Go to file T
Code
auth.go policy: UserActorFromCurrentUser propagates impersonation + admin (SR2 C1/C2)
compress.go Add middleware stack: requestid, recover, log, realip, secure, timeout, compress, cors, csrf, session
cors.go Add middleware stack: requestid, recover, log, realip, secure, timeout, compress, cors, csrf, session
csrf.go Add OptionalUser/RequireUser middleware + MaxBodySize cap; honor real TLS state in nosurf
logging.go Add middleware stack: requestid, recover, log, realip, secure, timeout, compress, cors, csrf, session
metrics.go Add Prometheus registry, HTTP middleware, and DB pool observer
middleware_test.go api: propagate PAT policy actors
pat.go middleware/pat: JSON envelope on 401/403, set X-OAuth-Scopes header
policy.go S15: PolicyCache middleware so handlers share per-request memo
query_count_assert.go S36: CountQueries middleware + QueriesFor test helper
realip.go Add middleware stack: requestid, recover, log, realip, secure, timeout, compress, cors, csrf, session
recover.go Plumb config + observability into web server (logger from config, /metrics route, panic counter, error report from recover)
requestid.go Add middleware stack: requestid, recover, log, realip, secure, timeout, compress, cors, csrf, session
secure.go middleware/secure: allow Stripe checkout + portal in form-action
session.go Add middleware stack: requestid, recover, log, realip, secure, timeout, compress, cors, csrf, session
timeout.go Add middleware stack: requestid, recover, log, realip, secure, timeout, compress, cors, csrf, session