Documentation
¶
Index ¶
- Constants
- func APIKey(r *http.Request) database.APIKey
- func APIKeyFromRequest(ctx context.Context, db database.Store, ...) (*database.APIKey, codersdk.Response, bool)
- func APIKeyOptional(r *http.Request) (database.APIKey, bool)
- func APITokenFromRequest(r *http.Request) string
- func AsAuthzSystem(mws ...func(http.Handler) http.Handler) func(http.Handler) http.Handler
- func AttachRequestID(next http.Handler) http.Handler
- func CSPHeaders(telemetry bool, websocketHosts func() []string, ...) func(next http.Handler) http.Handler
- func CSRF(secureCookie bool) func(next http.Handler) http.Handler
- func Cors(allowAll bool, origins ...string) func(next http.Handler) http.Handler
- func CustomRedirectToLogin(rw http.ResponseWriter, r *http.Request, redirect string, message string, ...)
- func EnsureXForwardedForHeader(req *http.Request) error
- func ExternalAuthParam(r *http.Request) *externalauth.Config
- func ExtractAPIKey(rw http.ResponseWriter, r *http.Request, cfg ExtractAPIKeyConfig) (*database.APIKey, *rbac.Subject, bool)
- func ExtractAPIKeyMW(cfg ExtractAPIKeyConfig) func(http.Handler) http.Handler
- func ExtractExternalAuthParam(configs []*externalauth.Config) func(next http.Handler) http.Handler
- func ExtractGroupByNameParam(db database.Store) func(http.Handler) http.Handler
- func ExtractGroupParam(db database.Store) func(http.Handler) http.Handler
- func ExtractNotificationTemplateParam(db database.Store) func(http.Handler) http.Handler
- func ExtractOAuth2(config promoauth.OAuth2Config, client *http.Client, ...) func(http.Handler) http.Handler
- func ExtractOAuth2ProviderApp(db database.Store) func(http.Handler) http.Handler
- func ExtractOAuth2ProviderAppSecret(db database.Store) func(http.Handler) http.Handler
- func ExtractOrganizationMemberParam(db database.Store) func(http.Handler) http.Handler
- func ExtractOrganizationParam(db database.Store) func(http.Handler) http.Handler
- func ExtractProvisionerDaemonAuthenticated(opts ExtractProvisionerAuthConfig) func(next http.Handler) http.Handler
- func ExtractProvisionerKeyParam(db database.Store) func(http.Handler) http.Handler
- func ExtractRealIP(config *RealIPConfig) func(next http.Handler) http.Handler
- func ExtractRealIPAddress(config *RealIPConfig, req *http.Request) (net.IP, error)
- func ExtractTemplateParam(db database.Store) func(http.Handler) http.Handler
- func ExtractTemplateVersionParam(db database.Store) func(http.Handler) http.Handler
- func ExtractUserContext(ctx context.Context, db database.Store, rw http.ResponseWriter, ...) (user database.User, ok bool)
- func ExtractUserParam(db database.Store) func(http.Handler) http.Handler
- func ExtractUserParamOptional(db database.Store) func(http.Handler) http.Handler
- func ExtractWorkspaceAgentAndLatestBuild(opts ExtractWorkspaceAgentAndLatestBuildConfig) func(http.Handler) http.Handler
- func ExtractWorkspaceAgentParam(db database.Store) func(http.Handler) http.Handler
- func ExtractWorkspaceAndAgentParam(db database.Store) func(http.Handler) http.Handler
- func ExtractWorkspaceBuildParam(db database.Store) func(http.Handler) http.Handler
- func ExtractWorkspaceParam(db database.Store) func(http.Handler) http.Handler
- func ExtractWorkspaceProxy(opts ExtractWorkspaceProxyConfig) func(http.Handler) http.Handler
- func ExtractWorkspaceProxyParam(db database.Store, deploymentID string, ...) func(http.Handler) http.Handler
- func ExtractWorkspaceResourceParam(db database.Store) func(http.Handler) http.Handler
- func FilterUntrustedOriginHeaders(config *RealIPConfig, req *http.Request)
- func GroupParam(r *http.Request) database.Group
- func HSTS(next http.Handler, cfg HSTSConfig) http.Handler
