server

Documentation

Index

• Constants
• Variables
• func MetricsHandler() http.Handler
• func ObserveGoogleGroupRequest(operation, outcome string, elapsed time.Duration)
• func ParseDefaultDocPermission(value string) (repo.Role, bool)
• func ValidateEmbeddedBridge() error
• func ValidateRenderOrigin(appOrigin, renderOrigin string) error
• type Config
• type FeaturedSection
  • func ParseFeatured(raw string) ([]FeaturedSection, error)
• type Option
  • func WithAuthenticator(a auth.Authenticator) Option
  • func WithCommentNotificationSender(sender notifications.Sender) Option
  • func WithDocumentKVEvents(events kvevents.Subscriber) Option
  • func WithGoogleGroupDirectory(directory googlegroups.GoogleGroupDirectory) Option
  • func WithReadinessCheck(name string, fn func(context.Context) error) Option
  • func WithRepository(r repo.Repository) Option
  • func WithStateStore(st auth.LoginStateStore) Option
• type Server
  • func New(cfg Config, opts ...Option) *Server
  • func (s *Server) Handler() http.Handler
  • func (s *Server) RunCommentNotifications(ctx context.Context)

Constants

const (
	DeploymentPublic = "public"
	DeploymentOrg    = "org"
)

Deployment types. A public deployment lets anyone who can authenticate with the identity provider in; an org deployment gates login to the org's domains. The only authz difference is the login gate — the document ACL is identical.

const (
	EnvProduction = "production"
)

Environment values for Config.Environment.

Variables

var (
	BuildVersion = "dev"
	BuildCommit  = ""
)

BuildVersion and BuildCommit are set with -ldflags in release builds.

var BuildBridgeSourceHash string

BuildBridgeSourceHash is the bridge source fingerprint, linked at build time.

var ErrUnsafeRenderOrigin = errors.New("app and render origins are not isolated by hostname")

ErrUnsafeRenderOrigin marks the one render-origin validation failure that the explicit local-development escape hatch may override. Invalid origins must remain fatal even when that escape hatch is set.

Functions

func MetricsHandler

func MetricsHandler() http.Handler

MetricsHandler serves Prometheus metrics. It is mounted on a separate, private listener (see cmd/slashdocs-server) so /metrics is never exposed on the public app port.

func ObserveGoogleGroupRequest

func ObserveGoogleGroupRequest(operation, outcome string, elapsed time.Duration)

func ParseDefaultDocPermission

func ParseDefaultDocPermission(value string) (repo.Role, bool)

ParseDefaultDocPermission maps the default-sharing vocabulary (viewer | commenter | editor | private) to a repo.Role. "private" is repo.RoleNone: no grant is applied. Callers own the unset/absent case and their own error wording; the second return is false for anything else.

func ValidateEmbeddedBridge

func ValidateEmbeddedBridge() error

ValidateEmbeddedBridge rejects production startup when the generated iframe bridge is absent, stale, or corrupt. Supported server builds link BuildBridgeSourceHash from a fingerprint covering every TypeScript source under frontend/bridge/, so a change to any bridge module invalidates an outdated bundle.

func ValidateRenderOrigin

func ValidateRenderOrigin(appOrigin, renderOrigin string) error

ValidateRenderOrigin refuses an app/render origin pair that shares a hostname. Uploaded HTML is untrusted; scheme and port do not isolate host-scoped cookies, so rendering it on the app host lets a malicious document script against the app itself (session cookies, API calls). Startup code may downgrade this error to a loud warning when SLASHDOCS_ALLOW_UNSAFE_RENDER_ORIGIN=true opts into the risk (dev/demo only).

Types

type Config

type Config struct {
	Environment  string
	AppOrigin    string
	RenderOrigin string
	// PreviousOrigins are app origins that this deployment used before. A
	// request to one of them is sent to AppOrigin (see movedOriginMiddleware).
	PreviousOrigins     []string
	OIDC                auth.OIDC
	OIDCProviderName    string
	SessionSecret       string
	AllowedOAuthDomains []string
	// Deployment is "public" or "org". OrgName labels the org in UI copy.
	Deployment string
	OrgName    string
	// DefaultDocPermission is the role granted to the "anyone" principal on
	// newly created documents when the request does not override it via the
	// default_permission form field. repo.RoleNone means private: no grant.
	DefaultDocPermission      repo.Role
	Featured                  []FeaturedSection
	GitHubClientID            string
	GitHubClientSecret        string
	GoogleGroupsEnabled       bool
	GoogleGroupsMembershipTTL time.Duration
	GoogleGroupsRetryCooldown time.Duration
	// DisableLabels is a temporary rollout switch. It defaults to false so
	// programmatic users of server.New retain the existing feature set unless
	// the application entrypoint explicitly disables labels.
	DisableLabels bool
}

Config holds static configuration for the server.

type FeaturedSection

type FeaturedSection struct {
	Title       string   `json:"-"`
	Description string   `json:"description"`
	Permanent   bool     `json:"permanent"` // Principals cannot hide the items.
	Items       []string `json:"items"`     // Document and folder IDs.
}

FeaturedSection is one titled row of documents and folders that the Documents page shows to every principal above their own items.

func ParseFeatured

func ParseFeatured(raw string) ([]FeaturedSection, error)

ParseFeatured reads the SLASHDOCS_FEATURED JSON object. Each key is a section title, and the key order is the section order.

type Option

type Option func(*dependencies)

Option configures the Server.

func WithAuthenticator

func WithAuthenticator(a auth.Authenticator) Option

func WithCommentNotificationSender

func WithCommentNotificationSender(sender notifications.Sender) Option

func WithDocumentKVEvents

func WithDocumentKVEvents(events kvevents.Subscriber) Option

WithDocumentKVEvents supplies the process-wide persisted-event broker used by document KV SSE streams.

func WithGoogleGroupDirectory

func WithGoogleGroupDirectory(directory googlegroups.GoogleGroupDirectory) Option

func WithReadinessCheck

func WithReadinessCheck(name string, fn func(context.Context) error) Option

func WithRepository

func WithRepository(r repo.Repository) Option

func WithStateStore

func WithStateStore(st auth.LoginStateStore) Option

type Server

type Server struct {
	// contains filtered or unexported fields
}

Server wraps the gin engine.

func New

func New(cfg Config, opts ...Option) *Server

New constructs and returns a configured Server. The authenticator defaults to one that denies every request, and a repository must be supplied via WithRepository outside of tests.

func (*Server) Handler

func (s *Server) Handler() http.Handler

func (*Server) RunCommentNotifications

func (s *Server) RunCommentNotifications(ctx context.Context)