From bebc427408bdc836350e59d73c1879a0de6982b9 Mon Sep 17 00:00:00 2001 From: Anirudh Oppiliappan Date: Mon, 27 Jul 2026 16:14:54 +0300 Subject: [PATCH] appview/{config,state}: gate xrpc router behind TANGLED_XRPC_ENABLED Signed-off-by: Anirudh Oppiliappan --- appview/config/config.go | 4 ++++ appview/state/router.go | 6 ++++-- 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/appview/config/config.go b/appview/config/config.go index d8db366a..202f81b2 100644 --- a/appview/config/config.go +++ b/appview/config/config.go @@ -23,6 +23,10 @@ type CoreConfig struct { Dev bool `env:"DEV, default=false"` DisallowedNicknamesFile string `env:"DISALLOWED_NICKNAMES_FILE"` + // gates the org.tangled.* xrpc router (/xrpc). off by default; the svelte + // frontend is the only consumer and isn't shipped yet. + XrpcEnabled bool `env:"XRPC_ENABLED, default=false"` + // origin allowed to call the xrpc endpoints from the browser (the svelte // frontend). empty allows any origin, which is safe here since xrpc uses // bearer service-auth tokens rather than cookies. diff --git a/appview/state/router.go b/appview/state/router.go index a45e2eb1..ebec0041 100644 --- a/appview/state/router.go +++ b/appview/state/router.go @@ -18,6 +18,7 @@ import ( "tangled.org/core/appview/middleware" "tangled.org/core/appview/migration" "tangled.org/core/appview/notifications" + whnotify "tangled.org/core/appview/notify/webhook" "tangled.org/core/appview/pipelines" "tangled.org/core/appview/pulls" "tangled.org/core/appview/repo" @@ -25,7 +26,6 @@ import ( "tangled.org/core/appview/signup" "tangled.org/core/appview/spindles" "tangled.org/core/appview/state/userutil" - whnotify "tangled.org/core/appview/notify/webhook" avstrings "tangled.org/core/appview/strings" avtimeline "tangled.org/core/appview/timeline" avxrpc "tangled.org/core/appview/xrpc" @@ -299,7 +299,9 @@ func (s *State) StandardRouter(mw *middleware.Middleware) http.Handler { r.Mount("/focus", s.FocusRouter(mw)) r.Mount("/signup", s.SignupRouter()) - r.Mount("/xrpc", s.XrpcRouter()) + if s.config.Core.XrpcEnabled { + r.Mount("/xrpc", s.XrpcRouter()) + } r.Mount("/", s.oauth.Router()) r.Get("/terms", s.TermsOfService) -- 2.51.2