mirror of
https://github.com/hanzoai/gateway.git
synced 2026-10-30 15:04:44 +00:00
zeekayandGitHub
ca31860513
* feat(cloud-mount): port gateway to HIP-0106 Mount(*zip.App, cloud.Deps)
Add pkg/gateway/mount.go (build tag: cloud) exposing the canonical
HIP-0106 contract so the unified hanzoai/cloud binary can co-resident
the gateway trust boundary without standing a second JWT validator up
in-process.
The mount does three things:
1. Installs the existing NewAuthMiddleware as a zip middleware via a
gin -> net/http -> zip adaptor. Same strip-list, same JWKS cache,
same X-* mint list as the standalone cmd/gateway binary — one
trust boundary, one implementation.
2. Registers a native zip /_/gateway/healthz endpoint independent of
the auth chain so probes work even with a misconfigured JWKS.
3. Best-effort loads the routes table from GATEWAY_ROUTES_FILE; a
missing file is non-fatal in cloud-mode (co-resident subsystems
own their own routes), unlike the standalone path which fails
closed.
Build tag isolation: the standalone gateway binary (KrakenD/Lura,
vendor mode, ghcr.io/hanzoai/gateway) builds with `-mod=vendor` and
must NOT pull hanzoai/cloud + hanzoai/zip into its vendor tree. The
`//go:build cloud` constraint on mount.go + mount_test.go keeps the
default build path clean. Build the cloud variant with `-tags=cloud`.
Wiring:
- init() registers ("gateway", order=80) in cloud.Registry — runs
before commerce(100) so identity headers are minted upstream of
every subsystem.
- go.mod gains the hanzoai/cloud + hanzoai/zip requires (gated by
tag at the import sites), pinned via local ../ replace.
Tests:
- TestMount_RegistersHealthAndRegistry boots a fresh zip.App, mounts
gateway with AUTH_ENABLED=false, asserts /_/gateway/healthz answers.
- cmd/gateway still builds clean with `-mod=vendor` (the standalone
KrakenD path).
Schema: schema/gateway.zap describes Health service for zapc codegen.
* refactor: collapse pkg/gateway/ → root for clean import path
Subsystem code lives in package gateway at repo root. Importers now use
`github.com/hanzoai/gateway` (no /pkg/gateway/ nesting). Standalone shim moved
to cmd/gateway/ where applicable.
Per Hanzo Go-stdlib pattern: repo IS the package.
* refactor: flatten import path — github.com/hanzoai/cloud (drop /pkg/cloud)
24 lines
803 B
Plaintext
24 lines
803 B
Plaintext
// gateway.zap — ZAP schema for the Gateway subsystem.
|
|
//
|
|
// HIP-0106 unified-binary contract. Gateway is the trust boundary in
|
|
// the unified cloud binary — it validates JWTs against the configured
|
|
// JWKS, strips client-supplied identity headers, and mints the
|
|
// gateway-authorized X-Org-Id / X-User-Id / X-Roles / X-User-Email /
|
|
// X-User-IsAdmin / X-Phone-Number / X-User-Permissions set per HIP-0026.
|
|
|
|
package gateway.v1;
|
|
|
|
service Health {
|
|
// Check returns OK when the gateway middleware is wired and the
|
|
// JWKS cache is reachable.
|
|
Check(HealthRequest) -> HealthResponse;
|
|
}
|
|
|
|
message HealthRequest {}
|
|
|
|
message HealthResponse {
|
|
string status = 1; // "ok"
|
|
bool auth_enabled = 2; // true when AUTH_ENABLED=true
|
|
string issuer = 3; // JWT issuer (e.g. https://hanzo.id)
|
|
}
|