mirror of
https://github.com/hanzoai/o11y.git
synced 2026-11-03 02:04:48 +00:00
zeekayandHanzo Dev
3011b92ea4
gorilla/mux, otelmux, gorilla/handlers and rs/cors leave go.mod. Every route the runtime serves is a zip route on a zip group: 233 from the apiserver tree, 134 from query-service, 367 total — the same 367 the mount publishes. pkg/http/routing is the one registration surface. It exists because a registration carries three facts zip has no slot for, and the tree this replaces recovered all three PER REQUEST by asking the router what it had just matched: the bound segments, the path template, and the route's declared resources. mux.CurrentRoute(req).GetHandler() was type-asserted back to handler.Handler in two separate packages to re-derive at request time what was already known once at boot. Stating them at registration deletes both lookups. The middleware chain is composed at the LEAF rather than registered ambient, because Audit keys on the route template and Resource resolves the route's declared resources — ambient middleware runs before the router has matched, so both would read an empty route. Per-leaf composition reproduces the order the old tree ran in exactly: match, then middleware, then handler. Duplicate registration now panics at boot; gorilla let the first one win. The Sentry ingest constraint becomes fiber's own guid — a UUID parse instead of a hand-written character class. Paths keep their public brace spelling in the source and in the table; the respelling happens in one function. The standalone server hands its listener to the app, so streams and the websocket upgrade run native fasthttp. Counted, not asserted: routes_test.go in the apiserver pins 233 against the real AddToRouter, routing_test.go pins the table against the router itself. This repo has already shipped 83 typed ops that reached no router while the suite stayed green — an uncalled func is legal Go, so arithmetic is the test. Co-authored-by: Hanzo Dev <[email protected]>
147 lines
6.0 KiB
Go
147 lines
6.0 KiB
Go
package o11yapiserver
|
|
|
|
import (
|
|
"net/http"
|
|
|
|
"github.com/hanzoai/o11y/pkg/http/handler"
|
|
"github.com/hanzoai/o11y/pkg/http/routing"
|
|
"github.com/hanzoai/o11y/pkg/types"
|
|
"github.com/hanzoai/o11y/pkg/types/authtypes"
|
|
"github.com/hanzoai/o11y/pkg/types/coretypes"
|
|
)
|
|
|
|
// ALL FIVE role routes are ALSO declared as typed ops at the module's mount
|
|
// seam (access.go in the repo root), which is what carries them into the
|
|
// composed document, the SDK, the CLI and the agent surface. That is a second
|
|
// DISPATCH, never a second implementation: the ops answer by handing the call
|
|
// to this router, so the CheckResources gate and the handlers below stay the
|
|
// one place role access control is performed. Both are needed — the ops serve
|
|
// the composed binary, this router serves the standalone process, which has no
|
|
// native router to register an op on — so deleting either half drops one of
|
|
// the two deployments.
|
|
func (provider *provider) addRoleRoutes(router routing.Router) {
|
|
router.Post("/v1/o11y/roles", handler.New(
|
|
provider.authzMiddleware.CheckResources(provider.authzHandler.Create, authtypes.O11yAdminRoleName),
|
|
handler.OpenAPIDef{
|
|
ID: "CreateRole",
|
|
Tags: []string{"role"},
|
|
Summary: "Create role",
|
|
Description: "This endpoint creates a role",
|
|
Request: new(authtypes.PostableRole),
|
|
RequestContentType: "",
|
|
Response: new(types.Identifiable),
|
|
ResponseContentType: "application/json",
|
|
SuccessStatusCode: http.StatusCreated,
|
|
ErrorStatusCodes: []int{http.StatusBadRequest, http.StatusConflict, http.StatusNotImplemented, http.StatusUnavailableForLegalReasons},
|
|
Deprecated: false,
|
|
SecuritySchemes: newScopedSecuritySchemes([]string{coretypes.ResourceRole.Scope(coretypes.VerbCreate)}),
|
|
},
|
|
handler.WithResourceDefs(handler.BasicResourceDef{
|
|
Resource: coretypes.ResourceRole,
|
|
