zeekayandHanzo Dev 37374e4c70 feat: migrate the HTTP layer from gofiber/fiber v2 to zap-proto/zip v1.10.0 ...

zip (a fiber v3 fork) is the fleet-wide Go web framework. Handlers are now
func(c *zip.Ctx) error; routes, groups and middleware move to the zip surface.

The published API is byte-for-byte unchanged. All 20 declared routes keep their
method, path, status codes and response bodies; the route table was dumped from
both trees and diffed to prove it, and is now pinned by declaredRoutes in
api/routes_test.go so no future refactor can move it silently.

Three deltas the framework bump would otherwise have shipped, and how each is held:

- fiber v3's c.JSON() tags bodies "application/json; charset=utf-8"; v2 sent
  bare "application/json". api.writeJSON restores it — one helper, six sites.
- fiber v2 listed auto-HEAD mirrors as routes; v3 generates them lazily at first
  serve. HEAD still answers 200 on every GET route, pinned by a new test.
- zip.Config exposes no Immutable knob, so request-scoped strings are no longer
  copied on read. Audited every param/query/header/cookie read: the only value
  that outlives its handler is the external-endpoint error string, which lands
  in the store, so it is now explicitly cloned. Every other key flows into a map
  lookup or a SQL arg and is never retained.

Bridges rather than rewrites, so nothing is reimplemented badly:
- zipx.Wrap is the single fiber.Handler -> zip.Handler adapter, used for the
  cors/recover/compress/redirect/static middleware and for basicauth.
- zip.AdaptNetHTTP fronts the Prometheus metrics handler; AdaptNetHTTPFunc the
  OIDC callback; AdaptNetHTTPMiddleware the g8 session gate.
- security.Router is the narrow slice of zip's router surface that package
  needs, so *zip.App and a Group both satisfy it.
- controller.Handle listens via app.Fiber().Listen(addr, fiber.ListenConfig) —
  TLS as a value in one listen path, because zip.Listen carries no TLS or
  dual-stack knob. This is the only escape from the zip surface.

Route-level coverage added where there was none: the pinned route table, a walk
asserting every route dispatches to a handler, HEAD mirroring, and the 404 tail
of the static fallback chain.

client, config/endpoint and metrics fail identically before and after this
change (network-dependent tests and a pre-existing metrics_test build break);
verified by stashing and re-running.

Co-authored-by: Hanzo Dev <[email protected]>

2026-08-04 09:19:50 -07:00

..

zipx.go

feat: migrate the HTTP layer from gofiber/fiber v2 to zap-proto/zip v1.10.0

2026-08-04 09:19:50 -07:00