server

Documentation

Overview

Package server wires the HTTP routes, login flow, ingest API, and proxy.

Index

• Constants
• func BuildBasicAuthorization(username, password string) string
• func ForwardedProto(r *http.Request) string
• type AuthenticateFunc
• type BulkIngestResponse
• type ErrorResponse
• type Gateway
  • func New(client *elastic.Client, authenticate AuthenticateFunc) *Gateway
  • func (g *Gateway) EncodeSessionCookieValue(s Session) (string, error)
  • func (g *Gateway) HandleKibana(w http.ResponseWriter, r *http.Request)
  • func (g *Gateway) Handler() *http.ServeMux
  • func (g *Gateway) RenderLoginPage(w http.ResponseWriter, status int, data LoginPageData)
• type IngestResponse
• type LoginPageData
• type Session
  • func (s Session) GoString() string
  • func (s Session) LogValue() slog.Value
  • func (s Session) String() string

Constants

const SessionCookieName = "elasticgateway_session"

SessionCookieName is the cookie that carries the gateway session token.

Functions

func BuildBasicAuthorization

func BuildBasicAuthorization(username, password string) string

BuildBasicAuthorization returns a Basic Auth header value for the credentials.

func ForwardedProto

func ForwardedProto(r *http.Request) string

ForwardedProto reports the direct request scheme for proxy headers.

Types

type AuthenticateFunc

type AuthenticateFunc func(string, string) (*authz.User, []authz.Access, error)

AuthenticateFunc validates credentials and returns the resolved LDAP access.

type BulkIngestResponse

type BulkIngestResponse struct {
	Took                int                                 `json:"took,omitempty"`
	Errors              bool                                `json:"errors"`
	Documents           int                                 `json:"documents"`
	WriteAliases        []string                            `json:"write_aliases"`
	BootstrappedAliases []string                            `json:"bootstrapped_write_aliases,omitempty"`
	Items               []map[string]elastic.BulkItemResult `json:"items"`
}

BulkIngestResponse is returned after a successful bulk ingest request.

type ErrorResponse

type ErrorResponse struct {
	Error string `json:"error"`
}

ErrorResponse is the JSON error envelope used by the gateway.

type Gateway

type Gateway struct {
	Client          *elastic.Client
	Authenticate    AuthenticateFunc
	IngestAuthCache *ingest.AuthCache
	SecureCookie    *securecookie.SecureCookie
	Logger          *slog.Logger
	// contains filtered or unexported fields
}

Gateway serves the login flow, ingest API, and Kibana reverse proxy.

func New

func New(client *elastic.Client, authenticate AuthenticateFunc) *Gateway

New constructs a gateway with the provided client and authenticator.

func (*Gateway) EncodeSessionCookieValue

func (g *Gateway) EncodeSessionCookieValue(s Session) (string, error)

EncodeSessionCookieValue encodes a session into a securecookie value. Exported so tests can mint cookies without going through the login flow.

func (*Gateway) HandleKibana

func (g *Gateway) HandleKibana(w http.ResponseWriter, r *http.Request)

HandleKibana proxies authenticated requests to Kibana.

func (*Gateway) Handler

func (g *Gateway) Handler() *http.ServeMux

Handler builds the HTTP mux for the gateway routes.

func (*Gateway) RenderLoginPage

func (g *Gateway) RenderLoginPage(w http.ResponseWriter, status int, data LoginPageData)

RenderLoginPage writes the login page with the supplied status and model.

type IngestResponse

type IngestResponse struct {
	Result       string `json:"result"`
	WriteAlias   string `json:"write_alias"`
	DocumentID   string `json:"document_id"`
	Bootstrapped bool   `json:"bootstrapped"`
}

IngestResponse is returned to clients after a successful ingest request.

type LoginPageData

type LoginPageData struct {
	Error    string
	Username string
	Next     string
}

LoginPageData is the template model for the login form.

type Session

type Session struct {
	User       *authz.User
	Access     []authz.Access
	AuthHeader string
}

Session is the value carried inside the encrypted session cookie. It holds every per-request fact the gateway needs to authorize the user and proxy Kibana, so the gateway can scale horizontally without a shared session store: the cookie itself is the session. Expiry is enforced by gorilla/securecookie's configured MaxAge at decode time, so no timing fields are tracked here.

func (Session) GoString

func (s Session) GoString() string

GoString ensures verbose %#v formatting uses the redacted representation instead of reflecting the exported AuthHeader field.

func (Session) LogValue

func (s Session) LogValue() slog.Value

LogValue returns a redacted structured representation for slog.Any.

func (Session) String

func (s Session) String() string

String returns a redacted representation so accidental fmt-based logging cannot expose the Basic credentials carried in AuthHeader.