- func LatestBuild(r *http.Request) database.WorkspaceBuild
- func NotificationTemplateParam(r *http.Request) database.NotificationTemplate
- func OAuth2ProviderApp(r *http.Request) database.OAuth2ProviderApp
- func OAuth2ProviderAppSecret(r *http.Request) database.OAuth2ProviderAppSecret
- func OrganizationParam(r *http.Request) database.Organization
- func ParseUUIDParam(rw http.ResponseWriter, r *http.Request, param string) (uuid.UUID, bool)
- func Prometheus(register prometheus.Registerer) func(http.Handler) http.Handler
- func ProvisionerDaemonAuthenticated(r *http.Request) bool
- func ProvisionerKeyAuthOptional(r *http.Request) (database.ProvisionerKey, bool)
- func ProvisionerKeyParam(r *http.Request) database.ProvisionerKey
- func RateLimit(count int, window time.Duration) func(http.Handler) http.Handler
- func Recover(log slog.Logger) func(h http.Handler) http.Handler
- func RedirectToLogin(rw http.ResponseWriter, r *http.Request, dashboardURL *url.URL, message string)
- func ReportCLITelemetry(log slog.Logger, rep telemetry.Reporter) func(http.Handler) http.Handler
- func RequestID(r *http.Request) uuid.UUID
- func RequireAPIKeyOrProvisionerDaemonAuth() func(http.Handler) http.Handler
- func RequireAPIKeyOrWorkspaceAgent() func(http.Handler) http.Handler
- func RequireAPIKeyOrWorkspaceProxyAuth() func(http.Handler) http.Handler
- func RequireExperiment(experiments codersdk.Experiments, experiment codersdk.Experiment) func(next http.Handler) http.Handler
- func SplitAPIToken(token string) (id string, secret string, err error)
- func TemplateParam(r *http.Request) database.Template
- func TemplateVersionParam(r *http.Request) database.TemplateVersion
- func UserAuthorization(r *http.Request) rbac.Subject
- func UserAuthorizationOptional(r *http.Request) (rbac.Subject, bool)
- func UserParam(r *http.Request) database.User
- func UserParamOptional(r *http.Request) (database.User, bool)
- func UserRBACSubject(ctx context.Context, db database.Store, userID uuid.UUID, ...) (rbac.Subject, database.UserStatus, error)
- func WorkspaceAgent(r *http.Request) database.WorkspaceAgent
- func WorkspaceAgentOptional(r *http.Request) (database.WorkspaceAgent, bool)
- func WorkspaceAgentParam(r *http.Request) database.WorkspaceAgent
- func WorkspaceAppCors(regex *regexp.Regexp, app appurl.ApplicationURL) func(next http.Handler) http.Handler
- func WorkspaceBuildParam(r *http.Request) database.WorkspaceBuild
- func WorkspaceParam(r *http.Request) database.Workspace
- func WorkspaceProxy(r *http.Request) database.WorkspaceProxy
- func WorkspaceProxyOptional(r *http.Request) (database.WorkspaceProxy, bool)
- func WorkspaceProxyParam(r *http.Request) database.WorkspaceProxy
- func WorkspaceResourceParam(r *http.Request) database.WorkspaceResource
- type CSPFetchDirective
- type ExtractAPIKeyConfig
- type ExtractProvisionerAuthConfig
- type ExtractWorkspaceAgentAndLatestBuildConfig
- type ExtractWorkspaceProxyConfig
- type HSTSConfig
- type OAuth2Configs
- type OAuth2State
- type OrganizationMember
- type RealIPConfig
- type RealIPState
Constants ¶
const ( // Server headers. AccessControlAllowOriginHeader = "Access-Control-Allow-Origin" AccessControlAllowCredentialsHeader = "Access-Control-Allow-Credentials" AccessControlAllowMethodsHeader = "Access-Control-Allow-Methods" AccessControlAllowHeadersHeader = "Access-Control-Allow-Headers" VaryHeader = "Vary" // Client headers. OriginHeader = "Origin" AccessControlRequestMethodsHeader = "Access-Control-Request-Methods" AccessControlRequestHeadersHeader = "Access-Control-Request-Headers" )
const (
SignedOutErrorMessage = "You are signed out or your session has expired. Please sign in again to continue."
