proxy

Documentation

Overview

Package proxy is the pure, dependency-free reverse-proxy mechanism behind the /v1/auto subsystem. It is split from the cloud-registration wrapper (clients/auto) so the tenant-boundary behavior — the validated-principal gate and the outbound identity re-stamping the header-trusting auto engine depends on — is unit-testable WITHOUT linking the cloud root package (which transitively pulls conflicting SQLite drivers into a test binary). Separation of concerns: this file is the security mechanism; clients/auto only wires it into cloud.Registry.

Index

• Variables
• func Gate(next http.Handler) http.Handler
• func NewHandler(rawURL string) (http.Handler, error)

Variables

var EngineTrustHeaders = []string{"X-Org-Id", "X-User-Id", "X-User-Email"}

EngineTrustHeaders are the identity headers the auto engine reads. The proxy re-derives them from the gate-validated inbound request so the engine sees only server-authoritative values.

var StrippedHeaders = []string{
	"X-Roles", "X-User-Permissions", "X-Phone-Number", "X-User-IsAdmin",
	"X-User-Role", "X-User-Roles", "X-User-Name", "X-Tenant-Id", "X-Tenant-ID", "X-Org",
}

StrippedHeaders are identity aliases an attacker might smuggle that we delete on the outbound request (a superset beyond what the engine needs) so nothing identity-ish that cloud's SanitizeIdentity didn't set can reach the header-trusting engine.

Functions

func Gate

func Gate(next http.Handler) http.Handler

Gate refuses any request with no validated principal (empty X-User-Id, the signal cloud's SanitizeIdentity sets only from a verified credential) before it reaches the header-trusting engine. This closes the anonymous-forge path (a client-restored X-Org-Id with no credential) that would otherwise drive a victim org's workflows.

func NewHandler

func NewHandler(rawURL string) (http.Handler, error)

NewHandler builds the reverse-proxy handler targeting the auto engine at rawURL. Pure (URL in, handler out). The path is forwarded UNCHANGED: /v1/auto/* maps to /v1/auto/* on the engine. The Director re-stamps the outbound identity headers from the (gate-validated) inbound values, deleting every identity alias first, so the engine — which trusts X-Org-Id absolutely — only ever receives the validated tenant.