastLLMProviderDeploymentEvent(gatewayID string, deployment *model.LLMProviderDeploymentEvent) error

BroadcastLLMProviderDeploymentEvent sends an LLM provider deployment event to target gateway.

func (*GatewayEventsService) BroadcastLLMProviderUndeploymentEvent 

func (s *GatewayEventsService) BroadcastLLMProviderUndeploymentEvent(gatewayID string, undeployment *model.LLMProviderUndeploymentEvent) error

BroadcastLLMProviderUndeploymentEvent sends an LLM provider undeployment event to target gateway.

func (*GatewayEventsService) BroadcastLLMProxyDeletionEvent 

func (s *GatewayEventsService) BroadcastLLMProxyDeletionEvent(gatewayID string, deletion *model.LLMProxyDeletionEvent) error

BroadcastLLMProxyDeletionEvent sends an LLM proxy deletion event to target gateway.

func (*GatewayEventsService) BroadcastLLMProxyDeploymentEvent 

func (s *GatewayEventsService) BroadcastLLMProxyDeploymentEvent(gatewayID string, deployment *model.LLMProxyDeploymentEvent) error

BroadcastLLMProxyDeploymentEvent sends an LLM proxy deployment event to target gateway.

func (*GatewayEventsService) BroadcastLLMProxyUndeploymentEvent 

func (s *GatewayEventsService) BroadcastLLMProxyUndeploymentEvent(gatewayID string, undeployment *model.LLMProxyUndeploymentEvent) error

BroadcastLLMProxyUndeploymentEvent sends an LLM proxy undeployment event to target gateway.

func (*GatewayEventsService) BroadcastMCPProxyDeletionEvent 

func (s *GatewayEventsService) BroadcastMCPProxyDeletionEvent(gatewayID string, deletion *model.MCPProxyDeletionEvent) error

BroadcastMCPProxyDeletionEvent sends an MCP proxy deletion event to target gateway.

func (*GatewayEventsService) BroadcastMCPProxyDeploymentEvent 

func (s *GatewayEventsService) BroadcastMCPProxyDeploymentEvent(gatewayID string, deployment *model.MCPProxyDeploymentEvent) error

BroadcastMCPProxyDeploymentEvent sends an MCP proxy deployment event to target gateway.

func (*GatewayEventsService) BroadcastMCPProxyUndeploymentEvent 

func (s *GatewayEventsService) BroadcastMCPProxyUndeploymentEvent(gatewayID string, undeployment *model.MCPProxyUndeploymentEvent) error

BroadcastMCPProxyUndeploymentEvent sends an MCP proxy undeployment event to target gateway.

func (*GatewayEventsService) BroadcastSubscriptionCreatedEvent 

func (s *GatewayEventsService) BroadcastSubscriptionCreatedEvent(gatewayID string, event *model.SubscriptionCreatedEvent) error

BroadcastSubscriptionCreatedEvent sends a subscription.created event to the target gateway.

func (*GatewayEventsService) BroadcastSubscriptionDeletedEvent 

func (s *GatewayEventsService) BroadcastSubscriptionDeletedEvent(gatewayID string, event *model.SubscriptionDeletedEvent) error

BroadcastSubscriptionDeletedEvent sends a subscription.deleted event to the target gateway.

func (*GatewayEventsService) BroadcastSubscriptionPlanCreatedEvent 

func (s *GatewayEventsService) BroadcastSubscriptionPlanCreatedEvent(gatewayID string, event *model.SubscriptionPlanCreatedEvent) error

BroadcastSubscriptionPlanCreatedEvent sends a subscriptionPlan.created event to the target gateway.

func (*GatewayEventsService) BroadcastSubscriptionPlanDeletedEvent 

func (s *GatewayEventsService) BroadcastSubscriptionPlanDeletedEvent(gatewayID string, event *model.SubscriptionPlanDeletedEvent) error

BroadcastSubscriptionPlanDeletedEvent sends a subscriptionPlan.deleted event to the target gateway.

func (*GatewayEventsService) BroadcastSubscriptionPlanUpdatedEvent 

func (s *GatewayEventsService) BroadcastSubscriptionPlanUpdatedEvent(gatewayID string, event *model.SubscriptionPlanUpdatedEvent) error

BroadcastSubscriptionPlanUpdatedEvent sends a subscriptionPlan.updated event to the target gateway.

func (*GatewayEventsService) BroadcastSubscriptionUpdatedEvent 

func (s *GatewayEventsService) BroadcastSubscriptionUpdatedEvent(gatewayID string, event *model.SubscriptionUpdatedEvent) error

BroadcastSubscriptionUpdatedEvent sends a subscription.updated event to the target gateway.

func (*GatewayEventsService) BroadcastUndeploymentEvent 

func (s *GatewayEventsService) BroadcastUndeploymentEvent(gatewayID string, undeployment *model.APIUndeploymentEvent) error

BroadcastUndeploymentEvent sends an API undeployment event to target gateway.

func (*GatewayEventsService) BroadcastWebBrokerAPIDeletionEvent 

func (s *GatewayEventsService) BroadcastWebBrokerAPIDeletionEvent(gatewayID string, deletion *model.WebBrokerAPIDeletionEvent) error

BroadcastWebBrokerAPIDeletionEvent sends a WebBroker API deletion event to target gateway.

func (*GatewayEventsService) BroadcastWebBrokerAPIDeploymentEvent 

func (s *GatewayEventsService) BroadcastWebBrokerAPIDeploymentEvent(gatewayID string, deployment *model.WebBrokerAPIDeploymentEvent) error

BroadcastWebBrokerAPIDeploymentEvent sends a WebBroker API deployment event to target gateway.

func (*GatewayEventsService) BroadcastWebBrokerAPIUndeploymentEvent 

func (s *GatewayEventsService) BroadcastWebBrokerAPIUndeploymentEvent(gatewayID string, undeployment *model.WebBrokerAPIUndeploymentEvent) error

BroadcastWebBrokerAPIUndeploymentEvent sends a WebBroker API undeployment event to target gateway.

func (*GatewayEventsService) BroadcastWebSubAPIDeletionEvent 

func (s *GatewayEventsService) BroadcastWebSubAPIDeletionEvent(gatewayID string, deletion *model.WebSubAPIDeletionEvent) error

BroadcastWebSubAPIDeletionEvent sends a WebSub API deletion event to target gateway.

func (*GatewayEventsService) BroadcastWebSubAPIDeploymentEvent 

func (s *GatewayEventsService) BroadcastWebSubAPIDeploymentEvent(gatewayID string, deployment *model.WebSubAPIDeploymentEvent) error

BroadcastWebSubAPIDeploymentEvent sends a WebSub API deployment event to target gateway.

func (*GatewayEventsService) BroadcastWebSubAPIHmacSecretEvent 

func (s *GatewayEventsService) BroadcastWebSubAPIHmacSecretEvent(gatewayID, action string, event *model.WebSubAPIHmacSecretEvent) error

BroadcastWebSubAPIHmacSecretEvent sends a WebSub API HMAC secret lifecycle event to target gateway. action should be "CREATED", "UPDATED", or "DELETED".

func (*GatewayEventsService) BroadcastWebSubAPIUndeploymentEvent 

func (s *GatewayEventsService) BroadcastWebSubAPIUndeploymentEvent(gatewayID string, undeployment *model.WebSubAPIUndeploymentEvent) error

BroadcastWebSubAPIUndeploymentEvent sends a WebSub API undeployment event to target gateway.

type GatewayInternalAPIService 

type GatewayInternalAPIService struct {
	// contains filtered or unexported fields
}

