Documentation
¶
Index ¶
- Constants
- Variables
- func ClearLauncherDashboardSessionCookie(w http.ResponseWriter, r *http.Request, secure func(*http.Request) bool)
- func DefaultLauncherDashboardSecureCookie(r *http.Request) bool
- func IPAllowlist(cfg IPAllowlistConfig, next http.Handler) (http.Handler, error)
- func JSONContentType(next http.Handler) http.Handler
- func LauncherDashboardAuth(cfg LauncherDashboardAuthConfig, next http.Handler) http.Handler
- func Logger(next http.Handler) http.Handler
- func NewLauncherDashboardSessionCookie() (string, error)
- func Recoverer(next http.Handler) http.Handler
- func ReferrerPolicyNoReferrer(next http.Handler) http.Handler
- func SetLauncherDashboardSessionCookie(w http.ResponseWriter, r *http.Request, sessionValue string, ...)
- type IPAllowlistConfig
- type LauncherDashboardAuthConfig
- type LauncherDashboardLocalAutoLogin
Constants ¶
const ( // LauncherDashboardLocalAutoLoginPath is the one-shot local browser // bootstrap endpoint used by the launcher-managed auto-open flow. LauncherDashboardLocalAutoLoginPath = "/launcher-auto-login" // LauncherDashboardSetupPath is the setup page used before the dashboard // password is initialized. LauncherDashboardSetupPath = "/launcher-setup" )
const LauncherDashboardCookieName = "facet-studio_launcher_auth"
LauncherDashboardCookieName is the HttpOnly cookie set after a successful password login.
Variables ¶
var ErrInvalidLauncherDashboardGrant = errors.New("invalid launcher dashboard grant")
ErrInvalidLauncherDashboardGrant reports that an auto-login grant is missing, expired, already consumed, or otherwise invalid.
Functions ¶
func ClearLauncherDashboardSessionCookie ¶
func ClearLauncherDashboardSessionCookie(w http.ResponseWriter, r *http.Request, secure func(*http.Request) bool)
ClearLauncherDashboardSessionCookie clears the dashboard session (e.g. logout).
func DefaultLauncherDashboardSecureCookie ¶
DefaultLauncherDashboardSecureCookie mirrors typical production HTTPS detection (TLS or X-Forwarded-Proto).
func IPAllowlist ¶
IPAllowlist restricts access to requests from configured CIDR ranges. Loopback addresses can optionally bypass CIDR checks for local administration. X-Forwarded-For is only trusted when the immediate peer is in a trusted CIDR. Empty CIDR list means no restriction.
func JSONContentType ¶
JSONContentType sets the Content-Type header to application/json for API requests handled by the wrapped handler.
func LauncherDashboardAuth ¶
func LauncherDashboardAuth(cfg LauncherDashboardAuthConfig, next http.Handler) http.Handler
LauncherDashboardAuth requires a valid session cookie before calling next. Public paths are login/setup pages and /api/auth/* handlers.
func NewLauncherDashboardSessionCookie ¶
NewLauncherDashboardSessionCookie creates the per-process session cookie value.
func Recoverer ¶
Recoverer recovers from panics in downstream handlers and returns a 500 Internal Server Error response.
func ReferrerPolicyNoReferrer ¶
ReferrerPolicyNoReferrer sets Referrer-Policy: no-referrer on every response so sensitive paths and query parameters are not leaked via the Referer header.
func SetLauncherDashboardSessionCookie ¶
func SetLauncherDashboardSessionCookie( w http.ResponseWriter, r *http.Request, sessionValue string, secure func(*http.Request) bool, )
SetLauncherDashboardSessionCookie writes the HttpOnly session cookie after successful dashboard password login.
Types ¶
type IPAllowlistConfig ¶
type IPAllowlistConfig struct {
AllowedCIDRs []string
AllowLocalhostBypass bool
TrustedProxyCIDRs []string
}
IPAllowlistConfig controls launcher network access decisions.
type LauncherDashboardAuthConfig ¶
type LauncherDashboardAuthConfig struct {
ExpectedCookie string
// LocalAutoLogin enables one-shot startup auto-login.
LocalAutoLogin *LauncherDashboardLocalAutoLogin
// SecureCookie sets the session cookie's Secure flag. If nil, DefaultLauncherDashboardSecureCookie is used.
SecureCookie func(*http.Request) bool
}
LauncherDashboardAuthConfig holds runtime material for dashboard access checks.
type LauncherDashboardLocalAutoLogin ¶
type LauncherDashboardLocalAutoLogin struct {
// contains filtered or unexported fields
}
LauncherDashboardLocalAutoLogin is an in-memory, one-shot startup grant. It is not a reusable credential; it only lets the launcher-opened browser receive the current process session cookie.
func NewLauncherDashboardLocalAutoLogin ¶
func NewLauncherDashboardLocalAutoLogin(ttl time.Duration) (*LauncherDashboardLocalAutoLogin, error)
NewLauncherDashboardLocalAutoLogin creates a one-shot local auto-login grant.
func (*LauncherDashboardLocalAutoLogin) URLPath ¶
func (a *LauncherDashboardLocalAutoLogin) URLPath() string
URLPath returns the one-shot local auto-login URL path including its nonce.
Source Files