Every public type, function and method

pub type ApiHandler = async (@ctx.Context) -> @http.Response

pub using @openapi {type ApiInfo}

pub using @security {type ApiKey}

pub using @security {type ApiKeyIn}

pub struct App { router : @route.Router layers : Array[&@mid.Layer] exception_handlers : Array[(@ctx.Context, Error) -> @http.Response?] security_schemes : Array[@security.DeclaredScheme] enforcers : Map[String, (@ctx.Context, @security.SecurityScopes, Int64) -> Result[@security.AuthenticatedUser, @http.Response]] status_handlers : Map[Int32, (@ctx.Context) -> @http.Response] mounts : Array[(String, Mount)] startup_hooks : Array[async (Map[String, Json]) -> Unit] shutdown_hooks : Array[async (Map[String, Json]) -> Unit] mut info : @openapi.ApiInfo mut clock : () -> Int64 mut deps : @di.Deps? redirect_slashes : Bool webhooks : @route.Router }

A moonapi application: routes and WebSocket routes, the layers around them, exception and per-status handlers, mounts, the security schemes the OpenAPI document surfaces (with their runtime enforcers), lifespan hooks, and the verification clock. Compiles to an ASGI application any server (mooncat) can run.

pub using @security {type AuthenticatedUser}

pub using @ctx {type BackgroundTasks}

pub using @security {type BasicAuth}

pub using @schema {type Constraint}

pub using @openapi {type Contact}

pub using @di {type Container}

pub using @ctx {type Context}

pub using @di {type Deps}

pub using @security {type DigestAuth}

pub using @socket {type Disconnected}

pub using @endpoint {type Endpoint}

pub using @status {type Events}

pub using @endpoint {type Example}

pub type ExceptionHandler = (@ctx.Context, Error) -> @http.Response?

pub using @openapi {type ExternalDocs}

pub using @schema {type Field}

pub type Hook = async (Map[String, Json]) -> Unit

A lifespan hook: it gets the lifespan state, where what it stores reaches every request as ctx.state().

pub type Hoop = async (@ctx.Context, async (@ctx.Context) -> @route.Reply) -> @route.Reply

pub using @ctx {type HttpBasicCredentials}

pub using @exceptions {type HttpException}

pub using @openapi {type License}

pub using @method {type Method}

pub type Middleware = async (@http.Request, async (@http.Request) -> @http.Response) -> @http.Response

A request-level middleware : the request and call_next, which runs the rest of the application, in; the response out. The response comes back whole, so a stream behind it is gathered first; a middleware that must keep streams streaming is a @mid.Layer.