GatewayInternalAPIService handles internal gateway API operations

func NewGatewayInternalAPIService 

func NewGatewayInternalAPIService(apiRepo repository.APIRepository, subscriptionRepo repository.SubscriptionRepository,
	subscriptionPlanRepo repository.SubscriptionPlanRepository, providerRepo repository.LLMProviderRepository,
	proxyRepo repository.LLMProxyRepository, mcpProxyRepo repository.MCPProxyRepository,
	deploymentRepo repository.DeploymentRepository, gatewayRepo repository.GatewayRepository,
	orgRepo repository.OrganizationRepository, projectRepo repository.ProjectRepository, apiKeyRepo repository.APIKeyRepository,
	artifactRepo repository.ArtifactRepository, secretRepo repository.SecretRepository, cfg *config.Server, slogger *slog.Logger) *GatewayInternalAPIService

NewGatewayInternalAPIService creates a new gateway internal API service. websubAPIRepo and webbrokerAPIRepo are nil in OSS builds and injected by the event-gateway plugin in experimental builds via SetEventArtifactRepos.

func (*GatewayInternalAPIService) CheckArtifactsExist 

func (s *GatewayInternalAPIService) CheckArtifactsExist(orgID string, artifactIDs []string) ([]string, error)

CheckArtifactsExist returns the subset of provided artifact UUIDs that still exist on the platform. Used by the gateway during sync to distinguish orphaned artifacts (deleted on platform) from artifacts that exist but have no active deployment.

func (*GatewayInternalAPIService) GetAPIByUUID 

func (s *GatewayInternalAPIService) GetAPIByUUID(apiId, orgId string) (map[string]string, error)

GetAPIByUUID retrieves an API by its ID

func (*GatewayInternalAPIService) GetAPIKeysByKind 

func (s *GatewayInternalAPIService) GetAPIKeysByKind(gatewayID, orgID, kind, issuer string) ([]model.InternalAPIKeyItem, error)

GetAPIKeysByKind returns all API keys for artifacts of the given kind associated with the gateway via deployment_status (DEPLOYED or UNDEPLOYED). When issuer is non-empty only keys whose issuer matches are returned. Each item carries a stable correlationId derived from (artifactUuid, name, updatedAt). source is always "external" and externalRefId is always null.

func (*GatewayInternalAPIService) GetActiveDeploymentByGateway 

func (s *GatewayInternalAPIService) GetActiveDeploymentByGateway(apiID, orgID, gatewayID string) (map[string]string, error)

GetActiveDeploymentByGateway retrieves the currently deployed API artifact for a specific gateway

func (*GatewayInternalAPIService) GetActiveLLMProviderDeploymentByGateway 

func (s *GatewayInternalAPIService) GetActiveLLMProviderDeploymentByGateway(providerID, orgID, gatewayID string) (map[string]string, error)

GetActiveLLMProviderDeploymentByGateway retrieves the currently deployed LLM provider artifact for a specific gateway

func (*GatewayInternalAPIService) GetActiveLLMProxyDeploymentByGateway 

func (s *GatewayInternalAPIService) GetActiveLLMProxyDeploymentByGateway(proxyID, orgID, gatewayID string) (map[string]string, error)

GetActiveLLMProxyDeploymentByGateway retrieves the currently deployed LLM proxy artifact for a specific gateway

func (*GatewayInternalAPIService) GetActiveMCPProxyDeploymentByGateway 

func (s *GatewayInternalAPIService) GetActiveMCPProxyDeploymentByGateway(proxyID, orgID, gatewayID string) (map[string]string, error)

GetActiveMCPProxyDeploymentByGateway retrieves the currently deployed MCP proxy artifact for a specific gateway

func (*GatewayInternalAPIService) GetActiveWebBrokerAPIDeploymentByGateway 

func (s *GatewayInternalAPIService) GetActiveWebBrokerAPIDeploymentByGateway(apiID, orgID, gatewayID string) (map[string]string, error)

GetActiveWebBrokerAPIDeploymentByGateway retrieves the currently deployed WebBroker API artifact for a specific gateway

func (*GatewayInternalAPIService) GetActiveWebSubAPIDeploymentByGateway 

func (s *GatewayInternalAPIService) GetActiveWebSubAPIDeploymentByGateway(apiID, orgID, gatewayID string) (map[string]string, error)

GetActiveWebSubAPIDeploymentByGateway retrieves the currently deployed WebSub API artifact for a specific gateway

func (*GatewayInternalAPIService) GetDeploymentContentBatch 

func (s *GatewayInternalAPIService) GetDeploymentContentBatch(orgID, gatewayID string, deploymentIDs []string) (map[string]*model.DeploymentContent, error)

GetDeploymentContentBatch retrieves deployment content for multiple deployment IDs Returns a map of deploymentID -> DeploymentContent (artifact ID + YAML bytes)

func (*GatewayInternalAPIService) GetDeploymentsByGateway 

func (s *GatewayInternalAPIService) GetDeploymentsByGateway(orgID, gatewayID string, since *time.Time) (*dto.GatewayDeploymentsResponse, error)

GetDeploymentsByGateway retrieves all deployments for a specific gateway Used to compare local gateway state with platform-api state If since is provided, only returns deployments updated after that timestamp

func (*GatewayInternalAPIService) GetSecretsByGateway 

func (s *GatewayInternalAPIService) GetSecretsByGateway(orgID, gatewayID string, updatedAfter *time.Time) ([]*model.Secret, error)

GetSecretsByGateway returns secrets referenced by artifacts deployed on this gateway. Handles are sourced from artifact_secret_refs (gateway_id rows, maintained at deploy time) so no config blob JOIN or application-level regex is needed here. If updatedAfter is set, only secrets updated after that time are included.

func (*GatewayInternalAPIService) IsAPIDeployedOnGateway 

func (s *GatewayInternalAPIService) IsAPIDeployedOnGateway(apiID, gatewayID, orgID string) error

IsAPIDeployedOnGateway returns nil if the API has an active deployment_status row on the gateway (DEPLOYED or UNDEPLOYED), ErrAPINotFound if the API does not exist, or ErrDeploymentNotActive if no active deployment_status exists for the API+gateway.

func (*GatewayInternalAPIService) IsSecretDeployedOnGateway 

func (s *GatewayInternalAPIService) IsSecretDeployedOnGateway(orgID, gatewayID, handle string) (bool, error)

IsSecretDeployedOnGateway reports whether a secret handle is referenced by any artifact currently deployed on the given gateway.

func (*GatewayInternalAPIService) ListSubscriptionPlansForOrg 

func (s *GatewayInternalAPIService) ListSubscriptionPlansForOrg(orgID string) ([]dto.GatewaySubscriptionPlanInfo, error)

ListSubscriptionPlansForOrg lists all subscription plans for an organization.

func (*GatewayInternalAPIService) ListSubscriptionsForAPI 

func (s *GatewayInternalAPIService) ListSubscriptionsForAPI(apiID, orgID string) ([]dto.GatewaySubscriptionInfo, error)

ListSubscriptionsForAPI lists subscriptions for a given API within an organization.

func (*GatewayInternalAPIService) SetEventArtifactRepos 

func (s *GatewayInternalAPIService) SetEventArtifactRepos(
	websubRepo repository.WebSubAPIRepository,
	webbrokerRepo repository.WebBrokerAPIRepository,
)

SetEventArtifactRepos injects the WebSub/WebBroker repositories after construction. Called by the server when the event-gateway plugin is loaded (experimental builds).

