Struct UiServer 

pub struct UiServer { /* private fields */ }

Implementations

impl UiServer

pub fn new(facade: AreevFacade, db_label: String) -> Self

pub fn with_sso( self, header: impl Into<String>, secret: impl Into<String>, ) -> Self

Enable trusted-header SSO (v0). header names the identity header the authenticating proxy forwards; secret is the proxy’s shared secret, demanded in x-areev-proxy-secret on every SSO request.

pub fn with_sso_rotating( self, header: impl Into<String>, secret: impl Into<String>, next: Option<impl Into<String>>, ) -> Self

with_sso with a second secret accepted during a rotation window (#79).

next is the incoming secret; secret stays the one already deployed. While both are configured either proves the proxy, so the fleet can be moved over one node at a time and the old secret retired afterwards — the way a TLS key is rotated. Order carries no privilege: they are equally valid until one is removed, which is what makes the window safe to run in both directions (roll forward, or roll back).

The window is meant to be short. Nothing here enforces that — a deadline the server could enforce would have to live in the file or a clock it does not own — so retiring the old secret is the operator’s step, and docs/runbooks/sso-secret-rotation.md is the procedure.

pub fn with_credentials(self, map: CredentialMap) -> Self

Multi-principal mode: attach the credential map (areev-auth.json). Tokens resolve to principal names; rights come from the memory file’s own grant grains; unauthenticated requests run as anonymous. See docs/cal-reference.md §9.

pub fn with_loop_policy(self, policy: Policy) -> Self

Attach a host loop policy to the console’s loop routes, so a console-triggered run honors the same auto-apply grants, denies, and severity floors as areev loop run --policy.

pub fn allow_remote(self, yes: bool) -> Self

Accept requests whose Host header is non-loopback. Off by default so the loopback console is protected against DNS-rebinding reads even when unauthenticated; the CLI enables it under --allow-remote.

pub fn allow_origin(self, origin: impl Into<String>) -> Self

Accept a cross-origin POST whose Origin header exactly matches this origin (scheme + host[:port], compared case-insensitively with a single trailing / ignored). Call once per origin to allow — there is no wildcard or subdomain form, by design: naming https://console.example.com must never thereby accept https://evil-console.example.com.

--allow-remote does not imply this. The Origin check exists because the console authenticates browsers with HTTP Basic, which the browser caches and re-attaches to cross-site requests — Origin is the only thing telling the console’s own page apart from an attacker’s page riding a viewer’s cached credential, so it is CSRF protection, not defence in depth, and it stays enforced on every non-loopback origin except the ones named here.

pub fn with_auth(self, token: String) -> Self

Require a shared secret on every request (the console page, reads, and writes). Browsers authenticate through the native Basic prompt (any username; password = token); scripts may send Authorization: Bearer <token>. Use this to serve the console to more than a single trusted local operator. Pair with a TLS-terminating proxy for non-local exposure — the token crosses the wire in the clear otherwise.

pub fn allow_destructive_ops(self, allow: bool) -> Self

Permit or forbid destructive CAL (FORGET <hash>) from the query console. Enabled by default; pass false to serve a read-only console. Since the plain console is unauthenticated, disabling this is the safe choice when the console is exposed beyond a trusted local operator.

pub fn bind(addr: &str) -> Result<TcpListener>

Bind and return the listener (lets callers learn the ephemeral port).

pub fn serve(&self, listener: TcpListener) -> Result<()>

Serve forever on an already-bound listener.