Files
bootnode/api/handlers/auth.go
T
zeekayandGitHub 97321f67b0 feat: Go rewrite scaffold — ZAP-first, Mount() per HIP-0106 (#1)
Adds a Go subsystem alongside the existing Python FastAPI service so
bootnode can fold into `superbase` per HIP-0106. The Python service in
`api/bootnode/` stays untouched.

What landed:

- `schema/bootnode.zap` — public typed surface (chains, RPC, tokens,
  NFTs, transfers, smart wallets, ERC-4337, gas, webhooks, fleets,
  nodes, usage). No `.capnp` anywhere — ZAP only, per brand policy.
- `zap/gen/` — hand-rolled Go bindings that match what `zapc generate`
  emits, so `go build` works without zapc installed locally.
- `api/mount.go` — the HIP-0106 contract:
    func Mount(r chi.Router, deps Deps) error
  mounts every FastAPI-parity route group through `api/handlers/`.
- `api/deps.go` — cross-subsystem ZAP client interfaces (IAM, KMS,
  Base, O11y, Commerce). No business logic, no hard imports — keeps
  the Bootnode module independent of sibling subsystems until they
  ship their typed clients.
- `api/handlers/` — 149 chi routes mounted (Python has 150). Each
  handler body is a 501 stub with a `TODO(bootnode-port)` pointing at
  the Python file + symbol to port.
- `api/middleware/` — IAM-backed auth, OTEL-friendly telemetry,
  per-org rate limit (stub).
- `api/store/` — per-tenant SQLite access via `deps.Base.Open(orgID,
  "bootnode")` per HIP-0302.
- `api/web3/` — chain registry + RPC pool surface (production version
  prefers luxfi/* over upstream go-ethereum).
- `cmd/bootnode/main.go` — standalone shim; same `api.Mount` superbase
  calls in production.
- `docs/PYTHON_TO_GO_PORT.md` — endpoint-by-endpoint port map.

Build: `go build ./...` and `go vet ./...` clean. Standalone shim
smokes 200 on /health, /ready, /v1/chains; 401 on auth-required
endpoints with no JWT; 501 on every TODO route.

Out of scope (not in this commit):
- Handler bodies (Phase 2 — porting in RPC → tokens → NFTs → ...
  priority order).
- superbase wiring (lands when the superbase repo opens its main).
- Python service removal (stays until handlers reach prod parity).
2026-05-18 23:36:46 -07:00

34 lines
1.2 KiB
Go

package handlers
import (
"net/http"
"github.com/go-chi/chi/v5"
)
// MountAuth registers /v1/auth/* (local-dev auth + IAM OAuth bridge).
// In production every authenticated request flows through deps.IAM —
// the local register/login paths exist for dev parity only.
func MountAuth(r chi.Router, _ Deps) {
r.Route("/auth", func(r chi.Router) {
r.Post("/register", func(w http.ResponseWriter, _ *http.Request) {
// TODO(bootnode-port): port from bootnode/api/auth/__init__.py:register —
// MUST bcrypt the password (golang.org/x/crypto/bcrypt). Never plaintext.
stub(w, "auth/register")
})
r.Post("/login", func(w http.ResponseWriter, _ *http.Request) {
// TODO(bootnode-port): port from bootnode/api/auth/__init__.py:login
stub(w, "auth/login")
})
r.Get("/me", func(w http.ResponseWriter, _ *http.Request) {
// TODO(bootnode-port): port from bootnode/api/auth/__init__.py:me
stub(w, "auth/me")
})
r.Post("/oauth/callback", func(w http.ResponseWriter, _ *http.Request) {
// TODO(bootnode-port): port from bootnode/api/auth/__init__.py:oauth_callback —
// exchange code at hanzo.id, return bearer.
stub(w, "auth/oauth/callback")
})
})
}