)
const ( // WorkspaceProxyAuthTokenHeader is the auth header used for requests from // external workspace proxies. // // The format of an external proxy token is: // <proxy id>:<proxy secret> // //nolint:gosec WorkspaceProxyAuthTokenHeader = "Coder-External-Proxy-Token" )
Variables ¶
This section is empty.
Functions ¶
func APIKeyFromRequest ¶
func APIKeyOptional ¶
APIKeyOptional may return an API key from the ExtractAPIKey handler.
func APITokenFromRequest ¶
APITokenFromRequest returns the api token from the request. Find the session token from: 1: The cookie 2. The coder_session_token query parameter 3. The custom auth header
API tokens for apps are read from workspaceapps/cookies.go.
func AsAuthzSystem ¶
AsAuthzSystem is a chained handler that temporarily sets the dbauthz context to System for the inner handlers, and resets the context afterwards.
TODO: Refactor the middleware functions to not require this. This is a bit of a kludge for now as some middleware functions require usage as a system user in some cases, but not all cases. To avoid large refactors, we use this middleware to temporarily set the context to a system.
func AttachRequestID ¶
AttachRequestID adds a request ID to each HTTP request.
func CSPHeaders ¶
func CSPHeaders(telemetry bool, websocketHosts func() []string, staticAdditions map[CSPFetchDirective][]string) func(next http.Handler) http.Handler
CSPHeaders returns a middleware that sets the Content-Security-Policy header for coderd.
Arguments:
- websocketHosts: a function that returns a list of supported external websocket hosts. This is to support the terminal connecting to a workspace proxy. The origin of the terminal request does not match the url of the proxy, so the CSP list of allowed hosts must be dynamic and match the current available proxy urls.
- staticAdditions: a map of CSP directives to append to the default CSP headers. Used to allow specific static additions to the CSP headers. Allows some niche use cases, such as embedding Coder in an iframe. Example: https://github.com/coder/coder/issues/15118
func CSRF ¶
CSRF is a middleware that verifies that a CSRF token is present in the request for non-GET requests. If enforce is false, then CSRF enforcement is disabled. We still want to include the CSRF middleware because it will set the CSRF cookie.
func CustomRedirectToLogin ¶ added in v2.5.0
func CustomRedirectToLogin(rw http.ResponseWriter, r *http.Request, redirect string, message string, code int)
CustomRedirectToLogin redirects the user to the login page with the `message` and `redirect` query parameters set, with a provided code
func EnsureXForwardedForHeader ¶
EnsureXForwardedForHeader ensures that the request has an X-Forwarded-For header. It uses the following logic:
- If we have a direct connection (remoteAddr == proxyAddr), then set it to remoteAddr
- If we have a proxied connection (remoteAddr != proxyAddr) and X-Forwarded-For doesn't begin with remoteAddr, then overwrite it with remoteAddr,proxyAddr
- If we have a proxied connection (remoteAddr != proxyAddr) and X-Forwarded-For begins with remoteAddr, then append proxyAddr to the original X-Forwarded-For header
- If X-Forwarded-Proto is not set, then it will be set to "https" if req.TLS != nil, otherwise it will be set to "http"
func ExternalAuthParam ¶ added in v2.2.1
func ExternalAuthParam(r *http.Request) *externalauth.Config
func ExtractAPIKey ¶
func ExtractAPIKey(rw http.ResponseWriter, r *http.Request, cfg ExtractAPIKeyConfig) (*database.APIKey, *rbac.Subject, bool)
ExtractAPIKey requires authentication using a valid API key. It handles extending an API key if it comes close to expiry, updating the last used time in the database.
