Expose HTTP services on a single port

[jeroenrinzema]

This pull request refactors the client HTTP API to simplify endpoint structure and improve authentication. The main changes include removing the need to specify a project ID in the URL for client endpoints (the project is now determined from the API key), consolidating server startup logic, and updating the RBAC scope to include project information. Related code, tests, and OpenAPI specs have been updated to reflect these changes.

API and Endpoint Refactoring:

• Replaced per-project client endpoints (/api/client/projects/{projectID}/identify and /api/client/projects/{projectID}/events) with flat endpoints (/api/client/identify and /api/client/events); the project is now inferred from the API key rather than the URL. [1] [2]
• Updated the OpenAPI spec and generated code accordingly, including renaming operation IDs and removing path parameters for project ID. [1] [2] [3]

RBAC and Context Improvements:

• Expanded the Scope struct in rbac to include ProjectID, and updated context handling to extract and pass ProjectID throughout the request lifecycle. [1] [2]

Controller and Test Updates:

• Refactored controller methods to get ProjectID from the RBAC scope instead of from URL parameters, and updated all related tests to match the new function signatures and context usage. [1] [2] [3] [4] [5] [6] [7] [8] [9] [10] [11] [12] [13] [14] [15] [16] [17]

Server and Configuration Simplification:

• Consolidated the management and public HTTP servers into a single server, updating configuration to use a single HTTPAddress instead of separate addresses. [1] [2] [3]

Code Cleanup:

• Removed unused imports, middleware, and legacy code related to the previous API structure. [1] [2]

These changes streamline the client API, improve security by tying requests directly to API keys, and simplify both server and client code.

[Copilot]

Pull request overview

This pull request consolidates HTTP services into a single unified server and simplifies the client API by inferring project context from API keys rather than URL parameters. The refactoring eliminates the need for clients to specify project IDs in endpoints, streamlines authentication, and reduces server configuration complexity.

Changes:

• Removed project ID path parameters from client API endpoints (/api/client/events and /api/client/identify), with project context now derived from API keys
• Consolidated management and client HTTP servers into a single unified server instance
• Enhanced RBAC scope to include project ID information extracted from API keys

Reviewed changes

Copilot reviewed 17 out of 23 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
internal/http/scalar/index.html	Updated API documentation to serve both management and client OpenAPI specs
internal/http/controllers/v1/public/http.go	Removed legacy public server setup (file deleted)
internal/http/controllers/v1/management/oapi/oapi.go	Renamed oapi variable to OAPI for export
internal/http/controllers/v1/management/oapi/middleware.go	Removed Scalar() middleware (consolidated elsewhere)
internal/http/controllers/v1/management/http.go	Removed separate management server setup (file deleted)
internal/http/controllers/v1/http.go	Added unified server combining management and client endpoints
internal/http/controllers/v1/client/subscriptions.go	Updated import path from public/oapi to client/oapi
internal/http/controllers/v1/client/oapi/resources_gen.go	Regenerated client code removing project ID parameters
internal/http/controllers/v1/client/oapi/resources.yml	Updated OpenAPI spec to remove project ID path parameters
internal/http/controllers/v1/client/oapi/oapi.go	Renamed oapi variable to OAPI for export
internal/http/controllers/v1/client/oapi/middleware.go	Removed Scalar() middleware (consolidated elsewhere)
internal/http/controllers/v1/client/client_test.go	Updated tests to pass project ID via RBAC scope instead of parameters
internal/http/controllers/v1/client/client.go	Modified handlers to extract project ID from RBAC scope
internal/http/auth/auth.go	Enhanced API key authentication to populate project ID in RBAC scope
internal/config/config.go	Replaced separate service addresses with single HTTPAddress
internal/claim/rbac/rbac.go	Added ProjectID field to RBAC Scope struct
cmd/lunogram/main.go	Updated main to start single unified server

[Copilot]

The comment was updated from 'admin user' to just 'user', but this struct is used for both admin (management API with JWT) and client API (with API keys) authentication. Consider clarifying this dual purpose, e.g., 'Scope represents an authenticated user or API key in the context'.

[jeroenrinzema]

@copilot open a new pull request to apply changes based on this feedback

[Copilot]

@jeroenrinzema I've opened a new pull request, #149, to work on those changes. Once the pull request is ready, I'll request review from you.