type GatewayPolicyDefinition 

type GatewayPolicyDefinition struct {
	Name             string                 `json:"name"`
	Version          string                 `json:"version"`
	DisplayName      string                 `json:"displayName,omitempty"`
	Description      *string                `json:"description,omitempty"`
	ManagedBy        string                 `json:"managedBy"`
	PolicyDefinition map[string]interface{} `json:"policyDefinition,omitempty"`
}

GatewayPolicyDefinition is the cleaned policy data stored in memory and returned to APIM. PolicyDefinition holds the full policy schema (parameters + systemParameters) as received from the gateway controller.

type GatewayPolicyInput 

type GatewayPolicyInput struct {
	Name             string                 `json:"name"`
	Version          string                 `json:"version"`
	DisplayName      string                 `json:"displayName,omitempty"`
	Description      *string                `json:"description,omitempty"`
	Parameters       map[string]interface{} `json:"parameters,omitempty"`
	SystemParameters map[string]interface{} `json:"systemParameters,omitempty"`
	ManagedBy        string                 `json:"managedBy"`
}

GatewayPolicyInput is the raw policy data received from the gateway controller. ManagedBy is used only for filtering and is not stored or returned.

type GatewayService 

type GatewayService struct {
	// contains filtered or unexported fields
}

GatewayService handles gateway business logic

func NewGatewayService 

func NewGatewayService(gatewayRepo repository.GatewayRepository, orgRepo repository.OrganizationRepository,
	apiRepo repository.APIRepository, customPolicyRepo repository.CustomPolicyRepository,
	gatewayEventsService *GatewayEventsService, slogger *slog.Logger,
	enableVersionVerification bool, enableFunctionalityTypeVerification bool,
	auditRepo repository.AuditRepository, identity *IdentityService) *GatewayService

NewGatewayService creates a new gateway service

func (*GatewayService) DeleteCustomPolicyByUUID 

func (s *GatewayService) DeleteCustomPolicyByUUID(orgID, policyUUID, version string) error

DeleteCustomPolicyByUUID deletes a custom policy by UUID, verifying org ownership, version, and no active usages.

func (*GatewayService) DeleteGateway 

func (s *GatewayService) DeleteGateway(gatewayID, orgID, deletedBy string) error

DeleteGateway deletes a gateway and all associated tokens (CASCADE)

func (*GatewayService) GetCustomPolicyByUUID 

func (s *GatewayService) GetCustomPolicyByUUID(orgID, policyUUID, version string) (*model.CustomPolicy, error)

GetCustomPolicyByUUID returns a custom policy by UUID, verifying org ownership and version.

func (*GatewayService) GetGateway 

func (s *GatewayService) GetGateway(gatewayId, orgId string) (*api.GatewayResponse, error)

GetGateway retrieves a gateway by ID

func (*GatewayService) GetGatewayStatus 

func (s *GatewayService) GetGatewayStatus(orgID string, gatewayId *string) (*api.GatewayStatusListResponse, error)

GetGatewayStatus retrieves gateway status information for polling

func (*GatewayService) GetStoredManifest 

func (s *GatewayService) GetStoredManifest(gatewayID, orgID string) (*Manifest, error)

GetStoredManifest returns the latest gateway manifest. Called by APIM to retrieve the manifest that was pushed by the gateway controller on connect.

func (*GatewayService) ListCustomPolicies 

func (s *GatewayService) ListCustomPolicies(orgID string) ([]*model.CustomPolicy, error)

ListCustomPolicies returns all custom policies synced for the given organization.

func (*GatewayService) ListGateways 

func (s *GatewayService) ListGateways(orgID *string) (*api.GatewayListResponse, error)

ListGateways retrieves all gateways with constitution-compliant envelope structure

func (*GatewayService) ListTokens 

func (s *GatewayService) ListTokens(gatewayId, orgId string) ([]api.TokenInfoResponse, error)

ListTokens retrieves all active tokens for a gateway

func (*GatewayService) ReceiveGatewayManifest 

func (s *GatewayService) ReceiveGatewayManifest(orgID, gatewayID, gatewayVersion, functionalityType string, policies []GatewayPolicyInput) error

ReceiveGatewayManifest stores the manifest posted by the gateway controller on connect. All policies are stored with name and version; customer-managed policies include policy_definition. gatewayVersion is the controller's reported build version; an empty string means the controller is on a legacy build (pre-1.1.0) that does not send a version — assumed to be "1.0.0". functionalityType is the controller's flavor ("regular", "event", ...); empty is treated as "regular". The reported major.minor and functionality type must match the registered values, otherwise the manifest is rejected.

func (*GatewayService) RegisterGateway 

func (s *GatewayService) RegisterGateway(orgID string, id *string, displayName, description string, endpoints []string, isCritical bool,
	functionalityType, version, createdBy string, properties map[string]interface{}) (*api.GatewayResponse, error)

RegisterGateway registers a new gateway with organization validation

func (*GatewayService) RevokeToken 

func (s *GatewayService) RevokeToken(gatewayId, tokenId, orgId, revokedBy string) error

RevokeToken revokes a specific token for a gateway

func (*GatewayService) RotateToken 

func (s *GatewayService) RotateToken(gatewayId, orgId, createdBy string) (*api.TokenRotationResponse, error)

RotateToken generates a new token for a gateway (max 2 active tokens)

func (*GatewayService) SyncCustomPolicy 

func (s *GatewayService) SyncCustomPolicy(gatewayID, orgID, policyName, version string) (*model.CustomPolicy, error)

SyncCustomPolicy upserts a custom policy from the gateway manifest into the gateway_custom_policies table. The gateway must belong to the caller's organization. The policy must exist in the manifest and it should be a custom policy.

func (*GatewayService) UpdateGateway 

func (s *GatewayService) UpdateGateway(gatewayId, orgId, updatedBy string, req *api.GatewayResponse) (*api.GatewayResponse, error)

UpdateGateway updates gateway details

func (*GatewayService) UpdateGatewayActiveStatus 

func (s *GatewayService) UpdateGatewayActiveStatus(gatewayId string, isActive bool) error

UpdateGatewayActiveStatus updates the active status of a gateway

func (*GatewayService) VerifyToken 

func (s *GatewayService) VerifyToken(plainToken string) (*model.Gateway, error)

VerifyToken verifies a plain-text token and returns the associated gateway

type IdentityService 

type IdentityService struct {
	// contains filtered or unexported fields
}

IdentityService resolves the internal platform UUID for the actor behind a request, translating the identity-provider's resolved actor identifier (the OIDC "sub" claim, falling back to the configured claim / user_id via middleware.GetActorIdentityFromRequest) into our own stable UUID. This UUID is what gets stored in audit columns (created_by/updated_by/revoked_by/performed_by).

The internal UUID never leaves the process: API responses and external/data-plane consumers (e.g. gateway events) must resolve it back to the raw identity via SubForUUID / SubsForUUIDs before it is emitted — falling back to constants.DeletedUser when the UUID has no mapping.

func NewIdentityService 

func NewIdentityService(repo repository.UserIdentityMappingRepository) *IdentityService

NewIdentityService creates a new IdentityService.

func (*IdentityService) InternalUserID 

func (s *IdentityService) InternalUserID(r *http.Request) (string, error)

InternalUserID resolves the internal platform UUID for the actor making the given request, preferring the token's "sub" claim and falling back through the configured claim / user_id. When the request carries no resolvable identity, a fresh standalone UUID is minted so the write never fails; no mapping row is created for it, so it reads back as constants.DeletedUser (see SubForUUID) — it can never be confused with a real user.

func (*IdentityService) ResolveIdentityField 

func (s *IdentityService) ResolveIdentityField(field **string) error

ResolveIdentityField replaces the UUID held in *field (a generated API response's createdBy/updatedBy/revokedBy/performedBy pointer, which holds our internal UUID immediately after a model→API mapper runs) with the raw external identity, in place. No-op if field is nil or points to nil/empty.

