Function NewServer

internal/api/server.go:99–148

NewServer creates a new HTTP server

(cfg *config.Config, registryService service.RegistryService, metrics *telemetry.Metrics, versionInfo *v0.VersionBody)

// NewServer creates a new HTTP server
func NewServer(cfg *config.Config, registryService service.RegistryService, metrics *telemetry.Metrics, versionInfo *v0.VersionBody) *Server {
	// Create HTTP mux and Huma API
	mux := http.NewServeMux()

	api := router.NewHumaAPI(cfg, registryService, mux, metrics, versionInfo)

	// Configure CORS with permissive settings for public API
	corsHandler := cors.New(cors.Options{
		AllowedOrigins: []string{"*"},
		AllowedMethods: []string{
			http.MethodGet,
			http.MethodPost,
			http.MethodPut,
			http.MethodDelete,
			http.MethodOptions,
		},
		AllowedHeaders:   []string{"*"},
		ExposedHeaders:   []string{"Content-Type", "Content-Length"},
		AllowCredentials: false, // Must be false when AllowedOrigins is "*"
		MaxAge:           86400, // 24 hours
	})

	// Wrap the mux with middleware stack
	// Order: NulByteValidation -> TrailingSlash -> CORS -> Mux
	handler := NulByteValidationMiddleware(TrailingSlashMiddleware(corsHandler.Handler(mux)))

	server := &Server{
		config:   cfg,
		registry: registryService,
		humaAPI:  api,
		server: &http.Server{
			Addr:              cfg.ServerAddress,
			Handler:           handler,
			ReadHeaderTimeout: 10 * time.Second,
			ReadTimeout:       30 * time.Second,
			// WriteTimeout intentionally not set: the publish path runs
			// outbound package validators sequentially (npm/pypi/nuget up to
			// 10s each, OCI up to 30s), so any tight cap could cut off a
			// legitimate multi-package publish mid-response — surfacing as a
			// truncated read to the publisher even when the DB commit
			// succeeded. Slow-response-read DoS is bounded upstream by
			// NGINX ingress timeouts and the per-IP rate limit. Revisit once
			// validators are parallelised or per-request package counts are
			// bounded.
			IdleTimeout: 120 * time.Second,
		},
	}

	return server
}

// Start begins listening for incoming HTTP requests
func (s *Server) Start() error {