7fb24e0452
Tiny Go service that returns ShellConfig JSON for any registered app.
Backs the runtime-loaded <AppShell> component being added to
@limitless/ui (next).
Endpoints:
GET /api/v1/shell/{appKey} → app + branding + user + menus, ETag-cached
GET /api/v1/apps → registered app inventory
GET /healthz, /readyz → ops probes
Auth:
Keycloak Bearer JWT validated against the gosecCloud realm.
Discovery URL is overridable so pods can hit Keycloak via the
in-cluster service (https://keycloak.keycloak.svc.cluster.local:8443)
while still validating the canonical issuer (auth.gosec.cloud).
Lazy JWKS init — pod stays up if Keycloak is briefly unreachable.
Data model (gsc_core.shell):
apps · menu_items (zone enum: topbar/sidebar/footer/user-menu) ·
menu_role_grants (Keycloak realm roles, OR semantics, empty=all) ·
branding
Seed includes the 8 gsc-crm sidebar items + topbar search +
user-menu (settings/support/logout) + footer (docs).
K8s:
Namespace gsc-shell (ambient mesh).
Deployment 2 replicas, internal-only ingress shell-api.gosec.internal,
EJBCA SERVER cert.
ServiceEntry for auth.gosec.cloud (vestigial — discovery now uses
in-cluster path; keeping for ad-hoc curl from inside pods).
Added to keycloak/allow-keycloak-clients AuthorizationPolicy out of band.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
104 lines
2.3 KiB
Go
104 lines
2.3 KiB
Go
package main
|
|
|
|
import (
|
|
"context"
|
|
"log"
|
|
"os"
|
|
"os/signal"
|
|
"syscall"
|
|
"time"
|
|
|
|
"github.com/gofiber/fiber/v2"
|
|
"github.com/gofiber/fiber/v2/middleware/logger"
|
|
"github.com/gofiber/fiber/v2/middleware/recover"
|
|
|
|
"github.com/gosec/gsc-shell-api/internal/auth"
|
|
"github.com/gosec/gsc-shell-api/internal/config"
|
|
"github.com/gosec/gsc-shell-api/internal/db"
|
|
"github.com/gosec/gsc-shell-api/internal/handlers"
|
|
)
|
|
|
|
func main() {
|
|
cfg, err := config.Load()
|
|
if err != nil {
|
|
log.Fatalf("config: %v", err)
|
|
}
|
|
|
|
ctx := context.Background()
|
|
|
|
database, err := db.New(ctx, cfg.DatabaseURL)
|
|
if err != nil {
|
|
log.Fatalf("db: %v", err)
|
|
}
|
|
defer database.Close()
|
|
|
|
verifier, err := auth.NewVerifier(ctx, cfg.KeycloakIssuer, cfg.KeycloakDiscovery, cfg.KeycloakAudCSV)
|
|
if err != nil {
|
|
log.Fatalf("oidc: %v", err)
|
|
}
|
|
|
|
app := fiber.New(fiber.Config{
|
|
AppName: "gsc-shell-api",
|
|
DisableStartupMessage: true,
|
|
ReadTimeout: 10 * time.Second,
|
|
WriteTimeout: 10 * time.Second,
|
|
})
|
|
app.Use(recover.New())
|
|
app.Use(logger.New(logger.Config{
|
|
Format: `{"time":"${time}","status":${status},"method":"${method}","path":"${path}","latency":"${latency}","ip":"${ip}"}` + "\n",
|
|
}))
|
|
|
|
health := &handlers.HealthHandlers{DB: database}
|
|
app.Get("/healthz", health.Live)
|
|
app.Get("/readyz", health.Ready)
|
|
|
|
shell := &handlers.ShellHandlers{
|
|
DB: database,
|
|
CacheTTLSeconds: cfg.CacheTTLSeconds,
|
|
}
|
|
|
|
api := app.Group("/api/v1", verifier.Middleware())
|
|
api.Get("/shell/:appKey", shell.GetShell)
|
|
api.Get("/apps", shell.ListApps)
|
|
|
|
addr := ":" + itoa(cfg.Port)
|
|
log.Printf("gsc-shell-api listening on %s (issuer=%s)", addr, cfg.KeycloakIssuer)
|
|
|
|
go func() {
|
|
if err := app.Listen(addr); err != nil {
|
|
log.Fatalf("listen: %v", err)
|
|
}
|
|
}()
|
|
|
|
stop := make(chan os.Signal, 1)
|
|
signal.Notify(stop, syscall.SIGTERM, syscall.SIGINT)
|
|
<-stop
|
|
log.Println("shutting down")
|
|
shutdownCtx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
|
|
defer cancel()
|
|
_ = app.ShutdownWithContext(shutdownCtx)
|
|
}
|
|
|
|
func itoa(n int) string {
|
|
// avoid pulling strconv just for this
|
|
if n == 0 {
|
|
return "0"
|
|
}
|
|
neg := n < 0
|
|
if neg {
|
|
n = -n
|
|
}
|
|
buf := [20]byte{}
|
|
i := len(buf)
|
|
for n > 0 {
|
|
i--
|
|
buf[i] = byte('0' + n%10)
|
|
n /= 10
|
|
}
|
|
if neg {
|
|
i--
|
|
buf[i] = '-'
|
|
}
|
|
return string(buf[i:])
|
|
}
|