64 lines
2.1 KiB
Markdown
64 lines
2.1 KiB
Markdown
# Integrating a Go API
|
|
|
|
Install the module from its eventual repository location:
|
|
|
|
```bash
|
|
go get github.com/danyel/go-loose/client
|
|
```
|
|
|
|
Wrap a router or selected route group:
|
|
|
|
```go
|
|
package main
|
|
|
|
import (
|
|
"log"
|
|
"net/http"
|
|
"time"
|
|
|
|
goloose "github.com/danyel/go-loose/client"
|
|
)
|
|
|
|
func main() {
|
|
access, err := goloose.New(goloose.Config{
|
|
BaseURL: "https://nmbs.goloose.local",
|
|
Tenant: "nmbs",
|
|
Application: "guess",
|
|
HTTPClient: &http.Client{Timeout: 2 * time.Second},
|
|
})
|
|
if err != nil {
|
|
log.Fatal(err)
|
|
}
|
|
|
|
protected := access.Middleware(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
principal, _ := goloose.PrincipalFromContext(r.Context())
|
|
w.Write([]byte("authorized by key " + principal.APIKeyName))
|
|
}))
|
|
|
|
mux := http.NewServeMux()
|
|
mux.Handle("GET /api/guesses", protected)
|
|
mux.HandleFunc("GET /healthz", func(w http.ResponseWriter, _ *http.Request) {
|
|
w.WriteHeader(http.StatusOK)
|
|
})
|
|
log.Fatal(http.ListenAndServe(":8090", mux))
|
|
}
|
|
```
|
|
|
|
Call the protected API:
|
|
|
|
```bash
|
|
curl -H 'X-API-Key: gl_REPLACE_WITH_ISSUED_SECRET' \
|
|
https://nmbs.guess.local/api/guesses
|
|
```
|
|
|
|
The middleware sends the original method, URL path, and request host to Go Loose. It denies missing/invalid keys and control-plane errors, then removes `X-API-Key` before invoking the application handler. Read the authorized tenant/application/key identity with `PrincipalFromContext`.
|
|
|
|
## Importing the service contract
|
|
|
|
Expose an OpenAPI JSON or YAML route from the service, then use **Contracts → Import contract → Scan URL**. Private/internal URLs are blocked by default; production deployments that need internal discovery should use a restricted egress network and explicitly set `GO_LOOSE_ALLOW_PRIVATE_CONTRACT_URLS=true`.
|
|
|
|
Contracts can also be pasted into the console, which avoids server-side egress entirely.
|
|
|
|
## Availability and latency
|
|
|
|
The current client validates remotely on every request so revocation is immediate. Run Go Loose highly available and set a strict client timeout. Do not implement an “allow on error” fallback. A future signed-assertion mode can reduce latency while retaining bounded revocation delay.
|