zeekay
c581e0af7b
zip is shared protocol infra (the fiber-over-ZAP web framework used by every
Lux/Hanzo/Zoo Go binary — nodes, gateway, cloud, iam, kms, o11y, ai, …), so its
home is the ZAP protocol family (zap-proto/{go,http,zapd,zip}), NOT any one org's
brand namespace. This consolidates the rich framework (formerly hanzoai/zip v0.5.0
— Ctx/Handler/Errorf/Err*/HTTPError, typed handlers, middleware, runtime/extension
loading, openapi, validate, zaprpc) with the real ZAP transport (ListenZAP/
ListenHTTP/Serve over zap-proto/http) into ONE canonical module.
Module path github.com/hanzoai/zip -> github.com/zap-proto/zip. Code identical to
hanzoai/zip v0.5.0; promoted to v1.0.0 as the stable shared-infra framework. The
prior hanzoai/zip lineage is retired — one home, one import path, one way.
Verified: go build/vet/test ./... green; the ZAP round-trip integration test serves
/v1/health over the real ZAP transport (200 + handler JSON).
1.8 KiB
zip middleware
Generic middleware for the zip framework. Auth-specific middleware
(JWT validation, identity-header stripping) lives in
github.com/hanzoai/gateway/middleware
— see "Why auth lives in gateway" below.
Available middleware
| Name | Purpose |
|---|---|
Recover() |
panic → JSON 500 |
Logger(luxlog.Logger) |
request log via luxfi/log |
RequestID() |
X-Request-Id propagation |
Timeout(d) |
per-request ctx deadline |
MaxBody(n) |
request size limit |
CORS(opts) |
standard CORS |
RateLimit(opts) |
per-key token bucket |
Telemetry(o11yClient) |
OTel span + request metrics |
Why auth lives in gateway
JWT validation + identity-header minting are the responsibility of the
gateway subsystem (per HIP-0106). Other subsystems mounted inside the
unified cloud binary trust the gateway-minted X-Org-Id header and do
NOT re-validate JWTs themselves — re-running JWT validation per-subsystem
is wasteful and risks divergent validation rules.
Subsystems that need to ASSERT the request was gateway-minted import
github.com/hanzoai/gateway and call gateway.AssertGatewayMinted(c).
Pipeline order
Recommended order for a service that mounts zip behind hanzoai/gateway:
app.Use(
middleware.Recover(), // 1. always first
middleware.RequestID(), // 2. mint request id
middleware.Logger(app.Logger()), // 3. log with request id
middleware.Telemetry(o11y), // 4. metrics
middleware.RateLimit(rlCfg), // 5. limit
middleware.CORS(corsCfg), // 6. last — close to response
)
JWT validation + identity-header stripping/minting is owned by the
gateway subsystem; see
github.com/hanzoai/gateway/middleware.