connections

Documentation

Overview

Package connections is the successor to internal/sources.

A source could only ever PULL. A connection is a connector that may also be pushed to (Receiver) or act outward (Actor) — the three verbs discovered by type assertion rather than declared up front, so a connector implements only what it actually does.

This file is the Receiver half, and it starts here because the schema for it has existed since migration 0013 with zero Go references. Push ingestion was designed carefully — hashed path tokens, vault-held signing keys, a namespace CHECK that stops an unauthenticated POST reaching a private brain, a rate limit, sources that land disabled — and then never built.

Index

• Constants
• type Receiver
  • func NewReceiver(db *sql.DB, log *slog.Logger, brain Retainer, vault Revealer) *Receiver
  • func (r *Receiver) Deliver(w http.ResponseWriter, req *http.Request)
  • func (r *Receiver) Routes(router chi.Router)
• type Retainer
• type Revealer

Constants

const MaxBody = 1 << 20 // 1 MiB

MaxBody caps what a delivery may carry.

The endpoint is public and unauthenticated by construction — the URL's path token IS the credential — so an unbounded read is a memory-exhaustion vector that needs no valid signature to fire. The cap applies BEFORE the signature check for exactly that reason.

Types

type Receiver

type Receiver struct {
	// contains filtered or unexported fields
}

Receiver serves webhook deliveries.

func NewReceiver

func NewReceiver(db *sql.DB, log *slog.Logger, brain Retainer, vault Revealer) *Receiver

func (*Receiver) Deliver

func (r *Receiver) Deliver(w http.ResponseWriter, req *http.Request)

Deliver handles POST /api/builder/hooks/{token}.

Unauthenticated by design: the path token is the credential. Everything that follows is therefore written for a caller who is not trusted.

func (*Receiver) Routes

func (r *Receiver) Routes(router chi.Router)

Routes mounts the public delivery endpoint.

PUBLIC on purpose, and it must stay that way: a webhook sender has no session and never will. The path token is the credential and the HMAC is the authentication, which is why both are enforced above rather than delegated to a middleware that a future refactor could mount this behind.

type Retainer

type Retainer interface {
	Retain(ctx context.Context, namespace, text string, importance float64) (string, error)
}

Retainer is the brain, narrowed to the one call this package makes.

type Revealer

type Revealer interface {
	RevealFor(ctx context.Context, name, principal, runID string) (string, error)
}

Revealer is the vault, narrowed the same way.