web/web.go

package web

import (
	"net/http"

	"github.com/google/uuid"

	"code.nochebuena.dev/einherjar/contracts/logging"
	"code.nochebuena.dev/einherjar/web/mw"
	"code.nochebuena.dev/einherjar/web/server"
)

// Config aggregates configuration for the web module. Server holds the HTTP server
// settings, including the single source of truth for CORS: Server.CORSOrigins,
// loaded from EINHERJAR_SERVER_CORS_ORIGINS. To override origins from code (without
// the env var), set Server.CORSOrigins directly before calling New.
type Config struct {
	Server server.Config
}

// New creates a [server.Server] with the recommended middleware stack pre-applied:
//  1. Recover — catches panics, returns 500
//  2. RequestID — injects UUID v7 request ID (falls back to v4)
//  3. RequestLogger — logs method, path, status, latency
//  4. CORS — applied only when Server.CORSOrigins is non-empty (from
//     EINHERJAR_SERVER_CORS_ORIGINS, or set in code before calling New)
//
// web.New uses explicit origins only; it does NOT support allow-all. For
// [mw.CORSAllowAll] (development) or any custom middleware order, use [server.New]
// directly. When no origins are configured, CORS is off and a log line records it.
func New(logger logging.Logger, cfg ...Config) server.Server {
	var c Config
	if len(cfg) > 0 {
		c = cfg[0]
	}

	middleware := []func(http.Handler) http.Handler{
		mw.Recover(logger),
		mw.RequestID(newRequestID),
		mw.RequestLogger(logger),
	}
	if len(c.Server.CORSOrigins) > 0 {
		middleware = append(middleware, mw.CORS(c.Server.CORSOrigins))
	} else {
		logger.Info("web.New: no CORS origins configured (EINHERJAR_SERVER_CORS_ORIGINS) — cross-origin browser requests will be blocked")
	}

	return server.New(logger, c.Server, server.WithMiddleware(middleware...))
}

func newRequestID() string {
	id, err := uuid.NewV7()
	if err != nil {
		return uuid.NewString()
	}
	return id.String()
}