pub using @security {type OAuth2CodeBearer}

pub using @security {type OAuth2PasswordBearer}

pub using @ctx {type OAuth2PasswordRequestForm}

pub using @schema {type ObjectSchema}

pub using @schema {type OpenApiVersion}

pub using @endpoint {type Param}

pub using @endpoint {type ParamLoc}

pub using @di {type Provider}

pub using @endpoint {type ResponseSpec}

pub using @route {type Router}

pub using @schema {type Schema}

pub using @di {type Scope}

pub using @security {type SecurityRequirement}

pub using @security {type SecurityScheme}

pub using @security {type SecurityScopes}

pub using @openapi {type Server}

pub using @status {type Stream}

pub type StreamHandler = async (@ctx.Context) -> @status.Stream

pub using @openapi {type Tag}

pub using @openapi {type Ui}

pub using @schema {type Unresolved}

pub type Url = (@route.Router) -> Unit

pub using @schema {type ValidationError}

pub using @socket {type WebSocket}

pub using @status {type Writer}

pub type WsHandler = async (@socket.WebSocket) -> Unit

pub using @socket {type WsMessage}

pub const HTTP_100_CONTINUE : Int32 = 100

pub const HTTP_101_SWITCHING_PROTOCOLS : Int32 = 101

pub const HTTP_102_PROCESSING : Int32 = 102

pub const HTTP_103_EARLY_HINTS : Int32 = 103

pub const HTTP_200_OK : Int32 = 200

pub const HTTP_201_CREATED : Int32 = 201

pub const HTTP_202_ACCEPTED : Int32 = 202

pub const HTTP_203_NON_AUTHORITATIVE_INFORMATION : Int32 = 203

pub const HTTP_204_NO_CONTENT : Int32 = 204

pub const HTTP_205_RESET_CONTENT : Int32 = 205

pub const HTTP_206_PARTIAL_CONTENT : Int32 = 206

pub const HTTP_207_MULTI_STATUS : Int32 = 207

pub const HTTP_208_ALREADY_REPORTED : Int32 = 208

pub const HTTP_226_IM_USED : Int32 = 226

pub const HTTP_300_MULTIPLE_CHOICES : Int32 = 300

pub const HTTP_301_MOVED_PERMANENTLY : Int32 = 301

pub const HTTP_302_FOUND : Int32 = 302

pub const HTTP_303_SEE_OTHER : Int32 = 303

pub const HTTP_304_NOT_MODIFIED : Int32 = 304

pub const HTTP_305_USE_PROXY : Int32 = 305

pub const HTTP_306_RESERVED : Int32 = 306

pub const HTTP_307_TEMPORARY_REDIRECT : Int32 = 307

pub const HTTP_308_PERMANENT_REDIRECT : Int32 = 308

pub const HTTP_400_BAD_REQUEST : Int32 = 400

pub const HTTP_401_UNAUTHORIZED : Int32 = 401

pub const HTTP_402_PAYMENT_REQUIRED : Int32 = 402

pub const HTTP_403_FORBIDDEN : Int32 = 403

pub const HTTP_404_NOT_FOUND : Int32 = 404

pub const HTTP_405_METHOD_NOT_ALLOWED : Int32 = 405

pub const HTTP_406_NOT_ACCEPTABLE : Int32 = 406

pub const HTTP_407_PROXY_AUTHENTICATION_REQUIRED : Int32 = 407

pub const HTTP_408_REQUEST_TIMEOUT : Int32 = 408

pub const HTTP_409_CONFLICT : Int32 = 409

pub const HTTP_410_GONE : Int32 = 410

pub const HTTP_411_LENGTH_REQUIRED : Int32 = 411

pub const HTTP_412_PRECONDITION_FAILED : Int32 = 412

pub const HTTP_413_REQUEST_ENTITY_TOO_LARGE : Int32 = 413

pub const HTTP_414_REQUEST_URI_TOO_LONG : Int32 = 414

pub const HTTP_415_UNSUPPORTED_MEDIA_TYPE : Int32 = 415

pub const HTTP_416_REQUESTED_RANGE_NOT_SATISFIABLE : Int32 = 416

pub const HTTP_417_EXPECTATION_FAILED : Int32 = 417

pub const HTTP_418_IM_A_TEAPOT : Int32 = 418

pub const HTTP_421_MISDIRECTED_REQUEST : Int32 = 421

pub const HTTP_422_UNPROCESSABLE_ENTITY : Int32 = 422

pub const HTTP_423_LOCKED : Int32 = 423

pub const HTTP_424_FAILED_DEPENDENCY : Int32 = 424

pub const HTTP_425_TOO_EARLY : Int32 = 425

pub const HTTP_426_UPGRADE_REQUIRED : Int32 = 426

pub const HTTP_428_PRECONDITION_REQUIRED : Int32 = 428

pub const HTTP_429_TOO_MANY_REQUESTS : Int32 = 429

pub const HTTP_431_REQUEST_HEADER_FIELDS_TOO_LARGE : Int32 = 431

pub const HTTP_451_UNAVAILABLE_FOR_LEGAL_REASONS : Int32 = 451

pub const HTTP_500_INTERNAL_SERVER_ERROR : Int32 = 500

pub const HTTP_501_NOT_IMPLEMENTED : Int32 = 501

pub const HTTP_502_BAD_GATEWAY : Int32 = 502

pub const HTTP_503_SERVICE_UNAVAILABLE : Int32 = 503

pub const HTTP_504_GATEWAY_TIMEOUT : Int32 = 504

pub const HTTP_505_HTTP_VERSION_NOT_SUPPORTED : Int32 = 505

pub const HTTP_506_VARIANT_ALSO_NEGOTIATES : Int32 = 506

pub const HTTP_507_INSUFFICIENT_STORAGE : Int32 = 507

pub const HTTP_508_LOOP_DETECTED : Int32 = 508

pub const HTTP_510_NOT_EXTENDED : Int32 = 510

pub const HTTP_511_NETWORK_AUTHENTICATION_REQUIRED : Int32 = 511

pub let query_limits : @moonurl.Limits

pub const WS_1000_NORMAL_CLOSURE : Int32 = 1000

pub const WS_1001_GOING_AWAY : Int32 = 1001

pub const WS_1002_PROTOCOL_ERROR : Int32 = 1002

pub const WS_1003_UNSUPPORTED_DATA : Int32 = 1003

pub const WS_1005_NO_STATUS_RCVD : Int32 = 1005

pub const WS_1006_ABNORMAL_CLOSURE : Int32 = 1006

pub const WS_1007_INVALID_FRAME_PAYLOAD_DATA : Int32 = 1007

pub const WS_1008_POLICY_VIOLATION : Int32 = 1008

pub const WS_1009_MESSAGE_TOO_BIG : Int32 = 1009

pub const WS_1010_MANDATORY_EXT : Int32 = 1010

pub const WS_1011_INTERNAL_ERROR : Int32 = 1011

pub const WS_1012_SERVICE_RESTART : Int32 = 1012

pub const WS_1013_TRY_AGAIN_LATER : Int32 = 1013

pub const WS_1014_BAD_GATEWAY : Int32 = 1014

pub const WS_1015_TLS_HANDSHAKE : Int32 = 1015

pub fn check_constraints(Json, Array[@schema.Constraint], Array[String], Array[@schema.ValidationError]) -> Unit

Returns Unit

pub fn create_access_token(String, String, Int64, scopes? : Array[String], expires_in_secs? : Int64, extra? : Map[String, Json], wins? : @jwt.Wins, clash? : @jwt.OnClash[Map[String, Json]]) -> String

Returns String

pub fn data_response(String, filename? : String, status? : Int32, inline? : Bool) -> @http.Response?

Returns @http.Response?

pub fn data_url(Bytes, media_type? : String) -> String

Returns String

pub fn delete_cookie(@http.Response, String, path? : String?, domain? : String, secure? : Bool, http_only? : Bool, same_site? : @cookie.SameSite?) -> @http.Response

Returns @http.Response

pub fn file_response(Bytes, filename? : String, media_type? : String, status? : Int32, inline? : Bool) -> @http.Response

Returns @http.Response

pub fn filter_response(@schema.Schema, Json) -> Result[Json, Array[@schema.ValidationError]]

Returns Result[Json, Array[@schema.ValidationError]]

pub fn group(String, Array[(@route.Router) -> Unit], tags? : Array[String], security? : Array[@security.SecurityRequirement], dependencies? : Array[String], hoops? : Array[async (@ctx.Context, async (@ctx.Context) -> @route.Reply) -> @route.Reply]) -> (@route.Router) -> Unit

Returns (@route.Router) -> Unit

pub fn html(Int32, String) -> @http.Response

Returns @http.Response

pub fn http_error(Int32, String, headers? : Array[(String, String)]) -> @exceptions.HttpException

Returns @exceptions.HttpException

pub fn json(Int32, Json) -> @http.Response

Returns @http.Response

pub fn json_model(Int32, @schema.Schema, Json) -> @http.Response

Returns @http.Response

pub fn parse_basic_auth(String) -> @ctx.HttpBasicCredentials?

Returns @ctx.HttpBasicCredentials?

pub fn path(String, async (@ctx.Context) -> @http.Response, methods? : Array[@method.Method], name? : String) -> (@route.Router) -> Unit

Returns (@route.Router) -> Unit

pub fn redirect(String, status? : Int32) -> @http.Response

Returns @http.Response

pub fn redoc_ui(spec_url? : String, title? : String, js_url? : String, telemetry? : Bool) -> String

Returns String

pub fn scalar_ui(spec_url? : String, title? : String, js_url? : String, extra? : Map[String, Json]) -> String

Returns String

pub fn set_cookie(@http.Response, String, String, max_age? : Int32, expires? : @moondate.Moment, path? : String?, domain? : String, secure? : Bool, http_only? : Bool, same_site? : @cookie.SameSite?) -> @http.Response

Returns @http.Response

pub fn sse(async (@status.Events) -> Unit, status? : Int32, headers? : Array[(String, String)], space? : Bool, wins? : @jwt.Wins, clash? : @jwt.OnClash[Array[(String, String)]]) -> @status.Stream

Returns @status.Stream

pub fn swagger_redirect(js_url? : String) -> String

Returns String

pub fn swagger_ui(spec_url? : String, title? : String, js_url? : String, css_url? : String, oauth2_redirect_url? : String, init_oauth? : Json, extra? : Map[String, Json]) -> String

Returns String

pub fn text(Int32, String) -> @http.Response

Returns @http.Response

pub fn token_response(String) -> @http.Response

Returns @http.Response

pub fn unprocessable(Array[@schema.ValidationError]) -> @http.Response

Returns @http.Response

pub fn validate_schema(@schema.Schema, Json, Array[String], Array[@schema.ValidationError]) -> Unit

Returns Unit

pub fn validation_error_body(Array[@schema.ValidationError]) -> Json

Returns Json

pub fn view(String, &@route.View, name? : String) -> (@route.Router) -> Unit

Returns (@route.Router) -> Unit

pub fn websocket(String, async (@socket.WebSocket) -> Unit, name? : String) -> (@route.Router) -> Unit

Returns (@route.Router) -> Unit

pub fn with_constraints(Json, Array[@schema.Constraint], @schema.OpenApiVersion) -> Json

Returns Json

pub fn App::add_security_scheme(Self, String, @security.SecurityScheme, description? : String) -> Unit

Declare a security scheme under name, surfaced in the emitted OpenAPI document (components/securitySchemes in 3.x, securityDefinitions in Swagger 2.0) so the generated spec describes how to authenticate. description is the prose shown beside it in the documentation UI.

This declares only. A route naming this scheme in its security is documented as protected and left unguarded, exactly as a scheme that no path operation depends on is — the secure_* functions are the ones that wire an enforcer.

Returns Unit

pub fn App::add_status_handler(Self, Int32, (@ctx.Context) -> @http.Response) -> Unit

Register a per-status exception handler keyed by an HTTP status code). Whenever an error path yields status — a routing 404 / 405, or a raised HttpException (or the fallback 500) — the handler's response replaces the default, so an app can serve a custom error page. Successful handler returns are never rewritten.

Returns Unit

pub fn App::delete(Self, String, async (@ctx.Context) -> @http.Response, summary? : String, description? : String, tags? : Array[String], deprecated? : Bool, operation_id? : String, status_code? : Int32, responses? : Array[@endpoint.ResponseSpec], name? : String, endpoint? : @endpoint.Endpoint, security? : Array[@security.SecurityRequirement], dependencies? : Array[String], include_in_schema? : Bool, validate? : Bool, openapi_extra? : Json, callbacks? : Array[@route.Route], hoops? : Array[async (@ctx.Context, async (@ctx.Context) -> @route.Reply) -> @route.Reply]) -> Unit

Register a DELETE route. A shorthand for route(Delete, ...).

Returns Unit

pub fn App::depends(Self, @di.Deps) -> Unit

Give the app the dependency container its routes resolve their declared dependencies through the application supplies). The container's value type is erased on the way in, because a route-level dependency runs for its effect and its value is never handed to the handler — the same thing dependencies=[...] does with the values it builds.

