public

Documentation

Overview

Package public provides the public-facing HTTP server, assembling routes from the oauth, vault, and wellknown sub-packages.

Index

• type Deps
• type Server
  • func NewServer(ctx context.Context, cfg config.ServerConfig, deps Deps, ...) *Server
  • func (s *Server) Handler() http.Handler
  • func (s *Server) Shutdown(ctx context.Context) error
  • func (s *Server) Start() error

Types

type Deps

type Deps struct {
	JWKS              wellknown.JWKSProvider
	DCR               oauth.DCRProvider
	Auth              oauth.UserAuthProvider
	Authorize         oauth.AuthorizeProvider
	Consent           oauth.ConsentProvider
	Token             oauth.TokenProvider
	ClientCredentials oauth.ClientCredentialsProvider
	TokenExchange     oauth.TokenExchangeProvider
	JWTBearer         oauth.JWTBearerProvider
	Revoke            oauth.RevocationProvider
	Introspect        oauth.IntrospectionProvider
	Health            wellknown.HealthChecker
	OIDC              oauth.OIDCFlowProvider
	OIDCConfig        config.OIDCConfig
	ResourceServers   wellknown.ResourceListerFunc
	SessionCfg        config.SessionConfig
	RateLimitCfg      config.RateLimitConfig
	Connect           connectionapi.ConnectProvider
	// ConnectConsentBaseURL is the base URL used to build /connect/<provider>
	// consent_url values in consent_required responses from the token
	// endpoint (Broker upstream re-connect path). Populated from
	// cfg.Connect.RedirectBaseURL.
	ConnectConsentBaseURL string
	// AuthorizeBaseURL is the AS issuer URL used to build
	// /authorize?resource=<slug> consent_url values for AS-side re-consent
	// flows (bound-B / bound-C, ). Populated from cfg.Server.Issuer.
	AuthorizeBaseURL string

	// DPoP (RFC 9449) — optional.
	DPoPNonce oauth.DPoPNonceIssuer // non-nil when DPoP is enabled
	DPoPCfg   config.DPoPConfig     // DPoP configuration

	// CIMD (Client ID Metadata Document) — optional.
	HasCIMD bool

	// Agent identity (Authplane extension) — optional.
	HasAgentIdentity bool

	// Users is consulted by SessionMiddleware to reject session cookies whose
	// userID no longer exists in the database. Pass the same UserStore
	// the rest of the app uses — production wraps it in storage.WithUserCache
	// so this lookup does not become a DB query per request. When nil, the
	// middleware accepts any cookie that passes HMAC + expiry validation —
	// the right default for tests, but not for production where a stale cookie
	// can survive a `docker compose down -v` and trip an FK constraint
	// downstream (e.g., broker_grants.user_id).
	Users output.UserStore
}

Deps holds the dependencies injected into the public HTTP server.

type Server

type Server struct {
	// contains filtered or unexported fields
}

Server is the public-facing HTTP server.

func NewServer

func NewServer(ctx context.Context, cfg config.ServerConfig, deps Deps, obs *observability.Provider) *Server

NewServer creates the public HTTP server with routes wired.

func (*Server) Handler

func (s *Server) Handler() http.Handler

Handler returns the server's HTTP handler for testing.

func (*Server) Shutdown

func (s *Server) Shutdown(ctx context.Context) error

Shutdown gracefully drains in-flight requests.

func (*Server) Start

func (s *Server) Start() error

Start begins listening. It blocks until the server stops.