If the configuration specifies that the API key is optional, a nil API key and authz object may be returned. False is returned if a response was written to the request and the caller should give up. nolint:revive
func ExtractAPIKeyMW ¶
func ExtractAPIKeyMW(cfg ExtractAPIKeyConfig) func(http.Handler) http.Handler
ExtractAPIKeyMW calls ExtractAPIKey with the given config on each request, storing the result in the request context.
func ExtractExternalAuthParam ¶ added in v2.2.1
func ExtractGroupByNameParam ¶
func ExtractGroupParam ¶
ExtraGroupParam grabs a group from the "group" URL parameter.
func ExtractNotificationTemplateParam ¶ added in v2.15.0
ExtractNotificationTemplateParam grabs a notification template from the "notification_template" URL parameter.
func ExtractOAuth2 ¶
func ExtractOAuth2(config promoauth.OAuth2Config, client *http.Client, authURLOpts map[string]string) func(http.Handler) http.Handler
ExtractOAuth2 is a middleware for automatically redirecting to OAuth URLs, and handling the exchange inbound. Any route that does not have a "code" URL parameter will be redirected. AuthURLOpts are passed to the AuthCodeURL function. If this is nil, the default option oauth2.AccessTypeOffline will be used.
func ExtractOAuth2ProviderApp ¶ added in v2.6.0
ExtractOAuth2ProviderApp grabs an OAuth2 app from the "app" URL parameter. This middleware requires the API key middleware higher in the call stack for authentication.
func ExtractOAuth2ProviderAppSecret ¶ added in v2.6.0
ExtractOAuth2ProviderAppSecret grabs an OAuth2 app secret from the "app" and "secret" URL parameters. This middleware requires the ExtractOAuth2ProviderApp middleware higher in the stack
func ExtractOrganizationMemberParam ¶
ExtractOrganizationMemberParam grabs a user membership from the "organization" and "user" URL parameter. This middleware requires the ExtractUser and ExtractOrganization middleware higher in the stack
func ExtractOrganizationParam ¶
ExtractOrganizationParam grabs an organization from the "organization" URL parameter. This middleware requires the API key middleware higher in the call stack for authentication.
func ExtractProvisionerDaemonAuthenticated ¶ added in v2.9.0
func ExtractProvisionerDaemonAuthenticated(opts ExtractProvisionerAuthConfig) func(next http.Handler) http.Handler
ExtractProvisionerDaemonAuthenticated authenticates a request as a provisioner daemon. If the request is not authenticated, the next handler is called unless Optional is true. This function currently is tested inside the enterprise package.
func ExtractProvisionerKeyParam ¶ added in v2.14.0
ExtractProvisionerKeyParam extracts a provisioner key from a name in the {provisionerKey} URL parameter.
func ExtractRealIP ¶
func ExtractRealIP(config *RealIPConfig) func(next http.Handler) http.Handler
ExtractRealIP is a middleware that uses headers from reverse proxies to propagate origin IP address information, when configured to do so.
func ExtractRealIPAddress ¶
ExtractRealIPAddress returns the original client address according to the configuration and headers. It does not mutate the original request.
func ExtractTemplateParam ¶
ExtractTemplateParam grabs a template from the "template" URL parameter.
func ExtractTemplateVersionParam ¶
ExtractTemplateVersionParam grabs template version from the "templateversion" URL parameter.
func ExtractUserContext ¶ added in v2.21.1
func ExtractUserContext(ctx context.Context, db database.Store, rw http.ResponseWriter, r *http.Request) (user database.User, ok bool)
ExtractUserContext queries the database for the parameterized `{user}` from the request URL.
func ExtractUserParam ¶
ExtractUserParam extracts a user from an ID/username in the {user} URL parameter.