A route that declares a dependency the container does not provide is answered with a 500: the setup the route promised did not happen, and running the handler as though it had is worse than saying so.

Returns Unit

pub fn App::describe(Self, title? : String, summary? : String, api_version? : String, description? : String, terms_of_service? : String, contact? : @openapi.Contact?, license? : @openapi.License?, servers? : Array[@openapi.Server], tags? : Array[@openapi.Tag], external_docs? : @openapi.ExternalDocs?) -> Unit

Set what the OpenAPI document says about this API summary=…, description=…, contact=…, license_info=…, servers=…, openapi_tags=…, openapi_external_docs=…)). App::openapi and the /openapi.json route enable_docs` registers both read it, so the document a client fetches and the one a test builds cannot describe different APIs. An argument left out keeps what was set before.

Returns Unit

pub fn App::enable_docs(Self, openapi_url? : String?, docs_url? : String?, redoc_url? : String?, version? : @schema.OpenApiVersion, ui? : @openapi.Ui, oauth2_redirect_url? : String?, init_oauth? : Json, ui_extra? : Map[String, Json], root_path_in_servers? : Bool) -> Unit

Serve the app's own documentation: the OpenAPI document at openapi_url, an interactive reference at docs_url, and ReDoc at redoc_url. Pass None for any of them to leave it off. The routes are kept out of the document they serve, so enabling docs does not change the spec a client reads.

ui picks the reader at docs_url. With Swagger, oauth2_redirect_url is where an OAuth2 flow started from the page returns to, and init_oauth prefills it ; ui_extra is merged over the reader's own settings either way.

Behind a proxy that mounts the app under a prefix, the server reports that prefix as the ASGI root_path. The pages then fetch the document from under it, and with root_path_in_servers the document names it as its first server, so a call tried out from the page goes where the app actually is.

It is a call rather than a default because registering routes behind the app's back would surprise anyone mounting this app under a prefix.

Returns Unit

pub fn App::exception_handler(Self, (@ctx.Context, Error) -> @http.Response?) -> Unit

Register an exception handler. On a raised error the handlers are tried in registration order; the first to return Some(response) wins. An unhandled error falls through to the built-in mapping — an HttpException becomes its own status / detail, anything else a 500.

Returns Unit

pub fn App::get(Self, String, async (@ctx.Context) -> @http.Response, summary? : String, description? : String, tags? : Array[String], deprecated? : Bool, operation_id? : String, status_code? : Int32, responses? : Array[@endpoint.ResponseSpec], name? : String, endpoint? : @endpoint.Endpoint, security? : Array[@security.SecurityRequirement], dependencies? : Array[String], include_in_schema? : Bool, validate? : Bool, openapi_extra? : Json, callbacks? : Array[@route.Route], hoops? : Array[async (@ctx.Context, async (@ctx.Context) -> @route.Reply) -> @route.Reply]) -> Unit

Register a GET route. A shorthand for route(Get, ...).

Returns Unit

pub async fn App::handle(Self, @http.Request) -> @http.Response

Run request through the app in-process and return the response, the way a server would see it answered: the same ASGI path, layers included . A streamed response comes back with its body joined.

async test {
  let app = @moonapi.App::new()
  app.get("/users/{id}", ctx => {
    @moonapi.text(200, "user " + ctx.param("id").unwrap())
  })
  let reply = app.handle({
    http_method: "GET",
    path: "/users/42",
    query_string: b"",
    headers: [],
    body: b"",
  })
  assert_eq(reply.body, b"user 42")
}

Returns @http.Response

pub fn App::head(Self, String, async (@ctx.Context) -> @http.Response, summary? : String, description? : String, tags? : Array[String], deprecated? : Bool, operation_id? : String, status_code? : Int32, responses? : Array[@endpoint.ResponseSpec], name? : String, endpoint? : @endpoint.Endpoint, security? : Array[@security.SecurityRequirement], dependencies? : Array[String], include_in_schema? : Bool, validate? : Bool, openapi_extra? : Json, callbacks? : Array[@route.Route], hoops? : Array[async (@ctx.Context, async (@ctx.Context) -> @route.Reply) -> @route.Reply]) -> Unit

Register a HEAD route. A shorthand for route(Head, ...).

Returns Unit

pub fn App::include_router(Self, @route.Router, prefix? : String, tags? : Array[String], security? : Array[@security.SecurityRequirement], dependencies? : Array[String], responses? : Array[@endpoint.ResponseSpec], deprecated? : Bool, include_in_schema? : Bool, hoops? : Array[async (@ctx.Context, async (@ctx.Context) -> @route.Reply) -> @route.Reply]) -> Unit

Fold router's routes into this app ( include_router, and the same name — include is a reserved word). Each is registered under prefix and becomes one of the app's own routes, with the arguments given here reaching every one of them as Router::include_router describes.

Returns Unit

pub fn App::layer(Self, &@mid.Layer) -> Unit

Wrap the application in layer, a moonasgi ASGI middleware add_middleware): moonasgi's Cors, Gzip, TrustedHosts, HttpsRedirect and ServerErrors, or one of your own. The first registered is the outermost, layers and middleware alike, and they wrap mounted applications too.

Returns Unit

pub fn App::middleware(Self, async (@http.Request, async (@http.Request) -> @http.Response) -> @http.Response) -> Unit

Add a request-level middleware , placed among the layers in registration order.

Returns Unit

pub fn App::mount(Self, String, Self) -> Unit

Mount a sub-application under prefix . A request whose path lies under prefix is served by subapp, with the prefix moved from path to root_path (its own layers, security and background tasks apply), and the sub-app's routes appear under prefix in the merged OpenAPI document with its security schemes folded into the parent's.

Returns Unit

pub fn App::mount_asgi(Self, String, async (@spec.Scope, async () -> @spec.Event, async (@spec.Event) -> Unit) -> Unit) -> Unit

Mount any ASGI application under prefix app.mount("/static", StaticFiles(...))). A request under prefix reaches app with the prefix moved from path to root_path, exactly as for a sub-app.

It is not a moonapi application, so it contributes nothing to the OpenAPI document and has no lifespan of its own to run — the app only routes to it. Mounts are tried in registration order, whichever kind they are.

Returns Unit

pub fn App::new(redirect_slashes? : Bool) -> Self

Create an empty application. The verification clock defaults to 0 (Unix epoch); a server sets a real one with App::set_clock, and tests inject a fixed time so token expiry is deterministic.

redirect_slashes answers a path that matches no route, but would with its trailing slash added or removed, with a 307 to that other path, the query kept . / itself is never redirected, nor is a WebSocket connection.

async test {
  let app = @moonapi.App::new()
  app.get("/", _ctx => @moonapi.text(200, "Hello"))
  let reply = app.handle({
    http_method: "GET",
    path: "/",
    query_string: b"",
    headers: [],
    body: b"",
  })
  assert_eq(reply.status, 200)
}

Returns Self

pub fn App::on_shutdown(Self, async (Map[String, Json]) -> Unit) -> Unit

Run hook when the server shuts down, after the last request has been served on_event("shutdown")). Hooks run in reverse registration order, so a resource is released before whatever it was opened from. A hook that raises does not stop the others — shutdown reports the first failure once the rest have run.

Returns Unit

pub fn App::on_startup(Self, async (Map[String, Json]) -> Unit) -> Unit

Run hook when the server starts, before it accepts the first request on_event("startup")). Hooks run in the order they were registered; one that raises aborts startup, and the server is told why.

Returns Unit

pub fn App::openapi(Self, version? : @schema.OpenApiVersion, title? : String, summary? : String, api_version? : String, description? : String, terms_of_service? : String, contact? : @openapi.Contact?, license? : @openapi.License?, servers? : Array[@openapi.Server], tags? : Array[@openapi.Tag], external_docs? : @openapi.ExternalDocs?) -> Json

Build the app's OpenAPI document as a Json value, walking the registered routes — this app's and every mounted sub-app's, each under its prefix — into paths, methods and operations. version picks the dialect: Swagger 2.0, OpenAPI 3.0.3 or 3.1.0 off the identical routes. Routes registered with include_in_schema=false are left out.