This is the single place a detail response's audit-identity field is unwrapped before being returned to the caller — see ResolveIdentityFields for the batch/list equivalent.

func (*IdentityService) ResolveIdentityFields 

func (s *IdentityService) ResolveIdentityFields(fields []**string) error

ResolveIdentityFields batch-resolves multiple createdBy/updatedBy-style pointer fields (e.g. across every record in a list response) in a single lookup, avoiding N+1 queries. Each entry is a pointer to a *string field (e.g. &resp.CreatedBy); nil entries, and fields that are nil or empty, are skipped.

func (*IdentityService) SubForUUID 

func (s *IdentityService) SubForUUID(uuid string) (string, error)

SubForUUID resolves an internal UUID stored in an audit column back to the raw identity that should be shown to external consumers (API responses, gateway events), or constants.DeletedUser if uuid has no mapping (an anonymous write, or a user whose mapping was removed).

func (*IdentityService) SubsForUUIDs 

func (s *IdentityService) SubsForUUIDs(uuids []string) (map[string]string, error)

SubsForUUIDs batch-resolves multiple UUIDs (e.g. across a list response) to their raw identity in a single lookup, avoiding N+1 queries. Every non-empty input UUID is present in the result, resolving to constants.DeletedUser if it has no mapping.

func (*IdentityService) ToInternalUUID 

func (s *IdentityService) ToInternalUUID(identity string) (string, error)

ToInternalUUID maps a raw resolved actor identity (or header-supplied actor id) to our internal platform UUID, creating the mapping on first use. An empty identity returns an empty string and creates no row — see InternalUserID for the anonymous-write path, which never fails.

type ImportContext 

type ImportContext struct {
	OrgID     string
	GatewayID string
	// MetadataMode is the last-in-wins decision for this push, computed by the
	// orchestrator for artifact-backed kinds from the existing working copy's
	// deployment time vs this push's DeployedAt. Org-level kinds not backed by the
	// artifacts table (LLM Provider Templates) compute their own decision in the
	// importer using DeployedAt.
	MetadataMode utils.MetadataWriteMode

	// ID is the control-plane artifact UUID: reused when the artifact already exists
	// (matched by handle), otherwise freshly generated by the orchestrator. It is NOT
	// the data-plane UUID — the CP owns its own identifier.
	ID string
	// DPID is the data-plane (gateway) artifact UUID as pushed. It is informational
	// (logging/traceability) and is never used as the CP artifact UUID.
	DPID          string
	Configuration dto.ArtifactImportConfig
	Status        string // deployed|pending|failed|undeployed (as pushed)
	CreatedAt     time.Time
	UpdatedAt     time.Time
	DeployedAt    *time.Time
	Properties    map[string]interface{}

	ProjectName string // metadata.project (may be empty)
	ProjectID   string // resolved project UUID (empty for org-level kinds)

	// Existing is the already-stored artifacts-table row keyed by ID, or nil if new.
	// It is nil for organization-level kinds that are not backed by the artifacts
	// table (e.g. LLM Provider Templates); those importers resolve existence themselves.
	Existing *model.Artifact
}

ImportContext carries everything a per-kind importer needs to create or update an artifact pushed from a data-plane gateway.

type ImportResult 

type ImportResult struct {
	ID              string
	DeployedVersion string
	// Deployable indicates the artifact has a per-gateway deployment lifecycle and
	// therefore a deployment record + status row should be written by the orchestrator.
	Deployable bool
}

ImportResult is returned by an importer describing the persisted artifact.

type LLMProviderAPIKeyService 

type LLMProviderAPIKeyService struct {
	// contains filtered or unexported fields
}

LLMProviderAPIKeyService handles API key management for LLM providers

func NewLLMProviderAPIKeyService 

func NewLLMProviderAPIKeyService(
	llmProviderRepo repository.LLMProviderRepository,
	gatewayRepo repository.GatewayRepository,
	apiKeyRepo repository.APIKeyRepository,
	gatewayEventsService *GatewayEventsService,
	identity *IdentityService,
	slogger *slog.Logger,
) *LLMProviderAPIKeyService

NewLLMProviderAPIKeyService creates a new LLM provider API key service instance

func (*LLMProviderAPIKeyService) CreateLLMProviderAPIKey 

func (s *LLMProviderAPIKeyService) CreateLLMProviderAPIKey(
	ctx context.Context,
	providerID, orgID, userID string,
	req *api.CreateLLMProviderAPIKeyRequest,
) (*api.CreateLLMProviderAPIKeyResponse, error)

CreateLLMProviderAPIKey generates an API key for an LLM provider and broadcasts it to all gateways.

func (*LLMProviderAPIKeyService) DeleteLLMProviderAPIKey 

func (s *LLMProviderAPIKeyService) DeleteLLMProviderAPIKey(
	ctx context.Context,
	providerID, orgID, userID, keyName string,
) error

DeleteLLMProviderAPIKey deletes the API key from the database and broadcasts a revoke event to gateways.

func (*LLMProviderAPIKeyService) ListLLMProviderAPIKeys 

func (s *LLMProviderAPIKeyService) ListLLMProviderAPIKeys(
	ctx context.Context,
	providerID, orgID, userID string,
) (*api.LLMProviderAPIKeyListResponse, error)

ListLLMProviderAPIKeys returns API keys for an LLM provider, filtered to those created by userID.

type LLMProviderDeploymentService 

type LLMProviderDeploymentService struct {
	// contains filtered or unexported fields
}

LLMProviderDeploymentService handles business logic for LLM provider deployment operations using the shared deployments table and status model.

func NewLLMProviderDeploymentService 

func NewLLMProviderDeploymentService(
	providerRepo repository.LLMProviderRepository,
	templateRepo repository.LLMProviderTemplateRepository,
	deploymentRepo repository.DeploymentRepository,
	gatewayRepo repository.GatewayRepository,
	orgRepo repository.OrganizationRepository,
	gatewayEventsService *GatewayEventsService,
	cfg *config.Server,
	slogger *slog.Logger,
) *LLMProviderDeploymentService

NewLLMProviderDeploymentService creates a new LLM provider deployment service

func (*LLMProviderDeploymentService) DeleteLLMProviderDeployment 

func (s *LLMProviderDeploymentService) DeleteLLMProviderDeployment(providerID, deploymentID, orgUUID string) error

DeleteLLMProviderDeployment permanently deletes an undeployed deployment artifact

func (*LLMProviderDeploymentService) DeployLLMProvider 

func (s *LLMProviderDeploymentService) DeployLLMProvider(providerID string, req *api.DeployRequest, orgUUID string) (*api.DeploymentResponse, error)

DeployLLMProvider creates a new immutable deployment artifact and deploys it to a gateway

func (*LLMProviderDeploymentService) GetLLMProviderDeployment 

func (s *LLMProviderDeploymentService) GetLLMProviderDeployment(providerID, deploymentID, orgUUID string) (*api.DeploymentResponse, error)

GetLLMProviderDeployment retrieves a specific deployment by ID

func (*LLMProviderDeploymentService) GetLLMProviderDeployments 

func (s *LLMProviderDeploymentService) GetLLMProviderDeployments(providerID, orgUUID string, gatewayID *string, status *string) (*api.DeploymentListResponse, error)