func ExtractUserParamOptional ¶ added in v2.21.1
ExtractUserParamOptional does not fail if no user is present.
func ExtractWorkspaceAgentAndLatestBuild ¶ added in v2.10.0
func ExtractWorkspaceAgentAndLatestBuild(opts ExtractWorkspaceAgentAndLatestBuildConfig) func(http.Handler) http.Handler
ExtractWorkspaceAgentAndLatestBuild requires authentication using a valid agent token.
func ExtractWorkspaceAgentParam ¶
ExtractWorkspaceAgentParam grabs a workspace agent from the "workspaceagent" URL parameter.
func ExtractWorkspaceAndAgentParam ¶
ExtractWorkspaceAndAgentParam grabs a workspace and an agent from the "workspace_and_agent" URL parameter. `ExtractUserParam` must be called before this. This can be in the form of:
- "<workspace-name>.[workspace-agent]" : If multiple agents exist
- "<workspace-name>" : If one agent exists
func ExtractWorkspaceBuildParam ¶
ExtractWorkspaceBuildParam grabs workspace build from the "workspacebuild" URL parameter.
func ExtractWorkspaceParam ¶
ExtractWorkspaceParam grabs a workspace from the "workspace" URL parameter.
func ExtractWorkspaceProxy ¶
func ExtractWorkspaceProxy(opts ExtractWorkspaceProxyConfig) func(http.Handler) http.Handler
ExtractWorkspaceProxy extracts the external workspace proxy from the request using the external proxy auth token header.
func ExtractWorkspaceProxyParam ¶
func ExtractWorkspaceProxyParam(db database.Store, deploymentID string, fetchPrimaryProxy func(ctx context.Context) (database.WorkspaceProxy, error)) func(http.Handler) http.Handler
ExtractWorkspaceProxyParam extracts a workspace proxy from an ID/name in the {workspaceproxy} URL parameter.
func ExtractWorkspaceResourceParam ¶
ExtractWorkspaceResourceParam grabs a workspace resource from the "provisionerjob" URL parameter.
func FilterUntrustedOriginHeaders ¶
func FilterUntrustedOriginHeaders(config *RealIPConfig, req *http.Request)
FilterUntrustedOriginHeaders removes all known proxy headers from the request for untrusted origins, and ensures that only one copy of each proxy header is set.
func GroupParam ¶
GroupParam returns the group extracted via the ExtraGroupParam middleware.
func HSTS ¶
func HSTS(next http.Handler, cfg HSTSConfig) http.Handler
HSTS will add the strict-transport-security header if enabled. This header forces a browser to always use https for the domain after it loads https once. Meaning: On first load of product.coder.com, they are redirected to https. On all subsequent loads, the client's local browser forces https. This prevents man in the middle.
This header only makes sense if the app is using tls.
Full header example: Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
func LatestBuild ¶ added in v2.10.0
func LatestBuild(r *http.Request) database.WorkspaceBuild
LatestBuild returns the Latest Build from the ExtractLatestBuild handler.
func NotificationTemplateParam ¶ added in v2.15.0
func NotificationTemplateParam(r *http.Request) database.NotificationTemplate
NotificationTemplateParam returns the template from the ExtractNotificationTemplateParam handler.
func OAuth2ProviderApp ¶ added in v2.6.0
func OAuth2ProviderApp(r *http.Request) database.OAuth2ProviderApp
OAuth2ProviderApp returns the OAuth2 app from the ExtractOAuth2ProviderAppParam handler.
func OAuth2ProviderAppSecret ¶ added in v2.6.0
func OAuth2ProviderAppSecret(r *http.Request) database.OAuth2ProviderAppSecret
OAuth2ProviderAppSecret returns the OAuth2 app secret from the ExtractOAuth2ProviderAppSecretParam handler.
func OrganizationParam ¶
func OrganizationParam(r *http.Request) database.Organization
OrganizationParam returns the organization from the ExtractOrganizationParam handler.