The webhooks go under webhooks, which only 3.1 has; callbacks go under their operation in both 3.x dialects. Swagger 2.0 can express neither and leaves them out. The named arguments override what App::describe set, for this one document.

Returns Json

pub fn App::openapi_json(Self, version? : @schema.OpenApiVersion) -> String

The app's OpenAPI / Swagger document for version, stringified.

test {
  let app = @moonapi.App::new()
  app.get("/ping", _ctx => @moonapi.text(200, "pong"), summary="health check")
  let doc = app.openapi_json()
  assert_true(doc.contains("\"openapi\": \"3.1.0\""))
  assert_true(doc.contains("\"/ping\""))
}

Returns String

pub fn App::options(Self, String, async (@ctx.Context) -> @http.Response, summary? : String, description? : String, tags? : Array[String], deprecated? : Bool, operation_id? : String, status_code? : Int32, responses? : Array[@endpoint.ResponseSpec], name? : String, endpoint? : @endpoint.Endpoint, security? : Array[@security.SecurityRequirement], dependencies? : Array[String], include_in_schema? : Bool, validate? : Bool, openapi_extra? : Json, callbacks? : Array[@route.Route], hoops? : Array[async (@ctx.Context, async (@ctx.Context) -> @route.Reply) -> @route.Reply]) -> Unit

Register a OPTIONS route. A shorthand for route(Options, ...).

Returns Unit

pub fn App::patch(Self, String, async (@ctx.Context) -> @http.Response, summary? : String, description? : String, tags? : Array[String], deprecated? : Bool, operation_id? : String, status_code? : Int32, responses? : Array[@endpoint.ResponseSpec], name? : String, endpoint? : @endpoint.Endpoint, security? : Array[@security.SecurityRequirement], dependencies? : Array[String], include_in_schema? : Bool, validate? : Bool, openapi_extra? : Json, callbacks? : Array[@route.Route], hoops? : Array[async (@ctx.Context, async (@ctx.Context) -> @route.Reply) -> @route.Reply]) -> Unit

Register a PATCH route. A shorthand for route(Patch, ...).

Returns Unit

pub fn App::post(Self, String, async (@ctx.Context) -> @http.Response, summary? : String, description? : String, tags? : Array[String], deprecated? : Bool, operation_id? : String, status_code? : Int32, responses? : Array[@endpoint.ResponseSpec], name? : String, endpoint? : @endpoint.Endpoint, security? : Array[@security.SecurityRequirement], dependencies? : Array[String], include_in_schema? : Bool, validate? : Bool, openapi_extra? : Json, callbacks? : Array[@route.Route], hoops? : Array[async (@ctx.Context, async (@ctx.Context) -> @route.Reply) -> @route.Reply]) -> Unit

Register a POST route. A shorthand for route(Post, ...).

Returns Unit

pub fn App::put(Self, String, async (@ctx.Context) -> @http.Response, summary? : String, description? : String, tags? : Array[String], deprecated? : Bool, operation_id? : String, status_code? : Int32, responses? : Array[@endpoint.ResponseSpec], name? : String, endpoint? : @endpoint.Endpoint, security? : Array[@security.SecurityRequirement], dependencies? : Array[String], include_in_schema? : Bool, validate? : Bool, openapi_extra? : Json, callbacks? : Array[@route.Route], hoops? : Array[async (@ctx.Context, async (@ctx.Context) -> @route.Reply) -> @route.Reply]) -> Unit

Register a PUT route. A shorthand for route(Put, ...).

Returns Unit

pub fn App::route(Self, @method.Method, String, async (@ctx.Context) -> @http.Response, summary? : String, description? : String, tags? : Array[String], deprecated? : Bool, operation_id? : String, status_code? : Int32, responses? : Array[@endpoint.ResponseSpec], name? : String, endpoint? : @endpoint.Endpoint, security? : Array[@security.SecurityRequirement], dependencies? : Array[String], include_in_schema? : Bool, validate? : Bool, openapi_extra? : Json, callbacks? : Array[@route.Route], hoops? : Array[async (@ctx.Context, async (@ctx.Context) -> @route.Reply) -> @route.Reply]) -> Unit

Register a route for an explicit method. An optional endpoint descriptor makes the route fully typed (its parameters, request body, and responses surface in the OpenAPI document and drive validation); security attaches per-operation requirements (emitted as OpenAPI security and enforced before the handler when their scheme has an enforcer); dependencies names provider keys resolved through the app's container (App::depends) before the handler and torn down after it, whatever the handler did.

The rest describe the operation: summary and description are its prose, operation_id the stable handle client generators name their method after, status_code the status its success response is documented under, responses further documented responses, name the handle App::url_for resolves, openapi_extra a fragment merged over the generated operation object, and callbacks the requests this operation makes back to its caller, written as routes whose paths are runtime expressions — the same keyword arguments path operations take. hoops wrap this one route, inside any its routers put around it.

Returns Unit

pub fn App::route_stream(Self, @method.Method, String, async (@ctx.Context) -> @status.Stream, summary? : String, description? : String, tags? : Array[String], deprecated? : Bool, operation_id? : String, status_code? : Int32, responses? : Array[@endpoint.ResponseSpec], name? : String, endpoint? : @endpoint.Endpoint, security? : Array[@security.SecurityRequirement], dependencies? : Array[String], include_in_schema? : Bool, validate? : Bool, openapi_extra? : Json, callbacks? : Array[@route.Route], hoops? : Array[async (@ctx.Context, async (@ctx.Context) -> @route.Reply) -> @route.Reply]) -> Unit

Register a streaming route StreamingResponse). The handler's chunks reach the client as separate body events, so a long or open-ended reply starts arriving before it is finished.

A stream is only streamed as far as the app can honestly keep it one: a middleware that rewrites the body — gzip does — collapses the reply to a single chunk. Everything else about the route is ordinary; it documents, validates and enforces security exactly as route does.

Returns Unit

pub fn App::secure_api_key(Self, String, @security.ApiKey, description? : String, auto_error? : Bool) -> Unit

Declare an API-key scheme under name and wire it as a runtime enforcer Security(APIKeyHeader(name=...))). The scheme appears in the document as apiKey in the header, query or cookie the key names, and a route requiring name is refused with 403 unless it presents a key the scheme accepts.

Returns Unit

pub fn App::secure_basic(Self, String, @security.BasicAuth, description? : String, auto_error? : Bool) -> Unit

Declare an HTTP Basic scheme under name and wire it as a runtime enforcer . A route requiring name is refused with 401 and a Basic challenge unless it presents credentials the scheme accepts.

Returns Unit

pub fn App::secure_bearer(Self, String, String, bearer_format? : String, description? : String, auto_error? : Bool) -> Unit

Declare a plain HTTP bearer scheme under name and wire it as a runtime enforcer . The token is verified as an HS256 JWT against secret at the app clock's time, and the route's required scopes are checked against the token's — the same guard the OAuth2 flows use, without an OAuth2 flow to advertise.

Returns Unit

pub fn App::secure_digest(Self, String, @security.DigestAuth, description? : String, auto_error? : Bool) -> Unit

Declare an HTTP Digest scheme under name and wire it as a runtime enforcer . A route requiring name is refused with 403 unless it presents a Digest credential the scheme accepts.

Returns Unit

pub fn App::secure_oauth2(Self, String, @security.OAuth2PasswordBearer, scopes? : Array[(String, String)], description? : String, auto_error? : Bool) -> Unit

Declare an OAuth2 password-bearer scheme under name and wire it as a runtime enforcer. Like add_security_scheme it surfaces the scheme in the OpenAPI document (with the advertised scopes and description), and additionally registers the guard a route names in its security: the app pulls the bearer token, verifies it against bearer's secret at the app clock's time, and checks the route's required scopes — returning 401/403 before the handler runs.

auto_error=false admits the request instead of refusing it every security class takes, whose dependency then yields None and leaves the decision to the route).

