Function requestID

internal/httpapi/middleware.go:52–62

requestID middleware honors a caller-supplied X-Request-Id (so a trace id can flow across services) and otherwise mints one, then stashes it in the request context and sets it on the response header. Because it runs at the chi root it covers both the new Huma surface and the legacy fallback — every

(next http.Handler)

// chi root it covers both the new Huma surface and the legacy fallback —
// every response carries a request id.
func requestID(next http.Handler) http.Handler {
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		id := r.Header.Get(requestIDHeader)
		if id == "" {
			id = newRequestID()
		}
		w.Header().Set(requestIDHeader, id)
		ctx := context.WithValue(r.Context(), requestIDKey, id)
		next.ServeHTTP(w, r.WithContext(ctx))
	})
}

// authChallenge injects the RFC 6750 §3 WWW-Authenticate header on any 401
// response. Every 401 on this Bearer-accepting surface must advertise the