Method setupRoutes

server/server.go:226–286

setupRoutes configures all routes

()

// setupRoutes configures all routes
func (s *Server) setupRoutes() {
	// Static files (UI SDK demos) - no auth required
	s.router.Static("/ui", "./ui")

	// Health check endpoint (no auth required)
	if s.config.Observability.HealthCheck.Enabled {
		s.router.GET(s.config.Observability.HealthCheck.Endpoint, s.healthCheck)
	}

	// Metrics endpoint (no auth required)
	if s.config.Observability.Metrics.Enabled {
		s.router.GET(s.config.Observability.Metrics.Endpoint, s.metricsHandler)
	}

	// WebSocket endpoint (no auth middleware - handles auth internally)
	wsHandler := handlers.NewWebSocketHandler(s.store, s.deps.AgentDeps, s.agentRegistry)
	s.router.GET("/v1/ws", wsHandler.HandleWebSocket)

	// Dashboard routes (no auth required for Studio UI)
	dashboardGroup := s.router.Group("/v1/dashboard")
	s.registerDashboardRoutesNoAuth(dashboardGroup)

	// API v1 routes (with authentication)
	v1 := s.router.Group("/v1")

	// Apply authentication middleware
	if s.config.Auth.APIKey.Enabled {
		v1.Use(apiKeyAuthMiddleware(s.config.Auth.APIKey))
	}
	if s.config.Auth.JWT.Enabled {
		v1.Use(jwtAuthMiddleware(s.config.Auth.JWT))
	}

	// Apply rate limiting
	if s.config.RateLimit.Enabled && s.rateLimiter != nil {
		v1.Use(ratelimit.Middleware(ratelimit.Config{
			Enabled:       s.config.RateLimit.Enabled,
			RequestsPerIP: s.config.RateLimit.RequestsPerIP,
			WindowSize:    s.config.RateLimit.WindowSize,
			BurstSize:     s.config.RateLimit.BurstSize,
		}, s.rateLimiter))
	}

	// Register API routes
	s.registerAgentRoutes(v1)
	s.registerMemoryRoutes(v1)
	s.registerSessionRoutes(v1)
	s.registerWorkflowRoutes(v1)
	s.registerToolRoutes(v1)
	s.registerMiddlewareRoutes(v1)
	s.registerSystemRoutes(v1)
	s.registerTelemetryRoutes(v1)
	s.registerEvalRoutes(v1)
	s.registerMCPRoutes(v1)
	s.registerA2ARoutes(v1)
	s.registerRemoteAgentRoutes(v1)
	// Dashboard routes are registered without auth above for Studio UI