Returns Unit

pub fn App::secure_oauth2_code(Self, String, @security.OAuth2CodeBearer, scopes? : Array[(String, String)], description? : String, auto_error? : Bool) -> Unit

Declare an OAuth2 authorization-code scheme under name and wire it as a runtime enforcer . The document describes the browser redirect and token endpoints and the advertised scopes; the guard verifies the presented bearer token exactly as the password flow's does, since by the time a request arrives the two flows have produced the same credential.

Returns Unit

pub fn App::secure_openid(Self, String, String, String, description? : String, auto_error? : Bool) -> Unit

Declare an OpenID Connect scheme under name and wire it as a runtime enforcer . url is the discovery document a client reads every other parameter from; secret is what the ID token presented as a bearer credential is verified against.

Swagger 2.0 has no openIdConnect type, so this scheme is absent from a 2.0 document rather than described as something it is not.

Returns Unit

pub fn App::set_clock(Self, () -> Int64) -> Unit

Set the clock the app reads to verify token expiry when enforcing route security (Unix seconds). A native server passes the wall clock; a test passes a fixed function so expiry is deterministic.

Returns Unit

pub fn App::stream(Self, String, async (@ctx.Context) -> @status.Stream, summary? : String, description? : String, tags? : Array[String], deprecated? : Bool, operation_id? : String, status_code? : Int32, responses? : Array[@endpoint.ResponseSpec], name? : String, endpoint? : @endpoint.Endpoint, security? : Array[@security.SecurityRequirement], dependencies? : Array[String], include_in_schema? : Bool, validate? : Bool, openapi_extra? : Json, callbacks? : Array[@route.Route], hoops? : Array[async (@ctx.Context, async (@ctx.Context) -> @route.Reply) -> @route.Reply]) -> Unit

Register a streaming GET route — the verb a stream is nearly always read over, and what an SSE endpoint is. A shorthand for route_stream(Get, ...).

Returns Unit

pub fn App::to_asgi(Self) -> async (@spec.Scope, async () -> @spec.Event, async (@spec.Event) -> Unit) -> Unit

Compile the app to an ASGI application a server can run: the layers around the router, in registration order with the first outermost.

Returns async (@spec.Scope, async () -> @spec.Event, async (@spec.Event) -> Unit) -> Unit

pub fn App::trace(Self, String, async (@ctx.Context) -> @http.Response, summary? : String, description? : String, tags? : Array[String], deprecated? : Bool, operation_id? : String, status_code? : Int32, responses? : Array[@endpoint.ResponseSpec], name? : String, endpoint? : @endpoint.Endpoint, security? : Array[@security.SecurityRequirement], dependencies? : Array[String], include_in_schema? : Bool, validate? : Bool, openapi_extra? : Json, callbacks? : Array[@route.Route], hoops? : Array[async (@ctx.Context, async (@ctx.Context) -> @route.Reply) -> @route.Reply]) -> Unit

Register a TRACE route. A shorthand for route(Trace, ...).

Returns Unit

pub fn App::url_for(Self, String, params? : Map[String, String]) -> String?

The path of the route registered under name, with its parameters filled from params . Mounted sub-applications are searched too, so what comes back already carries the mount prefix — the path a client would call, not the one the sub-app knows itself by.

None when nothing is registered under that name, or when params is missing one the path needs or holds one its convertor refuses; only a path parameter takes a /.

test {
  let app = @moonapi.App::new()
  app.get("/items/{id}", _ctx => @moonapi.text(200, "item"), name="get_item")
  assert_eq(
    app.url_for("get_item", params=Map([("id", "77")])),
    Some("/items/77"),
  )
}

Returns String?

pub fn App::urls(Self, Array[(@route.Router) -> Unit]) -> Unit

Register a route table; see Router::urls.

Returns Unit

pub fn App::view(Self, String, &@route.View, name? : String, tags? : Array[String], security? : Array[@security.SecurityRequirement], dependencies? : Array[String], deprecated? : Bool, include_in_schema? : Bool, hoops? : Array[async (@ctx.Context, async (@ctx.Context) -> @route.Reply) -> @route.Reply]) -> Unit

Register the methods view answers at path; see Router::view.

Returns Unit

pub fn App::websocket(Self, String, async (@socket.WebSocket) -> Unit, name? : String, security? : Array[@security.SecurityRequirement], dependencies? : Array[String]) -> Unit

Register a WebSocket route . The path is a template with the same parameters and convertors as an HTTP route's.

security is enforced and dependencies resolved before the handler is called. A refusal declines the handshake with the response an HTTP route would have answered — through ASGI's websocket.http.response extension where the server offers it, and with close code 1008 otherwise. The dependencies are torn down when the handler returns. name is the handle App::url_for resolves.

Returns Unit

pub struct BackgroundTasks { // private fields }

A queue of deferred tasks. A handler adds to ctx.background; the app runs the queue in the order tasks were added, after the response is sent and within the same request.

pub using @moonmime {type Form}

pub using @moonmime {type Limits}

pub using @moonmime {type Upload}

pub fn parse_basic_auth(String) -> HttpBasicCredentials?

Parse an HTTP Basic Authorization header value into credentials , or None. Matches the Basic scheme case-insensitively (RFC 7617), base64-decodes the rest, and splits on the first colon so a password may itself contain colons.

Returns HttpBasicCredentials?

pub fn split_scopes(String) -> Array[String]

Split a space-delimited scope string into its scopes, dropping empty runs — the OAuth2 scope form field is one string like "read write".

Returns Array[String]

pub fn BackgroundTasks::add_task(Self, async () -> Unit) -> Unit

Enqueue a task to run after the response is sent .

Returns Unit

pub fn BackgroundTasks::length(Self) -> Int32

How many tasks are queued.

Returns Int32

pub fn BackgroundTasks::new() -> Self

An empty task queue.

Returns Self

pub async fn BackgroundTasks::run(Self) -> Unit

Run every queued task in order, each after the previous returns, then clear the queue. A task that raises stops the ones after it and the error goes to the caller, as in .

Returns Unit

pub fn Context::api_key_cookie(Self, String) -> String?

The API key carried in the cookie name , or None.

Returns String?

pub fn Context::api_key_header(Self, String) -> String?

The API key carried in the request header name , or None. Header names are matched against the request's lower-cased headers.

Returns String?

pub fn Context::api_key_query(Self, String) -> String?

The API key carried in the query parameter name , or None.

Returns String?

pub fn Context::bearer_token(Self) -> String?

Pull the bearer token out of the Authorization: Bearer <token> header, None if the header is absent or isn't a bearer credential. The scheme name is matched case-insensitively, as RFC 6750 requires.

Returns String?

pub fn Context::body_json(Self) -> Json?

Parse the request body as JSON, returning None for an empty body or one that does not parse — the total counterpart of reading a JSON body.

test {
  let request : @moonasgi.Request = {
    http_method: "POST",
    path: "/login",
    query_string: b"",
    headers: [],
    body: b"{\"user\":\"ada\"}",
  }
  assert_eq(@ctx.Context::new(request).body_json(), Some({ "user": "ada" }))
  assert_eq(
    @ctx.Context::new({ ..request, body: b"not json", }).body_json(),
    None,
  )
}

Returns Json?

pub fn Context::cookie(Self, String) -> String?

Look up a cookie by name from the request Cookie header, which is a ; -separated list of key=value pairs. Spaces around a name or a value are the separators'; None if there is no Cookie header or the name is absent.

Returns String?

pub fn Context::digest_credentials(Self) -> String?