func ParseUUIDParam ¶
ParseUUIDParam consumes a url parameter and parses it as a UUID.
func Prometheus ¶
func Prometheus(register prometheus.Registerer) func(http.Handler) http.Handler
func ProvisionerDaemonAuthenticated ¶ added in v2.9.0
func ProvisionerKeyAuthOptional ¶ added in v2.14.0
func ProvisionerKeyAuthOptional(r *http.Request) (database.ProvisionerKey, bool)
func ProvisionerKeyParam ¶ added in v2.14.0
func ProvisionerKeyParam(r *http.Request) database.ProvisionerKey
ProvisionerKeyParam returns the user from the ExtractProvisionerKeyParam handler.
func RateLimit ¶
RateLimit returns a handler that limits requests per-minute based on IP, endpoint, and user ID (if available).
func RedirectToLogin ¶
func RedirectToLogin(rw http.ResponseWriter, r *http.Request, dashboardURL *url.URL, message string)
RedirectToLogin redirects the user to the login page with the `message` and `redirect` query parameters set.
If dashboardURL is nil, the redirect will be relative to the current request's host. If it is not nil, the redirect will be absolute with dashboard url as the host.
func ReportCLITelemetry ¶
func RequireAPIKeyOrProvisionerDaemonAuth ¶ added in v2.9.0
RequireAPIKeyOrProvisionerDaemonAuth is middleware that should be inserted after optional ExtractAPIKey and ExtractProvisionerDaemonAuthenticated middlewares to ensure one of the two authentication methods is provided.
If both are provided, an error is returned to avoid misuse.
func RequireAPIKeyOrWorkspaceAgent ¶
RequireAPIKeyOrWorkspaceAgent is middleware that should be inserted after optional ExtractAPIKey and ExtractWorkspaceAgent middlewares to ensure one of the two is provided.
If both are provided an error is returned to avoid misuse.
func RequireAPIKeyOrWorkspaceProxyAuth ¶
RequireAPIKeyOrWorkspaceProxyAuth is middleware that should be inserted after optional ExtractAPIKey and ExtractWorkspaceProxy middlewares to ensure one of the two authentication methods is provided.
If both are provided, an error is returned to avoid misuse.
func RequireExperiment ¶ added in v2.9.0
func RequireExperiment(experiments codersdk.Experiments, experiment codersdk.Experiment) func(next http.Handler) http.Handler
func SplitAPIToken ¶
SplitAPIToken verifies the format of an API key and returns the split ID and secret.
APIKeys are formatted: ${ID}-${SECRET}
func TemplateParam ¶
TemplateParam returns the template from the ExtractTemplateParam handler.
func TemplateVersionParam ¶
func TemplateVersionParam(r *http.Request) database.TemplateVersion
TemplateVersionParam returns the template version from the ExtractTemplateVersionParam handler.
func UserAuthorization ¶
UserAuthorization returns the roles and scope used for authorization. Depends on the ExtractAPIKey handler.
func UserAuthorizationOptional ¶
UserAuthorizationOptional may return the roles and scope used for authorization. Depends on the ExtractAPIKey handler.
func UserParamOptional ¶ added in v2.21.1
func UserRBACSubject ¶ added in v2.13.0
func UserRBACSubject(ctx context.Context, db database.Store, userID uuid.UUID, scope rbac.ExpandableScope) (rbac.Subject, database.UserStatus, error)
UserRBACSubject fetches a user's rbac.Subject from the database. It pulls all roles from both site and organization scopes. It also pulls the groups, and the user's status.
func WorkspaceAgent ¶
func WorkspaceAgent(r *http.Request) database.WorkspaceAgent
WorkspaceAgent returns the workspace agent from the ExtractAgent handler.
func WorkspaceAgentOptional ¶
func WorkspaceAgentOptional(r *http.Request) (database.WorkspaceAgent, bool)
func WorkspaceAgentParam ¶
func WorkspaceAgentParam(r *http.Request) database.WorkspaceAgent
WorkspaceAgentParam returns the workspace agent from the ExtractWorkspaceAgentParam handler.
