routers

Documentation

Index

• Constants
• func ApiFilter(c *zip.Ctx) error
• func GetSessionUser(c *zip.Ctx) *iamsdk.User
• func RecordMessage(c *zip.Ctx) error
• func Route(app *zip.App)
• func TenantContextFilter(c *zip.Ctx) error
• func TransparentStatic(c *zip.Ctx) error
• type Health
• type Object
• type Ping
• type Response

Constants

const MCPPath = "/mcp"

MCPPath is where visor serves its MCP door. Stated here, in the package that owns the HTTP surface, and handed to zip.Config — so the path the static filter lets through and the path zip mounts are the same string and cannot drift into a door that exists and cannot be reached.

Functions

func ApiFilter

func ApiFilter(c *zip.Ctx) error

ApiFilter is the ONE authorization seam — ZAP middleware that authorizes every request against the static Casbin policy (authz.IsAllowed) on the resolved subject/object, denying with 403 or threading the request through to the handler via c.Next(). It runs after the tenant filter and before the record filter, exactly as the Beego BeforeRouter chain did.

func GetSessionUser

func GetSessionUser(c *zip.Ctx) *iamsdk.User

GetSessionUser resolves the caller from the forwarded IAM Bearer JWT — the ONE stateless identity seam. There is no cookie or server-side session: an API/console caller presents a short-lived Bearer, verified and brand-bound in object.GetBearerUser.

func RecordMessage

func RecordMessage(c *zip.Ctx) error

RecordMessage is the audit-record middleware. Beego split this into a BeforeRouter hook (stash the acting user) and an AfterExec hook (build+persist the record from the response); ZAP composes both around one c.Next() — the before-work stashes the user id, the handler runs, then the after-work reads the response envelope the handler stashed and writes the audit record. Login, signup and get-assets are exempted from the user-id stash exactly as before.

func Route

func Route(app *zip.App)

Route mounts the whole visor HTTP surface on app: the ambient filter chain (recover, CORS, static, tenant, authz, record) followed by the /v1 API. The filter order is load-bearing — static short-circuits before the authz seam, so an asset is never gated; every /v1 route registered after the chain is tenant-scoped, authorized and audited.

func TenantContextFilter

func TenantContextFilter(c *zip.Ctx) error

TenantContextFilter is the ZAP middleware seam: it threads the tenant scope onto the request, then continues the chain via c.Next(). The scope transform itself is applyTenantContext, kept separate from the plumbing so it is unit- testable without a routed context.

func TransparentStatic

func TransparentStatic(c *zip.Ctx) error

TransparentStatic is the FIRST request filter after recover/CORS: a /v1/ request threads through (c.Next()) to the tenant/authz/record chain and the API routes; anything else is served from the web build with an index.html SPA fallback (or from the swagger root), short-circuiting the chain so no static asset is ever authz-gated or audit-recorded.

Static is a FALLBACK, so it yields to anything the app itself answers.

Types

type Health

type Health struct {
	Status  string `json:"status"`
	Backend string `json:"backend"`
}

Health is visor's answer to a probe.

Status is "ok" or the response is not a 200 at all, so a reader never has to parse the body to learn the verdict — which matters because the reader is kubelet, and kubelet reads the status code and nothing else. Backend names the store that was reached, so a human looking at a curl can tell a Base pod from a Postgres one without consulting the deployment.

type Object

type Object struct {
	Owner        string `json:"owner"`
	Name         string `json:"name"`
	AccessKey    string `json:"accessKey"`
	AccessSecret string `json:"accessSecret"`
}

type Ping

type Ping struct{}

Ping is what a probe sends: nothing. A health check asks one question and carries no arguments to ask it with, and saying so as a type is what lets the op be declared like every other — one shape, no special case.

type Response

type Response struct {
	Status string      `json:"status"`
	Msg    string      `json:"msg"`
	Data   interface{} `json:"data"`
	Data2  interface{} `json:"data2"`
}