The credential of an Authorization: Digest <parameters> header — the comma-separated parameter list, verbatim . None when the header is absent or names another scheme; the scheme name is matched case-insensitively, as RFC 7235 requires.

Returns String?

pub fn Context::form(Self, limits? : @moonmime.Limits) -> @moonmime.Form?

The posted form — Form(...) and File(...) parameters.

Reading the body is moonhttp/form's job; what belongs here is knowing that a request has a Content-Type and handing it over. None means the form broke its bounds and was refused whole: a handler given the first thousand parts of a larger form would be answering a request nobody sent. An empty form is the other answer, and means the request carried none.

Returns @moonmime.Form?

pub fn Context::http_basic(Self) -> HttpBasicCredentials?

The HTTP Basic credentials on this request , or None.

Returns HttpBasicCredentials?

pub fn Context::json_field(Self, String) -> Json?

Pull a single field out of a JSON object body by name, None if the body is absent, not an object, or lacks the field.

Returns Json?

pub fn Context::last_event_id(Self) -> String?

The id of the last event the client received, from the Last-Event-ID header an event source sends when it reconnects, so a stream can resume after it. None on a first connection; an empty value is one too, since a client with no id sends no header.

Returns String?

pub fn Context::new(@http.Request, params? : Map[String, String], scope? : @spec.HttpScope, background? : BackgroundTasks) -> Self

A context for request. The scope defaults to the one a server would build for the request alone, which is what a test or a hand-built context needs.

Returns Self

pub fn Context::oauth2_password_form(Self) -> OAuth2PasswordRequestForm?

Read an OAuth2PasswordRequestForm off the request's urlencoded (or multipart) body. None when neither username nor password is present — the body isn't a password-grant form at all — and equally when the body is too large to be one, since a grant carries six fields and nothing that big is a login.

Returns OAuth2PasswordRequestForm?

pub fn Context::param(Self, String) -> String?

Look up a path parameter by name.

test {
  let request : @moonasgi.Request = {
    http_method: "GET",
    path: "/users/42",
    query_string: b"",
    headers: [],
    body: b"",
  }
  let ctx = @ctx.Context::new(request, params=Map([("id", "42")]))
  assert_eq(ctx.param("id"), Some("42"))
  assert_eq(ctx.param("name"), None)
}

Returns String?

pub fn Context::query(Self, String, limits? : @moonurl.Limits) -> String?

Look up a query-string parameter by name, e.g. ?limit=10&q=cat%20dog. Keys and values are percent/plus-decoded, so q above reads back as cat dog. When a key repeats, the first occurrence wins; use query_all to read every one.

test {
  let request : @moonasgi.Request = {
    http_method: "GET",
    path: "/search",
    query_string: b"q=cat%20dog&q=fish",
    headers: [],
    body: b"",
  }
  let ctx = @ctx.Context::new(request)
  assert_eq(ctx.query("q"), Some("cat dog"))
  assert_eq(ctx.query_all("q"), ["cat dog", "fish"])
}

Returns String?

pub fn Context::query_all(Self, String, limits? : @moonurl.Limits) -> Array[String]

Every value given for name, in the order they appear — ?tag=a&tag=b reads back as ["a", "b"]. Empty when the key is absent.

Returns Array[String]

pub fn Context::serve(Self, Bytes, filename? : String, media_type? : String, inline? : Bool, etag? : @conditional.Tag, modified? : @moondate.Moment, ranges? : Bool) -> @http.Response

[file_response] with the request weighed first (RFC 9110 §13, §14):

* 304 — the client's copy is current. * 412 — a precondition it stated does not hold. * 206 — it asked for part, one Content-Range or a multipart/byteranges. * 416 — it asked for what is not there.

Everything turns on etag. Left out, one is hashed from the content, which costs a pass over the body; pass @conditional.stamp(length~, modified~) for one stat's worth instead, or any tag of your own.

ranges=false withdraws the offer in Accept-Ranges.

Returns @http.Response

pub fn Context::state(Self) -> Map[String, Json]

The lifespan state: a shallow copy of what the startup hooks stored, so a handler reads the shared resources and anything it adds stays with this request.

Returns Map[String, Json]

pub fn OAuth2PasswordRequestForm::equal(Self, Self) -> Bool

Returns Bool

pub fn OAuth2PasswordRequestForm::not_equal(Self, Self) -> Bool

Returns Bool

pub struct Deps { open : () -> DepsScope }

A container with its dependency value type erased (Container::erase builds one), so a non-generic App can hold one. Resolving through it runs a provider's factory and records its teardown exactly as Scope::get does; what it cannot do is hand the value back — which is precisely what a route-level dependency does not need, since dependencies=[...] discards the values it builds and keeps only their effects.

pub struct DepsScope { resolve : (String) -> Bool close : (Error?) -> Unit }

One request's resolution scope over an erased container: resolve a key (false when nothing provides it), then close, handing any failure to the teardowns.

pub struct Scope[V] { container : Container[V] cache : Map[String, V] building : Map[String, Bool] teardowns : Array[(Error?) -> Unit] }

A request-scoped resolution scope. Each dependency is built at most once and its value cached for the life of the scope ( per-request dependency cache), and each built value's teardown is recorded to run — in reverse registration order (LIFO) — when the scope closes. Open one per request, resolve dependencies through it, then close it (or use Container::run).

pub fn loc_str(ParamLoc) -> String

The OpenAPI in string for a location.

Returns String

pub fn Endpoint::equal(Self, Self) -> Bool

Returns Bool

pub fn Endpoint::new(params? : Array[Param], request_body? : @schema.Schema, request_required? : Bool, request_examples? : Map[String, Example], responses? : Array[ResponseSpec]) -> Self

Build an endpoint descriptor. Everything is optional: a bare Endpoint::new() describes an endpoint with no parameters, no body, and (on emit) a default 200 OK response.

Returns Self

pub fn Endpoint::not_equal(Self, Self) -> Bool

Returns Bool

pub fn Endpoint::validate(Self, @ctx.Context) -> Array[@schema.ValidationError]

Validate an inbound request ctx against this endpoint descriptor: every declared parameter (path / query / header / cookie) plus the JSON request body, all off the same descriptor tree that emits the OpenAPI operation. Returns the accumulated errors — an empty array means the request conforms, otherwise pass them to unprocessable for a -shaped 422.

Returns Array[@schema.ValidationError]

pub fn Example::equal(Self, Self) -> Bool

Returns Bool

pub fn Example::new(value? : Json, summary? : String, description? : String, external_value? : String) -> Self

Returns Self

pub fn Example::not_equal(Self, Self) -> Bool

Returns Bool

pub fn Example::to_json(Self) -> Json

The Example Object for example. value and externalValue exclude each other, so a value given in both forms is written as the value.

Returns Json

pub fn Param::equal(Self, Self) -> Bool

Returns Bool

pub fn Param::is_required(Self) -> Bool

Whether a request must carry this parameter. One with a default never must — its absence is answered by the default, exactly as a Python default argument is.

Returns Bool

pub fn Param::key(Self) -> String

The name this parameter travels under: its alias when it has one, else its own name. This is what is read off the request, what the document calls it, and what a validation error's loc points at — all three being the client's view of the parameter.

Returns String

pub fn Param::new(String, ParamLoc, schema? : @schema.Schema, required? : Bool, description? : String, constraints? : Array[@schema.Constraint], default? : Json, alias_? : String, examples? : Map[String, Example]) -> Self

Build a parameter descriptor. schema defaults to a string and required to true. constraints are the Pydantic-style bounds reads off a Query(ge=…, max_length=…) — emitted into the parameter's documented schema *and* enforced on the inbound value. default is emitted and makes the parameter optional, since a value that has one is never missing. alias is the name the parameter travels under when that differs from the one the code calls it . examples are offered by name in the documentation .