GetLLMProviderDeployments retrieves all deployments for a provider with optional filters

func (*LLMProviderDeploymentService) RestoreLLMProviderDeployment 

func (s *LLMProviderDeploymentService) RestoreLLMProviderDeployment(providerID, deploymentID, gatewayID, orgUUID string) (*api.DeploymentResponse, error)

RestoreLLMProviderDeployment restores a previous deployment (ARCHIVED or UNDEPLOYED)

func (*LLMProviderDeploymentService) UndeployLLMProviderDeployment 

func (s *LLMProviderDeploymentService) UndeployLLMProviderDeployment(providerID, deploymentID, gatewayID, orgUUID string) (*api.DeploymentResponse, error)

UndeployLLMProviderDeployment undeploys an active deployment

type LLMProviderService 

type LLMProviderService struct {
	// contains filtered or unexported fields
}

func NewLLMProviderService 

func NewLLMProviderService(
	repo repository.LLMProviderRepository,
	templateRepo repository.LLMProviderTemplateRepository,
	orgRepo repository.OrganizationRepository,
	templateSeeder *LLMTemplateSeeder,
	deploymentRepo repository.DeploymentRepository,
	gatewayRepo repository.GatewayRepository,
	gatewayEventsService *GatewayEventsService,
	slogger *slog.Logger,
	auditRepo repository.AuditRepository,
	cfg *config.Server,
	identity *IdentityService,
) *LLMProviderService

func (*LLMProviderService) Create 

func (s *LLMProviderService) Create(orgUUID, createdBy string, req *api.LLMProvider) (*api.LLMProvider, error)

func (*LLMProviderService) Delete 

func (s *LLMProviderService) Delete(orgUUID, handle, deletedBy string) error

func (*LLMProviderService) Get 

func (s *LLMProviderService) Get(orgUUID, handle string) (*api.LLMProvider, error)

func (*LLMProviderService) List 

func (s *LLMProviderService) List(orgUUID string, limit, offset int) (*api.LLMProviderListResponse, error)

func (*LLMProviderService) SetSecretService 

func (s *LLMProviderService) SetSecretService(ss *SecretService)

SetSecretService injects the SecretService for placeholder validation. Called after both services are constructed to avoid circular dependency.

func (*LLMProviderService) Update 

func (s *LLMProviderService) Update(orgUUID, handle, updatedBy string, req *api.LLMProvider) (*api.LLMProvider, error)

type LLMProviderTemplateService 

type LLMProviderTemplateService struct {
	// contains filtered or unexported fields
}

func NewLLMProviderTemplateService 

func NewLLMProviderTemplateService(repo repository.LLMProviderTemplateRepository, auditRepo repository.AuditRepository, identity *IdentityService) *LLMProviderTemplateService

func (*LLMProviderTemplateService) CopyVersion 

func (s *LLMProviderTemplateService) CopyVersion(orgUUID, fromTemplateID, toTemplateID, toVersion, createdBy string, req *api.CreateLLMProviderTemplateVersionRequest) (*api.LLMProviderTemplate, error)

func (*LLMProviderTemplateService) Create 

func (s *LLMProviderTemplateService) Create(orgUUID, createdBy string, req *api.LLMProviderTemplate) (*api.LLMProviderTemplate, error)

func (*LLMProviderTemplateService) CreateVersion 

func (s *LLMProviderTemplateService) CreateVersion(orgUUID, groupID, createdBy string, req *api.CreateLLMProviderTemplateVersionRequest) (*api.LLMProviderTemplate, error)

func (*LLMProviderTemplateService) DeleteByHandle 

func (s *LLMProviderTemplateService) DeleteByHandle(orgUUID, handle string) error

func (*LLMProviderTemplateService) DeleteVersion 

func (s *LLMProviderTemplateService) DeleteVersion(orgUUID, groupID, version string) error

func (*LLMProviderTemplateService) Get 

func (s *LLMProviderTemplateService) Get(orgUUID, handle string) (*api.LLMProviderTemplate, error)

func (*LLMProviderTemplateService) GetVersion 

func (s *LLMProviderTemplateService) GetVersion(orgUUID, groupID, version string) (*api.LLMProviderTemplate, error)

func (*LLMProviderTemplateService) List 

func (s *LLMProviderTemplateService) List(orgUUID string, limit, offset int, latestOnly bool) (*api.LLMProviderTemplateListResponse, error)

func (*LLMProviderTemplateService) ListVersions 

func (s *LLMProviderTemplateService) ListVersions(orgUUID, groupID string, limit, offset int) (*api.LLMProviderTemplateListResponse, error)

func (*LLMProviderTemplateService) SetEnabledByHandle 

func (s *LLMProviderTemplateService) SetEnabledByHandle(orgUUID, handle string, enabled bool) (*api.LLMProviderTemplate, error)

SetEnabledByHandle enables or disables the single template version identified by its unique handle. The handle is resolved to its (groupId, version) and the existing version-level rules apply (built-ins are read-only).

func (*LLMProviderTemplateService) SetVersionEnabled 

func (s *LLMProviderTemplateService) SetVersionEnabled(orgUUID, groupID, version string, enabled bool) (*api.LLMProviderTemplate, error)

func (*LLMProviderTemplateService) Update 

func (s *LLMProviderTemplateService) Update(orgUUID, handle, updatedBy string, req *api.LLMProviderTemplate) (*api.LLMProviderTemplate, error)

type LLMProxyAPIKeyService 

type LLMProxyAPIKeyService struct {
	// contains filtered or unexported fields
}

LLMProxyAPIKeyService handles API key management for LLM proxies

func NewLLMProxyAPIKeyService 

func NewLLMProxyAPIKeyService(
	llmProxyRepo repository.LLMProxyRepository,
	gatewayRepo repository.GatewayRepository,
	apiKeyRepo repository.APIKeyRepository,
	gatewayEventsService *GatewayEventsService,
	identity *IdentityService,
	slogger *slog.Logger,
) *LLMProxyAPIKeyService

NewLLMProxyAPIKeyService creates a new LLM proxy API key service instance

func (*LLMProxyAPIKeyService) CreateLLMProxyAPIKey 

func (s *LLMProxyAPIKeyService) CreateLLMProxyAPIKey(
	ctx context.Context,
	proxyID, orgID, userID string,
	req *api.CreateLLMProxyAPIKeyRequest,
) (*api.CreateLLMProxyAPIKeyResponse, error)

CreateLLMProxyAPIKey generates an API key for an LLM proxy and broadcasts it to all gateways.

func (*LLMProxyAPIKeyService) DeleteLLMProxyAPIKey 

func (s *LLMProxyAPIKeyService) DeleteLLMProxyAPIKey(
	ctx context.Context,
	proxyID, orgID, userID, keyName string,
) error

DeleteLLMProxyAPIKey deletes the API key from the database and broadcasts a revoke event to gateways.

func (*LLMProxyAPIKeyService) ListLLMProxyAPIKeys 

func (s *LLMProxyAPIKeyService) ListLLMProxyAPIKeys(
	ctx context.Context,
	proxyID, orgID, userID string,
) (*api.LLMProxyAPIKeyListResponse, error)

ListLLMProxyAPIKeys returns API keys for an LLM proxy, filtered to those created by userID.

type LLMProxyDeploymentService 

type LLMProxyDeploymentService struct {
	// contains filtered or unexported fields
}

LLMProxyDeploymentService handles business logic for LLM proxy deployment operations using the shared deployments table and status model.

