proxy

Documentation

Overview

Package proxy routes /api/<component-path>/… to component backends: long-running runtimes over their unix sockets (blue/green targets from the runner), cgi per-request. It enforces the gateway side of the RBAC model: strips inbound X-XBin-* headers, consults the policy, and injects the verified caller identity (plans/auth.md §3).

Index

• Constants
• func DefaultPolicy(p auth.Principal, target *registry.Component) (string, bool)
• type Policy
• type Proxy
  • func (px *Proxy) ForwardIngress(w http.ResponseWriter, r *http.Request, rt ingress.Route, viaTerminator bool)
  • func (px *Proxy) ServeHTTP(w http.ResponseWriter, r *http.Request)

Constants

const (
	HeaderFrom = "X-XBin-From"
	HeaderRole = "X-XBin-Role"
	// HeaderUser / HeaderUserLevel attribute the HUMAN driving the call (D29):
	// set when a signed-in user is behind the request — directly (session) or
	// riding an element principal (frame token, tile terminal). Absent for
	// automation (instance tokens, cron) and the bootstrap owner token.
	// Backends use these to gate in-app (read vs write UI, per-user state) —
	// trustworthy because inbound X-XBin-* is stripped.
	HeaderUser      = "X-XBin-User"
	HeaderUserLevel = "X-XBin-User-Level"
)

const HeaderIngressHost = "X-XBin-Ingress-Host"

HeaderIngressHost carries the public hostname the request arrived on (the Host header is also preserved; this survives any client-set Host games).

Functions

func DefaultPolicy

func DefaultPolicy(p auth.Principal, target *registry.Component) (string, bool)

Types

type Policy

type Policy func(p auth.Principal, target *registry.Component) (role string, ok bool)

Policy decides whether principal p may call target, and at which role. Installed by the broker (phase 4); the default allows owner and self-calls only.

type Proxy

type Proxy struct {
	Reg    *registry.Registry
	Runner *runner.Runner
	Hub    *events.Hub
	Policy Policy

	// UserLevel resolves the attributed user's access level on a tile for
	// the X-XBin-User-Level header (D29). Installed by main from the user
	// store; nil = header omitted.
	UserLevel func(userID, tile string) string
	// contains filtered or unexported fields
}

func (*Proxy) ForwardIngress

func (px *Proxy) ForwardIngress(w http.ResponseWriter, r *http.Request, rt ingress.Route, viaTerminator bool)

ForwardIngress proxies one admitted public request to rt's backend. The runtime listener passes viaTerminator=false (xbind saw the client directly, so it stamps X-Forwarded-*); a terminator tile's forward socket passes true (the terminator already stamped them and its RemoteAddr is a meaningless unix peer).

func (*Proxy) ServeHTTP

func (px *Proxy) ServeHTTP(w http.ResponseWriter, r *http.Request)