Returns Self

pub fn Param::not_equal(Self, Self) -> Bool

Returns Bool

pub fn ParamLoc::equal(Self, Self) -> Bool

Returns Bool

pub fn ParamLoc::not_equal(Self, Self) -> Bool

Returns Bool

pub fn ResponseSpec::equal(Self, Self) -> Bool

Returns Bool

pub fn ResponseSpec::new(Int32, description? : String, body? : @schema.Schema, examples? : Map[String, Example]) -> Self

Build a response descriptor. description defaults to "OK" and there is no body unless one is given.

Returns Self

pub fn ResponseSpec::not_equal(Self, Self) -> Bool

Returns Bool

pub type ExceptionHandler = (@ctx.Context, Error) -> @http.Response?

An exception handler: given the request context and the raised error, return Some(response) to handle it or None to defer to the next handler. The explicit MoonBit form of @app.exception_handler(ExcType) — the None case stands in for "this handler isn't registered for that type".

pub fn http_error(Int32, String, headers? : Array[(String, String)]) -> HttpException

Build an HttpException with a string detail — the common case — and optional extra headers. raise http_error(404, "Item not found") reads like raise HTTPException(404, "Item not found").

Returns HttpException

pub let redoc_js : String

pub let scalar_js : String

pub let swagger_css : String

pub let swagger_js : String

The pages load their readers from a CDN at an exact version, so a page does not change under an application that did not change. Self-hosting is a matter of passing other URLs.

pub let swagger_redirect_js : String

pub fn redoc_ui(spec_url? : String, title? : String, js_url? : String, telemetry? : Bool) -> String

A ReDoc page rendering the document served at spec_url get_redoc_html): three panels, built for reading rather than for trying calls out. ReDoc reports usage to its maker unless told not to; telemetry is off unless turned on, since the page is served to this API's readers.

Returns String

pub fn scalar_ui(spec_url? : String, title? : String, js_url? : String, extra? : Map[String, Json]) -> String

A Scalar API reference rendering the document served at spec_url: the reference and a request client on one page. extra is merged over the configuration passed to Scalar.createApiReference, which is where its theme, layout and authentication defaults go.

Returns String

pub fn swagger_redirect(js_url? : String) -> String

The page an OAuth2 authorisation started from Swagger UI returns to: it hands the code or token back to the window that opened it get_swagger_ui_oauth2_redirect_html).

Returns String

pub fn swagger_ui(spec_url? : String, title? : String, js_url? : String, css_url? : String, oauth2_redirect_url? : String, init_oauth? : Json, extra? : Map[String, Json]) -> String

A Swagger UI page rendering the document served at spec_url get_swagger_ui_html). oauth2_redirect_url is the page an OAuth2 flow returns to, served by swagger_redirect; init_oauth is handed to initOAuth to prefill the client id, scopes and the like; extra is merged over the settings passed to Swagger UI .

Returns String

pub fn ApiInfo::new() -> Self

The defaults an app starts with.

Returns Self

pub fn Contact::new(name? : String, url? : String, email? : String) -> Self

Returns Self

pub fn ExternalDocs::new(String, description? : String) -> Self

Returns Self

pub fn ExternalDocs::to_json(Self) -> Json

The externalDocs object for docs, the same in every dialect.

Returns Json

pub fn License::new(String, url? : String, identifier? : String) -> Self

Returns Self

pub fn Server::new(String, description? : String) -> Self

Returns Self

pub fn Tag::new(String, description? : String, external_docs? : ExternalDocs) -> Self

Returns Self

pub fn Tag::to_json(Self) -> Json

The tag object, the same in every dialect.

Returns Json

pub fn Ui::equal(Self, Self) -> Bool

Returns Bool

pub fn Ui::not_equal(Self, Self) -> Bool

Returns Bool

pub fn Ui::to_repr(Self) -> @debug.Repr

Returns @debug.Repr

pub type ApiHandler = async (@ctx.Context) -> @http.Response

A route handler : the request context in, a response out. It runs async, so it can await a database or another service; a plain closure is one too, and a named function that is not async is registered as ctx => f(ctx). It may raise an HttpException (or any error) instead of returning — the app maps it to a response through the registered exception handlers.

pub type Hoop = async (@ctx.Context, async (@ctx.Context) -> Reply) -> Reply

A middleware on a route or on a router node : the request context and the rest of the route in, the reply out. It runs inside the app's own middleware and outside the route's security, validation and dependencies, so it can answer for the route — refuse, redirect, serve from a cache — or change what the route produced, and it can hand next a context of its own.

pub using @method {type Method}

The request method a route binds to: the nine standard ones and any other token, from moonhttp.

pub struct Router { routes : Array[Route] ws_routes : Array[WsRoute] hoops : Array[async (@ctx.Context, async (@ctx.Context) -> Reply) -> Reply] }

A collection of routes built away from any application and folded into one with App::include_router . It carries the registration surface of an App and nothing else: middleware, mounts, security schemes, documentation and lifespan belong to the application that includes it.

pub type StreamHandler = async (@ctx.Context) -> @status.Stream

A streaming route's handler : the response it returns writes its body while it is sent.

pub type Url = (Router) -> Unit

One entry of a route table: what it registers, given the router it lands on. path, view, websocket and group make them.

pub(open) trait View { fn get(Self) -> (async (@ctx.Context) -> @http.Response)? = _ fn head(Self) -> (async (@ctx.Context) -> @http.Response)? = _ fn post(Self) -> (async (@ctx.Context) -> @http.Response)? = _ fn put(Self) -> (async (@ctx.Context) -> @http.Response)? = _ fn patch(Self) -> (async (@ctx.Context) -> @http.Response)? = _ fn delete(Self) -> (async (@ctx.Context) -> @http.Response)? = _ fn options(Self) -> (async (@ctx.Context) -> @http.Response)? = _ fn trace(Self) -> (async (@ctx.Context) -> @http.Response)? = _ }

A type answering the methods of one path . Implement the methods it answers, each giving back its handler; the rest answer None, and a request for one of those gets a 405 whose Allow lists what the view does answer.

struct Articles { db : Db }

impl @moonapi.View for Articles with get(self) {
  Some(ctx => self.db.list(ctx))
}

impl @moonapi.View for Articles with post(self) {
  Some(ctx => self.db.create(ctx))
}

app.view("/articles", Articles::{ db })

pub fn group(String, Array[(Router) -> Unit], tags? : Array[String], security? : Array[@security.SecurityRequirement], dependencies? : Array[String], hoops? : Array[async (@ctx.Context, async (@ctx.Context) -> Reply) -> Reply]) -> (Router) -> Unit

urls under prefix reserved word). The arguments reach every route of the group as Router::include_router describes, and a group may hold groups.

Returns (Router) -> Unit

pub fn join_prefix(String, String) -> String

A route path under prefix, written as writes it: the prefix with its trailing slashes dropped, then the path as given, so ("/sub", "/items/") is /sub/items/ and ("/sub", "/") is /sub/. A path keeps its own trailing slash because a trailing slash is part of what a route matches.

Returns String

pub fn path(String, async (@ctx.Context) -> @http.Response, methods? : Array[@method.Method], name? : String) -> (Router) -> Unit

handler at path for each of methods default is the same GET, which answers HEAD too).

Returns (Router) -> Unit

pub fn segments(String) -> Array[String]

Split a path into its non-empty segments.

Returns Array[String]

pub fn view(String, &View, name? : String) -> (Router) -> Unit

The methods view answers at path.

Returns (Router) -> Unit

pub fn websocket(String, async (@socket.WebSocket) -> Unit, name? : String) -> (Router) -> Unit

A WebSocket route at path .

Returns (Router) -> Unit

pub fn Convertor::equal(Self, Self) -> Bool

Returns Bool

pub fn Convertor::not_equal(Self, Self) -> Bool

Returns Bool

pub fn Convertor::of(StringView) -> Self?

The convertor named name, as a template spells it after the colon.