func WorkspaceAppCors ¶
func WorkspaceBuildParam ¶
func WorkspaceBuildParam(r *http.Request) database.WorkspaceBuild
WorkspaceBuildParam returns the workspace build from the ExtractWorkspaceBuildParam handler.
func WorkspaceParam ¶
WorkspaceParam returns the workspace from the ExtractWorkspaceParam handler.
func WorkspaceProxy ¶
func WorkspaceProxy(r *http.Request) database.WorkspaceProxy
WorkspaceProxy returns the workspace proxy from the ExtractWorkspaceProxy middleware.
func WorkspaceProxyOptional ¶
func WorkspaceProxyOptional(r *http.Request) (database.WorkspaceProxy, bool)
WorkspaceProxyOptional may return the workspace proxy from the ExtractWorkspaceProxy middleware.
func WorkspaceProxyParam ¶
func WorkspaceProxyParam(r *http.Request) database.WorkspaceProxy
WorkspaceProxyParam returns the workspace proxy from the ExtractWorkspaceProxyParam handler.
func WorkspaceResourceParam ¶
func WorkspaceResourceParam(r *http.Request) database.WorkspaceResource
ProvisionerJobParam returns the template from the ExtractTemplateParam handler.
Types ¶
type CSPFetchDirective ¶
type CSPFetchDirective string
CSPFetchDirective is the list of all constant fetch directives that can be used/appended to.
const ( CSPDirectiveDefaultSrc CSPFetchDirective = "default-src" CSPDirectiveConnectSrc CSPFetchDirective = "connect-src" CSPDirectiveChildSrc CSPFetchDirective = "child-src" CSPDirectiveScriptSrc CSPFetchDirective = "script-src" CSPDirectiveFontSrc CSPFetchDirective = "font-src" CSPDirectiveStyleSrc CSPFetchDirective = "style-src" CSPDirectiveObjectSrc CSPFetchDirective = "object-src" CSPDirectiveManifestSrc CSPFetchDirective = "manifest-src" CSPDirectiveFrameSrc CSPFetchDirective = "frame-src" CSPDirectiveImgSrc CSPFetchDirective = "img-src" CSPDirectiveReportURI CSPFetchDirective = "report-uri" CSPDirectiveFormAction CSPFetchDirective = "form-action" CSPDirectiveMediaSrc CSPFetchDirective = "media-src" CSPFrameAncestors CSPFetchDirective = "frame-ancestors" CSPDirectiveWorkerSrc CSPFetchDirective = "worker-src" )
type ExtractAPIKeyConfig ¶
type ExtractAPIKeyConfig struct {
DB database.Store
ActivateDormantUser func(ctx context.Context, u database.User) (database.User, error)
OAuth2Configs *OAuth2Configs
RedirectToLogin bool
DisableSessionExpiryRefresh bool
// Optional governs whether the API key is optional. Use this if you want to
// allow unauthenticated requests.
//
// If true and no session token is provided, nothing will be written to the
// request context. Use the APIKeyOptional and UserAuthorizationOptional
// functions to retrieve the API key and authorization instead of the
// regular ones.
//
// If true and the API key is invalid (i.e. deleted, expired), the cookie
// will be deleted and the request will continue. If the request is not a
// cookie-based request, the request will be rejected with a 401.
Optional bool
// SessionTokenFunc is a custom function that can be used to extract the API
// key. If nil, the default behavior is used.
SessionTokenFunc func(r *http.Request) string
// PostAuthAdditionalHeadersFunc is a function that can be used to add
// headers to the response after the user has been authenticated.
//
// This is originally implemented to send entitlement warning headers after
// a user is authenticated to prevent additional CLI invocations.