Verb: coretypes.VerbCreate,
|
|
Category: coretypes.ActionCategoryAccessControl,
|
|
ID: coretypes.ResponseJSONPath("data.id"),
|
|
Selector: coretypes.WildcardSelector,
|
|
}),
|
|
))
|
|
|
|
router.Get("/v1/o11y/roles", handler.New(
|
|
provider.authzMiddleware.CheckResources(provider.authzHandler.List, authtypes.O11yAdminRoleName),
|
|
handler.OpenAPIDef{
|
|
ID: "ListRoles",
|
|
Tags: []string{"role"},
|
|
Summary: "List roles",
|
|
Description: "This endpoint lists all roles",
|
|
Request: nil,
|
|
RequestContentType: "",
|
|
Response: make([]*authtypes.Role, 0),
|
|
ResponseContentType: "application/json",
|
|
SuccessStatusCode: http.StatusOK,
|
|
ErrorStatusCodes: []int{},
|
|
Deprecated: false,
|
|
SecuritySchemes: newScopedSecuritySchemes([]string{coretypes.ResourceRole.Scope(coretypes.VerbList)}),
|
|
},
|
|
handler.WithResourceDefs(handler.BasicResourceDef{
|
|
Resource: coretypes.ResourceRole,
|
|
Verb: coretypes.VerbList,
|
|
Category: coretypes.ActionCategoryAccessControl,
|
|
Selector: coretypes.WildcardSelector,
|
|
}),
|
|
))
|
|
|
|
router.Get("/v1/o11y/roles/{id}", handler.New(
|
|
provider.authzMiddleware.CheckResources(provider.authzHandler.Get, authtypes.O11yAdminRoleName),
|
|
handler.OpenAPIDef{
|
|
ID: "GetRole",
|
|
Tags: []string{"role"},
|
|
Summary: "Get role",
|
|
Description: "This endpoint gets a role",
|
|
Request: nil,
|
|
RequestContentType: "",
|
|
Response: new(authtypes.RoleWithTransactionGroups),
|
|
ResponseContentType: "application/json",
|
|
SuccessStatusCode: http.StatusOK,
|
|
ErrorStatusCodes: []int{},
|
|
Deprecated: false,
|
|
SecuritySchemes: newScopedSecuritySchemes([]string{coretypes.ResourceRole.Scope(coretypes.VerbRead)}),
|
|
},
|
|
handler.WithResourceDefs(handler.BasicResourceDef{
|
|
Resource: coretypes.ResourceRole,
|
|
Verb: coretypes.VerbRead,
|
|
Category: coretypes.ActionCategoryAccessControl,
|
|
ID: coretypes.PathParam("id"),
|
|
Selector: provider.roleSelector,
|
|
}),
|
|
))
|
|
|
|
router.Put("/v1/o11y/roles/{id}", handler.New(
|
|
provider.authzMiddleware.CheckResources(provider.authzHandler.Update, authtypes.O11yAdminRoleName),
|
|
handler.OpenAPIDef{
|
|
ID: "UpdateRole",
|
|
Tags: []string{"role"},
|
|
Summary: "Update role",
|
|
Description: "This endpoint updates a role",
|
|
Request: new(authtypes.UpdatableRole),
|
|
RequestContentType: "",
|
|
Response: nil,
|
|
ResponseContentType: "application/json",
|
|
SuccessStatusCode: http.StatusNoContent,
|
|
ErrorStatusCodes: []int{http.StatusNotFound, http.StatusNotImplemented, http.StatusUnavailableForLegalReasons},
|
|
Deprecated: false,
|
|
SecuritySchemes: newScopedSecuritySchemes([]string{coretypes.ResourceRole.Scope(coretypes.VerbUpdate)}),
|
|
},
|
|
handler.WithResourceDefs(handler.BasicResourceDef{
|
|
Resource: coretypes.ResourceRole,
|
|
Verb: coretypes.VerbUpdate,
|
|
Category: coretypes.ActionCategoryAccessControl,
|
|
ID: coretypes.PathParam("id"),
|
|
Selector: provider.roleSelector,
|
|
}),
|
|
))
|
|
|
|
router.Delete("/v1/o11y/roles/{id}", handler.New(
|
|
provider.authzMiddleware.CheckResources(provider.authzHandler.Delete, authtypes.O11yAdminRoleName),
|
|
handler.OpenAPIDef{
|
|
ID: "DeleteRole",
|
|
Tags: []string{"role"},
|
|
Summary: "Delete role",
|
|
Description: "This endpoint deletes a role",
|
|
Request: nil,
|
|
RequestContentType: "",
|
|
Response: nil,
|
|
ResponseContentType: "application/json",
|
|
SuccessStatusCode: http.StatusNoContent,
|
|
ErrorStatusCodes: []int{http.StatusNotFound, http.StatusNotImplemented, http.StatusUnavailableForLegalReasons},
|
|
Deprecated: false,
|
|
SecuritySchemes: newScopedSecuritySchemes([]string{coretypes.ResourceRole.Scope(coretypes.VerbDelete)}),
|
|
},
|
|
handler.WithResourceDefs(handler.BasicResourceDef{
|
|
Resource: coretypes.ResourceRole,
|
|
Verb: coretypes.VerbDelete,
|
|
Category: coretypes.ActionCategoryAccessControl,
|
|
ID: coretypes.PathParam("id"),
|
|
Selector: provider.roleSelector,
|
|
}),
|
|
))
|
|
}
|