systemprompt_api/services/server/
builder.rs

1//! API server construction and the global middleware stack.
2//!
3//! [`setup_api_server`] composes the route tree and applies the global layers
4//! (body limit, analytics, context, session, CORS, trailing-slash, trace and
5//! served-by headers, content negotiation, security headers) in the order they
6//! must run, producing an [`ApiServer`] that binds and serves with graceful
7//! shutdown.
8
9use anyhow::Result;
10use axum::Router;
11use axum::extract::DefaultBodyLimit;
12use systemprompt_runtime::AppContext;
13use systemprompt_traits::{StartupEvent, StartupEventExt, StartupEventSender};
14
15use super::routes::configure_routes;
16use crate::models::ServerConfig;
17use crate::services::middleware::{
18    AnalyticsMiddleware, CorsMiddleware, PublicContextMiddleware, SessionMiddleware,
19    inject_security_headers, inject_served_by, inject_trace_header, remove_trailing_slash,
20};
21
22pub use super::discovery::*;
23pub use super::health::handle_health;
24
25#[derive(Debug)]
26pub struct ApiServer {
27    router: Router,
28    _config: ServerConfig,
29    events: Option<StartupEventSender>,
30}
31
32impl ApiServer {
33    pub fn new(router: Router, events: Option<StartupEventSender>) -> Self {
34        Self::with_config(router, ServerConfig::default(), events)
35    }
36
37    pub const fn with_config(
38        router: Router,
39        config: ServerConfig,
40        events: Option<StartupEventSender>,
41    ) -> Self {
42        Self {
43            router,
44            _config: config,
45            events,
46        }
47    }
48
49    pub fn into_router(self) -> Router {
50        self.router
51    }
52
53    pub async fn serve<F>(self, addr: &str, shutdown: F) -> Result<()>
54    where
55        F: Future<Output = ()> + Send + 'static,
56    {
57        if let Some(ref tx) = self.events
58            && tx
59                .unbounded_send(StartupEvent::ServerBinding {
60                    address: addr.to_owned(),
61                })
62                .is_err()
63        {
64            tracing::debug!("Startup event receiver dropped");
65        }
66
67        let listener = self.create_listener(addr).await?;
68
69        if let Some(ref tx) = self.events {
70            tx.server_listening(addr, std::process::id());
71        }
72
73        axum::serve(
74            listener,
75            self.router
76                .into_make_service_with_connect_info::<std::net::SocketAddr>(),
77        )
78        .with_graceful_shutdown(shutdown)
79        .await?;
80        Ok(())
81    }
82
83    async fn create_listener(&self, addr: &str) -> Result<tokio::net::TcpListener> {
84        tokio::net::TcpListener::bind(addr)
85            .await
86            .map_err(|e| anyhow::anyhow!("Failed to bind to {addr}: {e}"))
87    }
88}
89
90pub fn setup_api_server(ctx: &AppContext, events: Option<StartupEventSender>) -> Result<ApiServer> {
91    let rate_config = &ctx.config().rate_limits;
92
93    if rate_config.disabled
94        && let Some(ref tx) = events
95    {
96        tx.warning("Rate limiting disabled - development mode only");
97    }
98
99    let router = configure_routes(ctx, events.as_ref())?;
100    let router = apply_global_middleware(router, ctx)?;
101
102    Ok(ApiServer::new(router, events))
103}
104
105fn apply_global_middleware(router: Router, ctx: &AppContext) -> Result<Router> {
106    let mut router = router;
107
108    router = router.layer(DefaultBodyLimit::max(2 * 1024 * 1024));
109
110    let analytics_middleware = AnalyticsMiddleware::new(ctx)?;
111    router = router.layer(axum::middleware::from_fn({
112        let middleware = analytics_middleware;
113        move |req, next| {
114            let middleware = middleware.clone();
115            async move { middleware.track_request(req, next).await }
116        }
117    }));
118
119    let global_context_middleware = PublicContextMiddleware::new();
120    router = router.layer(axum::middleware::from_fn({
121        let middleware = global_context_middleware;
122        move |req, next| async move { middleware.handle(req, next).await }
123    }));
124
125    let session_middleware = SessionMiddleware::new(ctx)?;
126    router = router.layer(axum::middleware::from_fn({
127        let middleware = session_middleware;
128        move |req, next| {
129            let middleware = middleware.clone();
130            async move { middleware.handle(req, next).await }
131        }
132    }));
133
134    let cors = CorsMiddleware::build_layer(ctx.config())?;
135    router = router.layer(cors);
136
137    router = router.layer(axum::middleware::from_fn(remove_trailing_slash));
138
139    router = router.layer(axum::middleware::from_fn(inject_trace_header));
140
141    router = router.layer(axum::middleware::from_fn(inject_served_by));
142
143    if ctx.config().content_negotiation.enabled {
144        router = router.layer(axum::middleware::from_fn(
145            crate::services::middleware::content_negotiation_middleware,
146        ));
147    }
148
149    if ctx.config().security_headers.enabled {
150        let security_config = ctx.config().security_headers.clone();
151        router = router.layer(axum::middleware::from_fn(move |req, next| {
152            let config = security_config.clone();
153            inject_security_headers(config, req, next)
154        }));
155    }
156
157    Ok(router)
158}
systemprompt_api/services/server/builder.rs

systemprompt_api/services/server/
builder.rs
