Function NewRouter

server-source-code/internal/server/router.go:40–705

NewRouter creates the HTTP router with all routes and middleware. Returns (handler, guacdProcess) - guacdProcess should be stopped on shutdown. frontendFS is the embedded frontend static files (static/frontend/dist); pass nil to disable SPA serving.

(ctx context.Context, cfg *config.Config, db *database.DB, rdb *redisclient.Client, registry *agentregistry.Registry, queueClient *asynq.Client, queueInspector *asynq.Inspector, ctxRegistry *hostctx.Registry, poolCache *hostctx.PoolCache, redisCache *hostctx.RedisCache, notifyEmit *notifications.Emitter, log *slog.Logger, frontendFS fs.FS)

// Returns (handler, guacdProcess) - guacdProcess should be stopped on shutdown.
// frontendFS is the embedded frontend static files (static/frontend/dist); pass nil to disable SPA serving.
func NewRouter(ctx context.Context, cfg *config.Config, db *database.DB, rdb *redisclient.Client, registry *agentregistry.Registry, queueClient *asynq.Client, queueInspector *asynq.Inspector, ctxRegistry *hostctx.Registry, poolCache *hostctx.PoolCache, redisCache *hostctx.RedisCache, notifyEmit *notifications.Emitter, log *slog.Logger, frontendFS fs.FS) (http.Handler, *guacd.Process) {
	r := chi.NewRouter()

	var dbProvider database.DBProvider
	if poolCache != nil {
		dbProvider = &hostctx.DBResolver{Default: db}
	} else {
		dbProvider = db
	}

	// Build a RedisResolver so stores always call .RDB(ctx) for per-context isolation.
	redisResolver := &hostctx.RedisResolver{Default: rdb}
	settingsStore := store.NewSettingsStore(dbProvider)
	settings, _ := settingsStore.GetFirst(ctx)
	resolved := config.ResolveConfig(ctx, cfg, settings)

	r.Use(middleware.RequestID())
	r.Use(middleware.Recovery(log))
	if poolCache != nil {
		r.Use(hostctx.Middleware(ctxRegistry, poolCache, redisCache, db, rdb, cfg.RegistryReloadSecret))
	} else {
		r.Use(func(next http.Handler) http.Handler {
			return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
				ctx := hostctx.WithDB(r.Context(), db)
				ctx = hostctx.WithRedis(ctx, rdb)
				next.ServeHTTP(w, r.WithContext(ctx))
			})
		})
	}
	r.Use(middleware.CORS(resolved.CORSOrigin, corsOriginResolver(ctxRegistry)))
	if resolved.TrustProxy {
		r.Use(chimw.RealIP)
	}
	// Note: chimw.Timeout is NOT applied globally because it conflicts with
	// WebSocket/SSE routes (hijacked connections). It writes a 503 to a
	// hijacked ResponseWriter causing "WriteHeader on hijacked connection".
	// Instead, timeout is applied per-group below, skipping WS routes.

	if poolCache != nil && cfg.RegistryReloadSecret != "" {
		r.Post("/internal/reload-tenant", hostctx.ReloadHandler(poolCache, redisCache, cfg.RegistryReloadSecret))
	}

	usersStore := store.NewUsersStore(dbProvider)
	permissionsStore := store.NewPermissionsStore(dbProvider)

	if cfg.EnablePprof {
		// Pprof endpoints require admin authentication to prevent information leakage.
		r.Group(func(r chi.Router) {
			r.Use(middleware.RequirePermission("can_manage_settings", permissionsStore))
			r.Handle("/debug/pprof/*", http.HandlerFunc(pprof.Index))
			r.Handle("/debug/pprof/cmdline", http.HandlerFunc(pprof.Cmdline))
			r.Handle("/debug/pprof/profile", http.HandlerFunc(pprof.Profile))
			r.Handle("/debug/pprof/symbol", http.HandlerFunc(pprof.Symbol))
			r.Handle("/debug/pprof/trace", http.HandlerFunc(pprof.Trace))
		})
	}
	dashboardPrefsStore := store.NewDashboardPreferencesStore(dbProvider)