func NewLLMProxyDeploymentService 

func NewLLMProxyDeploymentService(
	proxyRepo repository.LLMProxyRepository,
	deploymentRepo repository.DeploymentRepository,
	gatewayRepo repository.GatewayRepository,
	orgRepo repository.OrganizationRepository,
	gatewayEventsService *GatewayEventsService,
	cfg *config.Server,
	slogger *slog.Logger,
) *LLMProxyDeploymentService

NewLLMProxyDeploymentService creates a new LLM proxy deployment service

func (*LLMProxyDeploymentService) DeleteLLMProxyDeployment 

func (s *LLMProxyDeploymentService) DeleteLLMProxyDeployment(proxyID, deploymentID, orgUUID string) error

DeleteLLMProxyDeployment permanently deletes an undeployed deployment artifact

func (*LLMProxyDeploymentService) DeployLLMProxy 

func (s *LLMProxyDeploymentService) DeployLLMProxy(proxyID string, req *api.DeployRequest, orgUUID string) (*api.DeploymentResponse, error)

DeployLLMProxy creates a new immutable deployment artifact and deploys it to a gateway

func (*LLMProxyDeploymentService) GetLLMProxyDeployment 

func (s *LLMProxyDeploymentService) GetLLMProxyDeployment(proxyID, deploymentID, orgUUID string) (*api.DeploymentResponse, error)

GetLLMProxyDeployment retrieves a specific deployment by ID

func (*LLMProxyDeploymentService) GetLLMProxyDeployments 

func (s *LLMProxyDeploymentService) GetLLMProxyDeployments(proxyID, orgUUID string, gatewayID *string, status *string) (*api.DeploymentListResponse, error)

GetLLMProxyDeployments retrieves all deployments for a proxy with optional filters

func (*LLMProxyDeploymentService) RestoreLLMProxyDeployment 

func (s *LLMProxyDeploymentService) RestoreLLMProxyDeployment(proxyID, deploymentID, gatewayID, orgUUID string) (*api.DeploymentResponse, error)

RestoreLLMProxyDeployment restores a previous deployment (ARCHIVED or UNDEPLOYED)

func (*LLMProxyDeploymentService) UndeployLLMProxyDeployment 

func (s *LLMProxyDeploymentService) UndeployLLMProxyDeployment(proxyID, deploymentID, gatewayID, orgUUID string) (*api.DeploymentResponse, error)

UndeployLLMProxyDeployment undeploys an active deployment

type LLMProxyService 

type LLMProxyService struct {
	// contains filtered or unexported fields
}

func NewLLMProxyService 

func NewLLMProxyService(
	repo repository.LLMProxyRepository,
	providerRepo repository.LLMProviderRepository,
	projectRepo repository.ProjectRepository,
	deploymentRepo repository.DeploymentRepository,
	gatewayRepo repository.GatewayRepository,
	gatewayEventsService *GatewayEventsService,
	slogger *slog.Logger,
	auditRepo repository.AuditRepository,
	cfg *config.Server,
	identity *IdentityService,
) *LLMProxyService

func (*LLMProxyService) Create 

func (s *LLMProxyService) Create(orgUUID, createdBy string, req *api.LLMProxy) (*api.LLMProxy, error)

func (*LLMProxyService) Delete 

func (s *LLMProxyService) Delete(orgUUID, handle, deletedBy string) error

func (*LLMProxyService) Get 

func (s *LLMProxyService) Get(orgUUID, handle string) (*api.LLMProxy, error)

func (*LLMProxyService) List 

func (s *LLMProxyService) List(orgUUID string, projectHandle *string, limit, offset int) (*api.LLMProxyListResponse, error)

func (*LLMProxyService) ListByProvider 

func (s *LLMProxyService) ListByProvider(orgUUID, providerID string, limit, offset int) (*api.LLMProxyListResponse, error)

func (*LLMProxyService) Update 

func (s *LLMProxyService) Update(orgUUID, handle, updatedBy string, req *api.LLMProxy) (*api.LLMProxy, error)

type LLMTemplateSeeder 

type LLMTemplateSeeder struct {
	// contains filtered or unexported fields
}

LLMTemplateSeeder seeds a set of default LLM provider templates into the DB for a given organization. This is used to avoid "template not found" when creating LLM providers.

Seeding is idempotent and convergent: existing templates are updated to match the seeded defaults on every run.

func NewLLMTemplateSeeder 

func NewLLMTemplateSeeder(repo repository.LLMProviderTemplateRepository, templates []*model.LLMProviderTemplate) *LLMTemplateSeeder

func (*LLMTemplateSeeder) SeedForOrg 

func (s *LLMTemplateSeeder) SeedForOrg(orgUUID string) error

type MCPDeploymentService 

type MCPDeploymentService struct {
	// contains filtered or unexported fields
}

func NewMCPDeploymentService 

func NewMCPDeploymentService(mcpRepo repository.MCPProxyRepository, deploymentRepo repository.DeploymentRepository,
	gatewayRepo repository.GatewayRepository, orgRepo repository.OrganizationRepository, artifactRepo repository.ArtifactRepository,
	gatewayEventsService *GatewayEventsService, cfg *config.Server, slogger *slog.Logger) *MCPDeploymentService

func (*MCPDeploymentService) DeleteDeploymentByHandle 

func (s *MCPDeploymentService) DeleteDeploymentByHandle(proxyHandle, deploymentID, orgUUID string) error

DeleteDeploymentByHandle deletes a deployment using MCP proxy handle

func (*MCPDeploymentService) DeployMCPProxyByHandle 

func (s *MCPDeploymentService) DeployMCPProxyByHandle(proxyHandle string, req *api.DeployRequest, orgUUID, createdBy string) (*api.DeploymentResponse, error)

DeployMCPProxyByHandle creates a new immutable deployment artifact using MCP proxy handle

func (*MCPDeploymentService) GetDeploymentByHandle 

func (s *MCPDeploymentService) GetDeploymentByHandle(proxyHandle, deploymentID, orgUUID string) (*api.DeploymentResponse, error)

GetDeploymentByHandle retrieves a single deployment using MCP proxy handle

func (*MCPDeploymentService) GetDeploymentsByHandle 

func (s *MCPDeploymentService) GetDeploymentsByHandle(proxyHandle, gatewayID, status, orgUUID string) (*api.DeploymentListResponse, error)

GetDeploymentsByHandle retrieves deployments for an MCP proxy using handle

func (*MCPDeploymentService) RestoreMCPDeploymentByHandle 

func (s *MCPDeploymentService) RestoreMCPDeploymentByHandle(proxyHandle, deploymentID, gatewayHandle, orgUUID string) (*api.DeploymentResponse, error)

RestoreMCPDeploymentByHandle restores a previous deployment using the MCP proxy handle and the gateway handle. Deploy resolves the gateway by handle, so restore resolves the handle to the gateway UUID here to keep the contract consistent.

func (*MCPDeploymentService) UndeployDeploymentByHandle 

func (s *MCPDeploymentService) UndeployDeploymentByHandle(proxyHandle, deploymentID, gatewayHandle, orgUUID string) (*api.DeploymentResponse, error)

UndeployDeploymentByHandle undeploys a deployment using the MCP proxy handle and the gateway handle. Deploy resolves the gateway by handle, so undeploy resolves the handle to the gateway UUID here to keep the contract consistent.

