hostpolicy

Documentation

Overview

Package hostpolicy gates all content on resolved alternate hosts. Compose it outside every application wrapper; it neither provisions tenants nor grants CMS access. Credentials are owner supplied and stored only as bcrypt hashes.

Index

• func CanonicalURL(primary string, path *url.URL) string
• func ParseTrustedProxies(raw string) ([]netip.Prefix, error)
• type Config
• type Gate
  • func New(cfg Config, next http.Handler) (*Gate, error)
  • func (g *Gate) ServeHTTP(w http.ResponseWriter, r *http.Request)
• type Policy
• type Tenant
• type TransportMode

Functions

func CanonicalURL

func CanonicalURL(primary string, path *url.URL) string

CanonicalURL is intended for callers that need a safe public canonical hint.

func ParseTrustedProxies

func ParseTrustedProxies(raw string) ([]netip.Prefix, error)

ParseTrustedProxies accepts explicit CIDRs only; never trust forwarded host.

Types

type Config

type Config struct {
	AdminHost, PlatformHost string
	Policies                map[string]Policy
	Resolve                 func(context.Context, string) (Tenant, bool)
	TrustedProxies          []netip.Prefix
	Transport               TransportMode
	// PreviewAccess optionally verifies host-owned, scoped preview authority on
	// every eligible request. It is considered only for protected preview tenants,
	// after transport/canonical policy checks, for canonical content GET/HEAD
	// targets without queries, or explicitly declared query targets below. Basic
	// authentication and all privileged routes keep their existing gates. The
	// callback must verify the exact origin, path AND raw query, tenant,
	// audience and current grant; it grants no CMS/admin authority. Nil or false
	// preserves Basic authentication. Its request clone must not be retained.
	PreviewAccess func(*http.Request, Tenant) bool
	// PreviewAccessQueryTargets is an optional finite per-tenant ceiling, derived
	// from validated host declarations. Only exact canonical GET/HEAD targets may
	// reach PreviewAccess. A nil/empty map retains the default query denial; these
	// declarations confer no authority without the callback's current grant check.
	PreviewAccessQueryTargets map[int64][]string
}

type Gate

type Gate struct {
	// contains filtered or unexported fields
}

func New

func New(cfg Config, next http.Handler) (*Gate, error)

func (*Gate) ServeHTTP

func (g *Gate) ServeHTTP(w http.ResponseWriter, r *http.Request)

type Policy

type Policy struct {
	Primary         string   `json:"primary"`
	RedirectAliases []string `json:"redirect_aliases"`
	PasswordHash    string   `json:"-"`
}

type Tenant

type Tenant struct {
	ID         int64
	Slug, Kind string
}

type TransportMode

type TransportMode string

TransportMode describes the deployment's HTTPS boundary, never client input.

const (
	TransportStrict           TransportMode = "strict"
	TransportAppPlatformHTTPS TransportMode = "app-platform-https"
)