httpmw/CHANGELOG.md

Changelog

All notable changes to this module will be documented in this file.

The format is based on Keep a Changelog, and this module adheres to Semantic Versioning.

1.0.2 - 2026-05-12

Changed

• logz dependency bumped from v0.9.0 to v1.0.1.
• go directive updated from 1.25 to 1.26.

0.9.0 - 2026-03-18

Added

• Recover() func(http.Handler) http.Handler — catches panics from inner handlers via defer/recover, captures the stack trace with debug.Stack, and writes HTTP 500; requires no configuration or logger injection
• CORS(origins []string) func(http.Handler) http.Handler — sets Access-Control-Allow-Origin, Access-Control-Allow-Methods (GET, HEAD, PUT, PATCH, POST, DELETE, OPTIONS), and Access-Control-Allow-Headers (Content-Type, Authorization, X-Request-ID) for matching origins; short-circuits OPTIONS preflight requests with HTTP 204; pass []string{"*"} for development environments
• RequestID(generator func() string) func(http.Handler) http.Handler — calls generator (e.g. uuid.NewString) to produce a unique ID per request, stores it in the context via logz.WithRequestID, and writes it to the X-Request-ID response header
• RequestLogger(logger Logger) func(http.Handler) http.Handler — logs method, path, status code, latency, and request ID after the inner handler returns; uses logger.Error for 5xx responses and logger.Info for all others; reads the request ID from context via logz.GetRequestID
• Logger interface — duck-typed logger accepted by RequestLogger; satisfied by logz.Logger: Info(msg string, args ...any), Error(msg string, err error, args ...any), With(args ...any) Logger
• StatusRecorder struct — exported http.ResponseWriter wrapper that captures the written status code in its Status field; used internally by RequestLogger and available for custom logging middleware

Design Notes

• RequestID and RequestLogger use logz.WithRequestID and logz.GetRequestID directly rather than a locally defined context key; this ensures the request ID is visible to any logz.Logger that calls .WithContext(ctx) downstream, which would break if the key were re-implemented here.
• Recover intentionally requires no logger injection in this release: it captures the stack trace but does not log it, keeping the middleware usable with zero configuration; logger injection is deferred to a future release.
• No middleware is installed by default; the package exports independent functions and the application chooses the chain and order (recommended: Recover → RequestID → RequestLogger → CORS).