PostAuthAdditionalHeadersFunc func(a rbac.Subject, header http.Header)
}
type ExtractProvisionerAuthConfig ¶ added in v2.9.0
type ExtractWorkspaceAgentAndLatestBuildConfig ¶ added in v2.10.0
type ExtractWorkspaceAgentAndLatestBuildConfig struct {
DB database.Store
// Optional indicates whether the middleware should be optional. If true, any
// requests without the a token or with an invalid token will be allowed to
// continue and no workspace agent will be set on the request context.
Optional bool
}
type ExtractWorkspaceProxyConfig ¶
type ExtractWorkspaceProxyConfig struct {
DB database.Store
// Optional indicates whether the middleware should be optional. If true,
// any requests without the external proxy auth token header will be
// allowed to continue and no workspace proxy will be set on the request
// context.
Optional bool
}
type HSTSConfig ¶
type HSTSConfig struct {
// HeaderValue is an empty string if hsts header is disabled.
HeaderValue string
}
func HSTSConfigOptions ¶
func HSTSConfigOptions(maxAge int, options []string) (HSTSConfig, error)
type OAuth2Configs ¶
type OAuth2Configs struct {
Github promoauth.OAuth2Config
OIDC promoauth.OAuth2Config
}
OAuth2Configs is a collection of configurations for OAuth-based authentication. This should be extended to support other authentication types in the future.
func (*OAuth2Configs) IsZero ¶
func (c *OAuth2Configs) IsZero() bool
type OAuth2State ¶
func OAuth2 ¶
func OAuth2(r *http.Request) OAuth2State
OAuth2 returns the state from an oauth request.
type OrganizationMember ¶ added in v2.3.0
type OrganizationMember struct {
database.OrganizationMember
Username string
AvatarURL string
}
OrganizationMember is the database object plus the Username and Avatar URL. Including these in the middleware is preferable to a join at the SQL layer so that we can keep the autogenerated database types as they are.
func OrganizationMemberParam ¶
func OrganizationMemberParam(r *http.Request) OrganizationMember
OrganizationMemberParam returns the organization membership that allowed the query from the ExtractOrganizationParam handler.
type RealIPConfig ¶
type RealIPConfig struct {
// TrustedOrigins is a list of networks that will be trusted. If
// any non-trusted address supplies these headers, they will be
// ignored.
TrustedOrigins []*net.IPNet
// TrustedHeaders lists headers that are trusted for forwarding
// IP addresses. e.g. "CF-Connecting-IP", "True-Client-IP", etc.
TrustedHeaders []string
}
RealIPConfig configures the search order for the function, which controls which headers to consider trusted.
func ParseRealIPConfig ¶
func ParseRealIPConfig(headers, origins []string) (*RealIPConfig, error)
ParseRealIPConfig takes a raw string array of headers and origins to produce a config.
type RealIPState ¶
type RealIPState struct {
// Config is the configuration applied in the middleware. Consider
// this read-only and do not modify.
Config *RealIPConfig
// OriginalRemoteAddr is the original RemoteAddr for the request.
OriginalRemoteAddr string
}
RealIPState is the original state prior to modification by this middleware, useful for getting information about the connecting client if needed.
func RealIP ¶
func RealIP(ctx context.Context) *RealIPState
FromContext retrieves the state from the given context.Context.
Source Files
¶
- actor.go
- apikey.go
- authz.go
- clitelemetry.go
- cors.go
- csp.go
- csrf.go
- experiments.go
- externalauthparam.go
- groupparam.go
- hsts.go
- httpmw.go
- notificationtemplateparam.go
- oauth2.go
- organizationparam.go
- prometheus.go
- provisionerdaemon.go
- provisionerkey.go
- ratelimit.go
- realip.go
- recover.go
- requestid.go
- templateparam.go
- templateversionparam.go
- userparam.go
- workspaceagent.go
- workspaceagentparam.go
- workspacebuildparam.go
- workspaceparam.go
- workspaceproxy.go
- workspaceresourceparam.go
Directories
¶
| Path | Synopsis |
|---|---|
|
loggermock
Package loggermock is a generated GoMock package.
|
Package loggermock is a generated GoMock package. |