Method Handler

internal/api/server.go:276–729

()

}

func (s *Server) Handler() (*chi.Mux, error) {
	r := chi.NewRouter()

	// Global middleware
	r.Use(middleware.RequestID) // Must be before logger to capture request ID
	// r.Use(middleware.Logger(s.logger))
	r.Use(middleware.Recoverer)
	// Enforce auth-disabled IP allowlist against the direct TCP peer.
	// This runs before RealIP so forwarded headers cannot bypass restrictions.
	r.Use(middleware.RequireAuthDisabledIPAllowlist(s.config.Config))
	r.Use(middleware.RealIP)

	// HTTP compression - handles gzip, brotli, zstd, deflate automatically
	// Use faster compression levels for better proxy performance
	compressor, err := httpcompression.DefaultAdapter(
		httpcompression.MinSize(1024),                        // Only compress responses >= 1KB
		httpcompression.GzipCompressionLevel(2),              // Use gzip level 2 (fast) instead of 6 (default)
		httpcompression.Prefer(httpcompression.PreferServer), // Let server choose best compression
	)
	if err != nil {
		log.Error().Err(err).Msg("Failed to create HTTP compression adapter")
	} else {
		// SSE responses must never be compressed. The compressor's writer buffers
		// until MinSize (delaying event flushes) and lacks Unwrap(), which prevents
		// the stream handler from clearing the server WriteTimeout via
		// http.NewResponseController. Bypass compression for event-stream requests
		// (EventSource always sends Accept: text/event-stream), covering /stream and
		// the RSS /events endpoint without coupling to specific paths.
		r.Use(func(next http.Handler) http.Handler {
			compressed := compressor(next)
			return http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
				if strings.Contains(req.Header.Get("Accept"), "text/event-stream") {
					next.ServeHTTP(w, req)
					return
				}
				compressed.ServeHTTP(w, req)
			})
		})
	}

	// CORS is disabled by default. Enable only for explicit trusted origins.
	if len(s.config.Config.CORSAllowedOrigins) > 0 {
		corsMiddleware := cors.New(cors.Options{
			AllowCredentials: true,
			AllowedOrigins:   s.config.Config.CORSAllowedOrigins,
			AllowedMethods:   []string{"HEAD", "OPTIONS", "GET", "POST", "PUT", "PATCH", "DELETE"},
			AllowedHeaders:   []string{"Accept", "Authorization", "Content-Type", "X-API-Key", "X-Requested-With"},
			MaxAge:           300,
			Debug:            false,
		})
		r.Use(corsMiddleware.Handler)
	}

	// Session middleware - must be added before any session-dependent middleware
	r.Use(s.sessionManager.LoadAndSave)

	// Create handlers
	healthHandler := handlers.NewHealthHandler()