66 lines
3.2 KiB
Go
66 lines
3.2 KiB
Go
// SPDX-License-Identifier: MPL-2.0
|
|
|
|
// Package web is the documentation root for Gamertan Web Foundations.
|
|
//
|
|
// Web Foundations is a collection of small, composable Go packages for the
|
|
// security-sensitive edges of a web application: request identity, structured
|
|
// request evidence, browser security, authentication, passkeys, permissions,
|
|
// organizations, SQLite persistence, abuse controls, and private analytics.
|
|
//
|
|
// It is a toolkit rather than an application framework. Applications keep
|
|
// their router, handlers, HTML, authorization decisions, deployment, and
|
|
// operational policy. Packages use net/http and can be adopted independently.
|
|
// No Redis, message broker, hosted identity provider, telemetry service, or
|
|
// JavaScript framework is required.
|
|
//
|
|
// # Choose a first boundary
|
|
//
|
|
// Start with the smallest package that owns the boundary you need:
|
|
//
|
|
// - [requestmeta] resolves request IDs, client addresses, and trusted-proxy
|
|
// metadata once for downstream security and logging.
|
|
// - [requestlog] records bounded, versioned request observations with
|
|
// sensitive fields disabled by default.
|
|
// - [websec] supplies HTTP headers, same-origin checks, CSRF protection,
|
|
// redirects, body limits, and rate limits.
|
|
// - [auth], [authhttp], [authwebauthn], and [authsqlite] provide
|
|
// storage-neutral identity, secure browser sessions, passkeys, and an
|
|
// optional no-CGO SQLite adapter.
|
|
// - [organizations] and [access] model organizations, teams, invitations,
|
|
// scoped roles, and audited temporary access.
|
|
// - [abuse] applies application-classified request-abuse decisions.
|
|
// - [analytics] creates bounded, disposable projections from requestlog
|
|
// records without becoming a telemetry service.
|
|
//
|
|
// # Compose with net/http
|
|
//
|
|
// Middleware is wrapped from the application outward. A request metadata
|
|
// resolver should be outermost so packages inside it agree about request
|
|
// identity. The package example shows a complete, executable composition.
|
|
// A copyable server with graceful shutdown and optional private JSONL logging
|
|
// is available in the repository's starters/basic directory.
|
|
//
|
|
// # Security model
|
|
//
|
|
// Untrusted values are bounded before storage or aggregation. Forwarding
|
|
// headers affect identity only through explicitly trusted proxies. Sensitive
|
|
// request fields require field-by-field opt-in. Security-relevant
|
|
// configuration and persistence failures fail closed rather than silently
|
|
// weakening policy.
|
|
//
|
|
// This root package intentionally exports no runtime API. Applications import
|
|
// only the subpackages they use.
|
|
//
|
|
// [abuse]: https://pkg.go.dev/gamertan.com/web/abuse
|
|
// [access]: https://pkg.go.dev/gamertan.com/web/access
|
|
// [analytics]: https://pkg.go.dev/gamertan.com/web/analytics
|
|
// [auth]: https://pkg.go.dev/gamertan.com/web/auth
|
|
// [authhttp]: https://pkg.go.dev/gamertan.com/web/authhttp
|
|
// [authsqlite]: https://pkg.go.dev/gamertan.com/web/authsqlite
|
|
// [authwebauthn]: https://pkg.go.dev/gamertan.com/web/authwebauthn
|
|
// [organizations]: https://pkg.go.dev/gamertan.com/web/organizations
|
|
// [requestlog]: https://pkg.go.dev/gamertan.com/web/requestlog
|
|
// [requestmeta]: https://pkg.go.dev/gamertan.com/web/requestmeta
|
|
// [websec]: https://pkg.go.dev/gamertan.com/web/websec
|
|
package web
|