type MCPProxyService 

type MCPProxyService struct {
	// contains filtered or unexported fields
}

MCPProxyService handles business logic for MCP proxy operations

func NewMCPProxyService 

func NewMCPProxyService(repo repository.MCPProxyRepository, projectRepo repository.ProjectRepository,
	deploymentRepo repository.DeploymentRepository, gatewayRepo repository.GatewayRepository,
	gatewayEventsService *GatewayEventsService, slogger *slog.Logger, auditRepo repository.AuditRepository,
	cfg *config.Server, identity *IdentityService) *MCPProxyService

NewMCPProxyService creates a new MCPProxyService instance

func (*MCPProxyService) Create 

func (s *MCPProxyService) Create(orgUUID, createdBy string, req *api.MCPProxy) (*api.MCPProxy, error)

Create creates a new MCP proxy

func (*MCPProxyService) Delete 

func (s *MCPProxyService) Delete(orgUUID, handle, deletedBy string) error

Delete deletes an MCP proxy by its handle

func (*MCPProxyService) FetchServerInfo 

func (s *MCPProxyService) FetchServerInfo(orgUUID string, req *api.MCPServerInfoFetchRequest) (*api.MCPServerInfoFetchResponse, error)

FetchServerInfo fetches server information from an MCP backend. When proxyId is provided, the URL and auth are fetched from the stored proxy configuration. When proxyId is not provided, url is required and auth is optional.

func (*MCPProxyService) Get 

func (s *MCPProxyService) Get(orgUUID, handle string) (*api.MCPProxy, error)

Get retrieves an MCP proxy by its handle

func (*MCPProxyService) List 

func (s *MCPProxyService) List(orgUUID string, limit, offset int) (*api.MCPProxyListResponse, error)

List retrieves all MCP proxies for an organization

func (*MCPProxyService) ListByProject 

func (s *MCPProxyService) ListByProject(orgUUID, projectHandle string, limit, offset int) (*api.MCPProxyListResponse, error)

ListByProject retrieves MCP proxies for an organization filtered by project ID

func (*MCPProxyService) Update 

func (s *MCPProxyService) Update(orgUUID, handle, updatedBy string, req *api.MCPProxy) (*api.MCPProxy, error)

Update updates an existing MCP proxy

func (*MCPProxyService) WithSecretService 

func (s *MCPProxyService) WithSecretService(ss *SecretService)

WithSecretService injects the SecretService for secret-ref validation.

type MCPServerInfoFetcher 

type MCPServerInfoFetcher interface {
	FetchServerInfo(orgUUID string, req *api.MCPServerInfoFetchRequest) (*api.MCPServerInfoFetchResponse, error)
}

MCPServerInfoFetcher fetches an MCP server's capabilities (tools/prompts/resources) from its upstream. It is satisfied by *MCPProxyService; the importer depends on the interface so the network fetch can be substituted in tests.

type Manifest 

type Manifest struct {
	Policies json.RawMessage
}

Manifest holds the gateway manifest returned to APIM.

type OrganizationService 

type OrganizationService struct {
	// contains filtered or unexported fields
}

func NewOrganizationService 

func NewOrganizationService(orgRepo repository.OrganizationRepository,
	projectRepo repository.ProjectRepository,
	applicationRepo repository.ApplicationRepository,
	apiRepo repository.APIRepository,
	gatewayRepo repository.GatewayRepository,
	llmProviderRepo repository.LLMProviderRepository,
	llmProxyRepo repository.LLMProxyRepository,
	mcpProxyRepo repository.MCPProxyRepository,
	llmTemplateSeeder *LLMTemplateSeeder,
	auditRepo repository.AuditRepository,
	userOrgMappingRepo repository.UserOrganizationMappingRepository,
	identity *IdentityService,
	cfg *config.Server,
	slogger *slog.Logger,
) *OrganizationService

func (*OrganizationService) GetOrganizationByHandle 

func (s *OrganizationService) GetOrganizationByHandle(handle string) (*api.Organization, error)

func (*OrganizationService) GetOrganizationByUUID 

func (s *OrganizationService) GetOrganizationByUUID(orgId string) (*api.Organization, error)

func (*OrganizationService) ListOrganizations 

func (s *OrganizationService) ListOrganizations(limit, offset int) ([]api.Organization, int, error)

ListOrganizations returns a paginated list of organizations along with the total number of organizations available across all pages.

func (*OrganizationService) RegisterOrganization 

func (s *OrganizationService) RegisterOrganization(id string, handle string, name string, region string, idpOrgRefUUID string, performedBy string) (*api.Organization, error)

type ProjectDeletionGuard 

type ProjectDeletionGuard interface {
	CheckProjectDeletion(orgID, projectID string) error
}

ProjectDeletionGuard is implemented by plugins that need to block project deletion when plugin-managed resources still exist under the project.

type ProjectService 

type ProjectService struct {
	// contains filtered or unexported fields
}

func NewProjectService 

func NewProjectService(projectRepo repository.ProjectRepository, orgRepo repository.OrganizationRepository,
	apiRepo repository.APIRepository, mcpProxyRepo repository.MCPProxyRepository,
	appRepo repository.ApplicationRepository, auditRepo repository.AuditRepository,
	identity *IdentityService, slogger *slog.Logger) *ProjectService

func (*ProjectService) CreateProject 

func (s *ProjectService) CreateProject(req *api.CreateProjectRequest, organizationID, actor string) (*api.Project, error)

func (*ProjectService) DeleteProject 

func (s *ProjectService) DeleteProject(handle, orgId, actor string) error

func (*ProjectService) GetProjectByHandle 

func (s *ProjectService) GetProjectByHandle(handle, orgId string) (*api.Project, error)

func (*ProjectService) GetProjectsByOrganization 

func (s *ProjectService) GetProjectsByOrganization(organizationID string) ([]api.Project, error)

func (*ProjectService) RegisterDeletionGuard 

func (s *ProjectService) RegisterDeletionGuard(guard ProjectDeletionGuard)

RegisterDeletionGuard adds a guard that is consulted during DeleteProject. Plugins call this to block deletion when they own resources under the project.

func (*ProjectService) UpdateProject 

func (s *ProjectService) UpdateProject(handle string, req *api.Project, orgId, actor string) (*api.Project, error)

type SecretInUseError 

type SecretInUseError struct {
	References []model.SecretReference
}

func (*SecretInUseError) Error 

func (e *SecretInUseError) Error() string

type SecretService 

type SecretService struct {
	// contains filtered or unexported fields
}

func NewSecretService 

func NewSecretService(repo repository.SecretRepository, v vault.SecretVault, identity *IdentityService) *SecretService

func (*SecretService) Create 

func (s *SecretService) Create(orgID, createdBy string, req *dto.CreateSecretRequest) (*dto.SecretResponse, error)

func (*SecretService) Decrypt 

func (s *SecretService) Decrypt(orgID, handle string) (string, error)

Decrypt returns the plaintext value of a secret — intended for internal GW use only.

func (*SecretService) DecryptCiphertext 

func (s *SecretService) DecryptCiphertext(ciphertext []byte) (string, error)

DecryptCiphertext decrypts an already-fetched ciphertext blob directly, without a database round-trip. Used in the bulk includeValues=true loop where the caller already holds the model.Secret rows.

func (*SecretService) Delete 

func (s *SecretService) Delete(orgID, handle, updatedBy string) error

func (*SecretService) Get 

func (s *SecretService) Get(orgID, handle string) (*dto.SecretSummary, error)

func (*SecretService) List 

func (s *SecretService) List(orgID string, limit, offset int, updatedAfter *time.Time) (*dto.SecretListResponse, error)

func (*SecretService) Update 

func (s *SecretService) Update(orgID, handle, updatedBy string, req *dto.UpdateSecretRequest) (*dto.SecretResponse, error)

func (*SecretService) ValidateSecretRefs 

func (s *SecretService) ValidateSecretRefs(orgID, configText string) error

ValidateSecretRefs checks that every {{ secret "handle" }} placeholder in configText resolves to an active org-scoped secret.

