rest

Documentation

Overview

Package rest owns the control API boundary and domain-to-DTO adapters.

Index

• Variables
• func WithControlAuthState(ctx context.Context, state ControlAuthState) context.Context
• type ControlAuthOptions
• type ControlAuthState
  • func ControlAuthStateFromContext(ctx context.Context) (ControlAuthState, bool)
• type ControlAuthenticator
  • func NewControlAuthenticator(options ControlAuthOptions) ControlAuthenticator
  • func (a ControlAuthenticator) Wrap(next http.Handler) http.Handler
• type OIDCIntrospector
• type Options
• type ProtectedContextAuthorizer
  • func (ProtectedContextAuthorizer) AuthorizeProtectedConfig(ctx context.Context, _ adapters.ProtectedConfigRequest) (bool, error)
• type Server
  • func NewServer(options Options) *Server
  • func (s *Server) Handler() http.Handler
  • func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request)

Variables

var JSON = jsoniter.ConfigCompatibleWithStandardLibrary

JSON is the REST boundary JSON codec. This intentionally uses jsoniter for REST JSON paths where the project chooses it over encoding/json.

Functions

func WithControlAuthState

func WithControlAuthState(ctx context.Context, state ControlAuthState) context.Context

WithControlAuthState stores control authorization state in a request context.

Types

type ControlAuthOptions

type ControlAuthOptions struct {
	Config           config.ControlServerConfig
	Authorities      map[string]config.AuthorityConfig
	HTTPClient       *http.Client
	OIDCIntrospector OIDCIntrospector
}

ControlAuthOptions configures the control-plane authentication boundary.

type ControlAuthState

type ControlAuthState struct {
	Actor      runtime.Actor
	Protected  bool
	Scopes     []string
	AuthMethod string
}

ControlAuthState carries authorization facts for stronger protected operations.

func ControlAuthStateFromContext

func ControlAuthStateFromContext(ctx context.Context) (ControlAuthState, bool)

ControlAuthStateFromContext returns authorization state set by the REST boundary.

type ControlAuthenticator

type ControlAuthenticator struct {
	// contains filtered or unexported fields
}

ControlAuthenticator is the control-plane guard around generated routes.

func NewControlAuthenticator

func NewControlAuthenticator(options ControlAuthOptions) ControlAuthenticator

NewControlAuthenticator creates the configured control API guard.

func (ControlAuthenticator) Wrap

func (a ControlAuthenticator) Wrap(next http.Handler) http.Handler

Wrap applies request guards before generated request decoding.

type OIDCIntrospector

type OIDCIntrospector interface {
	Introspect(ctx context.Context, token string) (nauthilus.OIDCIntrospectionResult, error)
}

OIDCIntrospector validates incoming bearer tokens through Nauthilus.

type Options

type Options struct {
	Version          string
	ConfigPath       string
	Control          config.ControlServerConfig
	Authorities      map[string]config.AuthorityConfig
	Profiles         config.ProfilesConfig
	AuthHTTPClient   *http.Client
	OIDCIntrospector OIDCIntrospector
	HandlerOptions   adapters.HandlerOptions
}

Options configures the generated REST boundary wrapper.

type ProtectedContextAuthorizer

type ProtectedContextAuthorizer struct{}

ProtectedContextAuthorizer grants protected config only to protected control actors.

func (ProtectedContextAuthorizer) AuthorizeProtectedConfig

func (ProtectedContextAuthorizer) AuthorizeProtectedConfig(
	ctx context.Context,
	_ adapters.ProtectedConfigRequest,
) (bool, error)

AuthorizeProtectedConfig checks the stronger protected authorization bit from context.

type Server

type Server struct {
	// contains filtered or unexported fields
}

Server owns the control API HTTP handler and generated route registration.

func NewServer

func NewServer(options Options) *Server

NewServer builds the generated strict-server boundary with local adapters.

func (*Server) Handler

func (s *Server) Handler() http.Handler

Handler returns the registered control API handler.

func (*Server) ServeHTTP

func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request)

ServeHTTP lets Server satisfy http.Handler directly.