Dmitry VerkhoturovandGitHub
1f34984dab
rest.CORS refuses "*" together with credentials since go-pkgz/rest#52, so the bump and the option have to land together: the option does not exist in v1.22.0 and the panic fires at construction, inside routes(), which makes it a startup failure rather than a request-time one. The wildcard stays. The comment widget is embedded on arbitrary third-party sites, so the set of origins is not knowable, which is why the escape hatch was asked for upstream instead of accepting the panic. What it costs is unchanged and now written next to the call: any site a signed-in user visits can read authenticated responses, so state-changing requests have to keep being protected by something other than the origin, X-XSRF-Token today. The example module is tidied in the same commit, as it reaches go-pkgz/rest through the replace directive and its indirect graph would otherwise keep the old pin and fail the readonly module check in CI. The bump also carries testify to v1.12.0, which drops go-spew and go-difflib from the module graph.
78 lines
2.1 KiB
Go
78 lines
2.1 KiB
Go
package logger
|
|
|
|
import (
|
|
"net/http"
|
|
)
|
|
|
|
// Option func type
|
|
type Option func(l *Middleware)
|
|
|
|
// WithBody triggers request body logging. Body size is limited (default 1k)
|
|
func WithBody(l *Middleware) {
|
|
l.logBody = true
|
|
}
|
|
|
|
// MaxBodySize sets size of the logged part of the request body.
|
|
func MaxBodySize(maximum int) Option {
|
|
return func(l *Middleware) {
|
|
if maximum >= 0 {
|
|
l.maxBodySize = maximum
|
|
}
|
|
}
|
|
}
|
|
|
|
// Prefix sets log line prefix.
|
|
func Prefix(prefix string) Option {
|
|
return func(l *Middleware) {
|
|
l.prefix = prefix
|
|
}
|
|
}
|
|
|
|
// IPfn sets IP masking function. If ipFn is nil then IP address will be logged as is.
|
|
func IPfn(ipFn func(ip string) string) Option {
|
|
return func(l *Middleware) {
|
|
l.ipFn = ipFn
|
|
}
|
|
}
|
|
|
|
// UserFn triggers user name logging if userFn is not nil.
|
|
func UserFn(userFn func(r *http.Request) (string, error)) Option {
|
|
return func(l *Middleware) {
|
|
l.userFn = userFn
|
|
}
|
|
}
|
|
|
|
// SubjFn triggers subject logging if subjFn is not nil.
|
|
func SubjFn(subjFn func(r *http.Request) (string, error)) Option {
|
|
return func(l *Middleware) {
|
|
l.subjFn = subjFn
|
|
}
|
|
}
|
|
|
|
// BodyFn sets a transform applied to the request body before it is logged, e.g. to
|
|
// mask secrets. It only runs when body logging is enabled (see WithBody) and the
|
|
// body is non-empty; if bodyFn is nil the body is logged unchanged. bodyFn receives
|
|
// the body (capped at MaxBodySize) and a truncated flag that is true when the body was longer than
|
|
// MaxBodySize and got cut short - a masker can use it to emit a marker instead of
|
|
// risking a pass-through of a partial body it cannot parse. The returned string is
|
|
// what gets logged, so bodyFn owns the content; the logger still collapses it to a
|
|
// single line to keep one log record per request.
|
|
func BodyFn(bodyFn func(body string, truncated bool) string) Option {
|
|
return func(l *Middleware) {
|
|
l.bodyFn = bodyFn
|
|
}
|
|
}
|
|
|
|
// ApacheCombined sets format to Apache Combined Log.
|
|
// See http://httpd.apache.org/docs/2.2/logs.html#combined
|
|
func ApacheCombined(l *Middleware) {
|
|
l.apacheCombined = true
|
|
}
|
|
|
|
// Log sets logging backend.
|
|
func Log(log Backend) Option {
|
|
return func(l *Middleware) {
|
|
l.log = log
|
|
}
|
|
}
|