type SubscriptionPlanService 

type SubscriptionPlanService struct {
	// contains filtered or unexported fields
}

SubscriptionPlanService handles subscription plan business logic

func NewSubscriptionPlanService 

func NewSubscriptionPlanService(
	planRepo repository.SubscriptionPlanRepository,
	gatewayRepo repository.GatewayRepository,
	orgRepo repository.OrganizationRepository,
	gatewayEvents *GatewayEventsService,
	auditRepo repository.AuditRepository,
	slogger *slog.Logger,
) *SubscriptionPlanService

NewSubscriptionPlanService creates a new subscription plan service

func (*SubscriptionPlanService) CreatePlan 

func (s *SubscriptionPlanService) CreatePlan(orgUUID, actor string, plan *model.SubscriptionPlan) (*model.SubscriptionPlan, error)

CreatePlan creates a new subscription plan

func (*SubscriptionPlanService) DeletePlan 

func (s *SubscriptionPlanService) DeletePlan(handle, orgUUID, actor string) error

DeletePlan removes a subscription plan

func (*SubscriptionPlanService) GetPlan 

func (s *SubscriptionPlanService) GetPlan(handle, orgUUID string) (*model.SubscriptionPlan, error)

GetPlan returns a subscription plan by handle

func (*SubscriptionPlanService) GetPlanNameMap 

func (s *SubscriptionPlanService) GetPlanNameMap(planIDs []string, orgUUID string) (map[string]string, error)

GetPlanNameMap returns a map of plan UUID to plan name for bulk lookup (avoids N+1 queries).

func (*SubscriptionPlanService) ListPlans 

func (s *SubscriptionPlanService) ListPlans(orgUUID string, limit, offset int) ([]*model.SubscriptionPlan, error)

ListPlans returns subscription plans for an organization with pagination

func (*SubscriptionPlanService) ResolveOrgHandle 

func (s *SubscriptionPlanService) ResolveOrgHandle(orgUUID string) string

ResolveOrgHandle returns the organization handle for display (organizationId in responses should be the handle, not the internal UUID).

func (*SubscriptionPlanService) UpdatePlan 

func (s *SubscriptionPlanService) UpdatePlan(handle, orgUUID, actor string, update *model.SubscriptionPlanUpdate) (*model.SubscriptionPlan, error)

UpdatePlan updates a subscription plan

type SubscriptionService 

type SubscriptionService struct {
	// contains filtered or unexported fields
}

SubscriptionService handles application-level subscription business logic

func NewSubscriptionService 

func NewSubscriptionService(
	apiRepo repository.APIRepository,
	artifactRepo repository.ArtifactRepository,
	subscriptionRepo repository.SubscriptionRepository,
	planRepo repository.SubscriptionPlanRepository,
	orgRepo repository.OrganizationRepository,
	gatewayEvents *GatewayEventsService,
	auditRepo repository.AuditRepository,
	slogger *slog.Logger,
) *SubscriptionService

NewSubscriptionService creates a new subscription service

func (*SubscriptionService) ChangePlan 

func (s *SubscriptionService) ChangePlan(subscriptionId, orgUUID, subscriberID, planHandle string) (*model.Subscription, error)

ChangePlan switches the subscription plan of an existing subscription and broadcasts the change to the gateways where the API is deployed. subscriberID must match the stored subscriber_id.

func (*SubscriptionService) CreateSubscription 

func (s *SubscriptionService) CreateSubscription(apiId, kind, orgUUID string, subscriberID string, applicationId *string, subscriptionPlanId *string, subscriptionToken string, status string, actor string) (*model.Subscription, error)

CreateSubscription creates a new subscription for an artifact of the given kind. apiId is the artifact handle; kind selects the artifact table it is resolved against. subscriberID identifies who the subscription is for (client-supplied, not a token identity); subscriptionToken, when non-empty, is the token imported from the Developer Portal (empty means generate one); actor is the authenticated caller's internal UUID, used for created_by/updated_by/audit.

func (*SubscriptionService) DeleteSubscription 

func (s *SubscriptionService) DeleteSubscription(subscriptionId, orgUUID, subscriberID, actor string) error

DeleteSubscription removes a subscription. subscriberID must match the stored subscriber_id; actor is the authenticated caller's internal UUID, used for audit.

func (*SubscriptionService) FindByArtifactKindAndSubscriber 

func (s *SubscriptionService) FindByArtifactKindAndSubscriber(orgUUID, apiHandle, kind, subscriberID string) (*model.Subscription, error)

FindByArtifactKindAndSubscriber locates a single subscription by (API, subscriber) within the org, resolving the API by handle + kind so the lookup is scoped to the artifact table backing that kind (a handle shared across kinds resolves unambiguously). Returns (nil, nil) when none exists and ErrAPINotFound when the artifact itself cannot be resolved.

func (*SubscriptionService) GetArtifactMetadataMap 

func (s *SubscriptionService) GetArtifactMetadataMap(uuids []string, orgUUID string) (map[string]*model.APIMetadata, error)

GetArtifactMetadataMap returns a map of artifact UUID to metadata (handle, kind) for bulk lookup across all artifact kinds (avoids N+1 queries).

func (*SubscriptionService) GetSubscription 

func (s *SubscriptionService) GetSubscription(subscriptionId, orgUUID string) (*model.Subscription, error)

GetSubscription returns a subscription by ID (and org)

func (*SubscriptionService) ListSubscriptionsByFilters 

func (s *SubscriptionService) ListSubscriptionsByFilters(orgUUID string, apiId *string, subscriberID *string, applicationID *string, status *string, limit, offset int) ([]*model.Subscription, int, error)

ListSubscriptionsByFilters returns subscriptions filtered by API, subscriber and/or application with pagination. It returns the list, total count matching filters, and any error.

func (*SubscriptionService) RegenerateToken 

func (s *SubscriptionService) RegenerateToken(subscriptionId, orgUUID, subscriberID, newToken string) (*model.Subscription, error)

RegenerateToken rotates the subscription's token to the value provided by the Developer Portal (delivered encrypted in the subscription.token_regenerated event). The old token is invalidated; the new token is persisted (hashed + encrypted) and broadcast to the gateways where the API is deployed. subscriberID must match the stored subscriber_id.

func (*SubscriptionService) ResolveArtifactHandleAndKind 

func (s *SubscriptionService) ResolveArtifactHandleAndKind(artifactUUID, orgUUID string) (handle, kind string)

ResolveArtifactHandleAndKind returns the artifact handle and kind for display. apiId in responses should be the handle (not the internal UUID); kind identifies the artifact type. Resolves across all artifact kinds, so it works for REST APIs, LLM providers/proxies, etc.

func (*SubscriptionService) ResolveOrgHandle 

func (s *SubscriptionService) ResolveOrgHandle(orgUUID string) string

ResolveOrgHandle returns the organization handle for display (organizationId in responses should be the handle, not the internal UUID).

func (*SubscriptionService) UpdateSubscription 

func (s *SubscriptionService) UpdateSubscription(subscriptionId, orgUUID, subscriberID, status, actor string) (*model.Subscription, error)

UpdateSubscription updates a subscription (e.g. status). subscriberID must match the stored subscriber_id; actor is the authenticated caller's internal UUID, used for updated_by/audit.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.