api

Documentation

Overview

Package api wires the HTTP API layer.

Index

• func NewRouter(log *zap.Logger, version string, tracingEnabled bool, deps RouterDeps) *gin.Engine
• func RegisterOpenAPIRoutes(r *gin.Engine)
• type ReadinessChecker
• type RouterDeps

Functions

func NewRouter

func NewRouter(log *zap.Logger, version string, tracingEnabled bool, deps RouterDeps) *gin.Engine

NewRouter builds the Gin engine with all routes registered.

func RegisterOpenAPIRoutes

func RegisterOpenAPIRoutes(r *gin.Engine)

RegisterOpenAPIRoutes serves the OpenAPI document and Swagger UI.

Types

type ReadinessChecker

type ReadinessChecker interface {
	Ready(ctx context.Context) error
}

ReadinessChecker reports whether the application is ready to serve traffic.

type RouterDeps

type RouterDeps struct {
	Ready                ReadinessChecker
	Seal                 handlers.SealController
	MasterKey            []byte
	MasterKeyService     *service.MasterKeyService
	RaftMembership       handlers.RaftMembership
	CORSAllowedOrigins   []string
	AuthService          *auth.Service
	PKIService           *service.PKIService
	SecretsService       *service.SecretsService
	DatabaseService      *service.DatabaseService
	SSHService           *service.SSHService
	PolicyService        *service.PolicyService
	AuditExportService   *service.AuditExportService
	InjectService        *service.InjectService
	BackupService        *service.BackupService
	RotationService      *service.RotationService
	OrchestrationService *service.OrchestrationService
	LeaseService         *service.LeaseService
	AuditPackService     *service.AuditPackService
	MachineIdentitySvc   *service.MachineIdentityService
	CubbyholeService     *service.CubbyholeService
	WrappingService      *service.WrappingService
	TransitService       *service.TransitService
	IdentityService      *service.IdentityService
	TenantMode           bool
	AuthzAudit           *middleware.AuthzAudit
	ExposureSigningKey   string
	ExposureAutoRevoke   bool
	ExposurePathPrefixes []string
	ExposureWebhook      *notify.Webhook
	MTLSRequired         bool
	TokenTTL             time.Duration
	RateLimiter          *middleware.RateLimiter
	SharedRateLimiter    *middleware.SharedRateLimiter
	// AuthLoginLimiter / TokenCreateLimiter / UnsealLimiter use Valkey when configured (W86-10).
	AuthLoginLimiter   *middleware.SharedRateLimiter
	TokenCreateLimiter *middleware.SharedRateLimiter
	UnsealLimiter      *middleware.SharedRateLimiter
	RequestSigning     *middleware.RequestSigning
	// TrustClientABACHeaders when false ignores client X-KNX-Environment/Cluster (W86-12).
	TrustClientABACHeaders bool
	ABACEnvironment        string
	ABACCluster            string
	HAStatus               handlers.HAStatusProvider
	IsLeader               func() bool
	// TrustedProxies configures Gin X-Forwarded-For trust (W50-18). nil/empty = trust none.
	TrustedProxies []string
	// MetricsBearerToken when set authenticates GET /metrics (W50-19).
	MetricsBearerToken string
	// MetricsDedicatedOnly when true omits /metrics from the API router (W75-03 dedicated listener).
	// Zero value (false) keeps the lab/test default: GET /metrics on the main HTTP listener.
	MetricsDedicatedOnly bool
	// UnsealAllowCIDRs restricts POST /sys/unseal clients (empty = allow all).
	UnsealAllowCIDRs []string
	// AllowCoarsePKIWrite enables legacy "pki" write fallback for native /pki routes (lab).
	// Production profile forces false (W80-03).
	AllowCoarsePKIWrite bool
	// ExposureReplayStore when set enables shared HA replay protection for exposure reports (W80-06).
	// Prefer Valkey/IncrStore; falls back to process-local map inside ExposureSigning.
	ExposureReplayStore middleware.ExposureReplayStore
	// AuthOIDCEnabled registers POST /auth/oidc/:role when true (M-DTP-2).
	AuthOIDCEnabled bool
	// AuthLDAPEnabled registers POST /auth/ldap when true (M-DTP-2).
	AuthLDAPEnabled bool
}

RouterDeps groups handlers wired into the HTTP router.