Keyboard shortcuts

Press ← or → to navigate between chapters

Press S or / to search in the book

Press ? to show this help

Press Esc to hide this help

Middleware Catalogue

The catalogue is a set of ready-made middleware packages that cover the common needs of every production API — authentication, validation, password hashing, audit logging, caching, CORS, and so on. Each one is an ordinary maniflex.MiddlewareFunc you register on the appropriate pipeline step, with the same scoping options as any other middleware.

The packages live under maniflex/middleware/. Most are part of the root module, so they need no extra require to use. Only the two with heavy third-party dependencies are broken out into their own Go modules — middleware/db/redis (the Redis rate-limit/cache backend) and middleware/service/bcrypt (password hashing) — so a project pulls those dependencies in only when it uses them:

PackageStepWhat it ships
middleware/authAuthJWT, API key, role gates, public-read helpers
middleware/bodyDeserialize / Validatebody size limits, unknown-field stripping, type coercion
middleware/idempotencyDeserializeidempotency-key replay for safely retried POSTs
middleware/validateValidateuniqueness, regex, cross-field rules, numeric precision, date ranges, conditional required
middleware/workflowValidatestate-machine transitions with role-gated guards
middleware/serviceService / DB-Afterpassword hashing, slugify, derived fields
middleware/dbDBtenancy, forced filters, rate limiting, audit log, cache invalidation
middleware/responseResponseCORS, caching, transforms, redaction, envelopes, metrics
middleware/openapiOpenAPI.Generatesecurity schemes, servers, titles, custom extensions

How to use the catalogue

Import the package you need and register the returned middleware on the matching pipeline step:

import (
    "github.com/xaleel/maniflex/middleware/auth"
    "github.com/xaleel/maniflex/middleware/service"
)

server.Pipeline.Auth.Register(
    auth.JWTAuth("my-signing-secret", auth.JWTOptions{Issuer: "my-app"}),
)

server.Pipeline.Service.Register(
    service.HashField("password", svcbcrypt.Hasher()), // svcbcrypt = middleware/service/bcrypt
    maniflex.ForModel("User"),
)

Each middleware factory returns a maniflex.MiddlewareFunc, so the standard options — ForModel, ForOperation, AtPosition, WithName — apply verbatim.

Composition

Catalogue middleware is designed to be composable. The expected stack for a typical REST API is roughly:

  1. Auth — JWTAuth or APIKeyAuth populates ctx.Auth; RequireRole gates sensitive operations.
  2. Body — MaxBodySize and StripUnknownFields shape input early.
  3. Validate — built-in tag rules plus UniqueField and friends.
  4. Service — HashField, SetField, SlugifyField, then any custom business logic, then the maniflex/events helpers (events.Emit / events.Webhook / events.SendEmail) on the After side.
  5. DB — Tenancy or ForceFilter enforces row-level scoping; AuditLog and Invalidate run After.
  6. Response — CORSHeaders, Cache, RedactField, then Logging / Metrics on the After side.

Mix and match freely; nothing in the catalogue is required.

Writing your own

The catalogue is just an applied form of Writing Middleware. If a built-in does not match your needs, write your own — the contract is the same func(ctx *maniflex.ServerContext, next func() error) error signature.