package server // import "git.griefed.de/griefed/repoman/internal/server" Package server wires repoman's HTTP layer: chi router, middleware stack, and handler registration. The construction is deliberately split out from cmd/repoman so it can be unit-tested without spinning up the daemon. FUNCTIONS func Build(deps Deps) (http.Handler, error) Build assembles the chi router with the standard middleware stack and registers all routes. Returned http.Handler is ready to pass to http.Server. Route layout: GET /healthz — unauthenticated liveness probe GET /auth/login — login form (anonymous) POST /auth/login — login submit POST /auth/logout — destroy session GET /auth/2fa — 2FA prompt (pending-2FA session) POST /auth/2fa — 2FA submit GET /auth/forgot-password — request reset (anonymous) POST /auth/forgot-password GET /auth/reset — token-bearing reset form POST /auth/reset GET / — dashboard (authenticated) The auth middleware whitelists /healthz, /auth/*, and /static/* as anonymous; everything else demands a session. TYPES type Deps struct { Auth *handlers.AuthHandler TwoFactor *handlers.TwoFactorHandler Profile *handlers.ProfileHandler UserAdmin *handlers.UserAdminHandler Config *handlers.ConfigHandler FirstRun *handlers.FirstRunHandler Run *handlers.RunHandler Dashboard *handlers.DashboardHandler Inventory *handlers.InventoryHandler RepoDownload *handlers.RepoDownloadHandler ConfigLogs *handlers.ConfigLogsHandler GlobalSettings *handlers.GlobalSettingsHandler Themes *handlers.ThemeHandler TestConn *handlers.TestConnectionHandler IssueWebhook *handlers.IssueWebhookHandler SessionMgr *auth.SessionManager Users auth.UserRepository SecureCookies bool BehindProxy bool // BaseURL is the externally-visible URL of this instance, e.g. // "https://repoman.example.com" (from --base-url). Its scheme+host is added // to the CSRF trusted-origin allowlist so form submissions are accepted when // the operator-visible origin differs from the host repoman sees behind a // reverse proxy. Empty in plain localhost dev, where same-origin checking // suffices. BaseURL string AuthSettings func() auth.Settings // TokenExpiryNotices lazily supplies the expiring-access-token reminders for // the nav banner (unfiltered by viewer; NewBaseData filters by permission). // Nil disables the banner. Wired in serve.go from the token-expiry state. TokenExpiryNotices func(context.Context) []handlers.TokenExpiryNotice // Notifications serves the in-app notification feed; NotificationCount lazily // supplies the nav unread badge. Nil disables both. Notifications *handlers.NotificationsHandler NotificationCount func(context.Context) int // Help serves the in-app user manual (/help index + /help/{slug} topics). // Nil disables the section (the nav link is gated on it too). Help *handlers.HelpHandler } Deps bundles everything Build needs. Constructed by cmd/repoman once at startup; fields are then live for the daemon's lifetime.