Returns Self?

pub fn Convertor::to_repr(Self) -> @debug.Repr

Returns @debug.Repr

pub fn Pattern::bind(Self, StringView) -> Map[String, String]?

The parameters path binds, or None when it does not match. The whole path must match: a trailing slash is a different path.

Returns Map[String, String]?

pub fn Pattern::equal(Self, Self) -> Bool

Returns Bool

pub fn Pattern::fill(Self, Map[String, String]) -> String?

The path with params substituted ; None when one is missing or does not fit its convertor.

Returns String?

pub fn Pattern::not_equal(Self, Self) -> Bool

Returns Bool

pub fn Pattern::params(Self) -> Array[(String, Convertor)]

The parameters in the order the path names them.

Returns Array[(String, Convertor)]

pub fn Pattern::parse(String) -> Self

Read path as a template. An unclosed brace, an empty name, an unknown convertor or two parameters with nothing between them is a mistake in the program, not in a request, so it aborts at registration — the way refuses such a route when the application starts.

Returns Self

pub fn Pattern::template(Self) -> String

The path as an OpenAPI template expression: every parameter as {name}, the convertor left to the parameter's schema.

Returns String

pub fn Pattern::to_repr(Self) -> @debug.Repr

Returns @debug.Repr

pub fn Piece::equal(Self, Self) -> Bool

Returns Bool

pub fn Piece::not_equal(Self, Self) -> Bool

Returns Bool

pub fn Piece::to_repr(Self) -> @debug.Repr

Returns @debug.Repr

pub fn Router::delete(Self, String, async (@ctx.Context) -> @http.Response, summary? : String, description? : String, tags? : Array[String], deprecated? : Bool, operation_id? : String, status_code? : Int32, responses? : Array[@endpoint.ResponseSpec], name? : String, endpoint? : @endpoint.Endpoint, security? : Array[@security.SecurityRequirement], dependencies? : Array[String], include_in_schema? : Bool, validate? : Bool, openapi_extra? : Json, callbacks? : Array[Route], hoops? : Array[async (@ctx.Context, async (@ctx.Context) -> Reply) -> Reply]) -> Unit

Register a DELETE route. A shorthand for route(Delete, ...).

Returns Unit

pub fn Router::get(Self, String, async (@ctx.Context) -> @http.Response, summary? : String, description? : String, tags? : Array[String], deprecated? : Bool, operation_id? : String, status_code? : Int32, responses? : Array[@endpoint.ResponseSpec], name? : String, endpoint? : @endpoint.Endpoint, security? : Array[@security.SecurityRequirement], dependencies? : Array[String], include_in_schema? : Bool, validate? : Bool, openapi_extra? : Json, callbacks? : Array[Route], hoops? : Array[async (@ctx.Context, async (@ctx.Context) -> Reply) -> Reply]) -> Unit

Register a GET route. A shorthand for route(Get, ...).

Returns Unit

pub fn Router::head(Self, String, async (@ctx.Context) -> @http.Response, summary? : String, description? : String, tags? : Array[String], deprecated? : Bool, operation_id? : String, status_code? : Int32, responses? : Array[@endpoint.ResponseSpec], name? : String, endpoint? : @endpoint.Endpoint, security? : Array[@security.SecurityRequirement], dependencies? : Array[String], include_in_schema? : Bool, validate? : Bool, openapi_extra? : Json, callbacks? : Array[Route], hoops? : Array[async (@ctx.Context, async (@ctx.Context) -> Reply) -> Reply]) -> Unit

Register a HEAD route. A shorthand for route(Head, ...).

Returns Unit

pub fn Router::hoop(Self, async (@ctx.Context, async (@ctx.Context) -> Reply) -> Reply) -> Unit

Put hoop around every route of this router . The router's hoops reach its routes when it is included, outside each route's own, in the order they were added.

Returns Unit

pub fn Router::include_router(Self, Self, prefix? : String, tags? : Array[String], security? : Array[@security.SecurityRequirement], dependencies? : Array[String], responses? : Array[@endpoint.ResponseSpec], deprecated? : Bool, include_in_schema? : Bool, hoops? : Array[async (@ctx.Context, async (@ctx.Context) -> Reply) -> Reply]) -> Unit

Fold router's routes into this one under prefix APIRouter.include_router), so routers nest into a tree and the tree is included into an app once. The arguments reach every route folded in:

- tags, security, dependencies and hoops are placed before the route's own, so a group's tag leads and a group-wide requirement, dependency or hoop cannot be dropped by a route that adds one of its own; router's own hoops come between the two; - responses are documented under the route's, which therefore wins any status both name; - deprecated marks the whole group, and include_in_schema=false hides it, neither of which a route can undo.

WebSocket routes take the prefix, the security and the dependencies.

Returns Unit

pub fn Router::new() -> Self

An empty router. The prefix and the attributes its routes share are given at include_router rather than here, so one router can be included twice — under a second prefix, or on another app with different tags.

Returns Self

pub fn Router::options(Self, String, async (@ctx.Context) -> @http.Response, summary? : String, description? : String, tags? : Array[String], deprecated? : Bool, operation_id? : String, status_code? : Int32, responses? : Array[@endpoint.ResponseSpec], name? : String, endpoint? : @endpoint.Endpoint, security? : Array[@security.SecurityRequirement], dependencies? : Array[String], include_in_schema? : Bool, validate? : Bool, openapi_extra? : Json, callbacks? : Array[Route], hoops? : Array[async (@ctx.Context, async (@ctx.Context) -> Reply) -> Reply]) -> Unit

Register a OPTIONS route. A shorthand for route(Options, ...).

Returns Unit

pub fn Router::patch(Self, String, async (@ctx.Context) -> @http.Response, summary? : String, description? : String, tags? : Array[String], deprecated? : Bool, operation_id? : String, status_code? : Int32, responses? : Array[@endpoint.ResponseSpec], name? : String, endpoint? : @endpoint.Endpoint, security? : Array[@security.SecurityRequirement], dependencies? : Array[String], include_in_schema? : Bool, validate? : Bool, openapi_extra? : Json, callbacks? : Array[Route], hoops? : Array[async (@ctx.Context, async (@ctx.Context) -> Reply) -> Reply]) -> Unit

Register a PATCH route. A shorthand for route(Patch, ...).

Returns Unit

pub fn Router::post(Self, String, async (@ctx.Context) -> @http.Response, summary? : String, description? : String, tags? : Array[String], deprecated? : Bool, operation_id? : String, status_code? : Int32, responses? : Array[@endpoint.ResponseSpec], name? : String, endpoint? : @endpoint.Endpoint, security? : Array[@security.SecurityRequirement], dependencies? : Array[String], include_in_schema? : Bool, validate? : Bool, openapi_extra? : Json, callbacks? : Array[Route], hoops? : Array[async (@ctx.Context, async (@ctx.Context) -> Reply) -> Reply]) -> Unit

Register a POST route. A shorthand for route(Post, ...).

Returns Unit

pub fn Router::put(Self, String, async (@ctx.Context) -> @http.Response, summary? : String, description? : String, tags? : Array[String], deprecated? : Bool, operation_id? : String, status_code? : Int32, responses? : Array[@endpoint.ResponseSpec], name? : String, endpoint? : @endpoint.Endpoint, security? : Array[@security.SecurityRequirement], dependencies? : Array[String], include_in_schema? : Bool, validate? : Bool, openapi_extra? : Json, callbacks? : Array[Route], hoops? : Array[async (@ctx.Context, async (@ctx.Context) -> Reply) -> Reply]) -> Unit

Register a PUT route. A shorthand for route(Put, ...).

Returns Unit

pub fn Router::route(Self, @method.Method, String, async (@ctx.Context) -> @http.Response, summary? : String, description? : String, tags? : Array[String], deprecated? : Bool, operation_id? : String, status_code? : Int32, responses? : Array[@endpoint.ResponseSpec], name? : String, endpoint? : @endpoint.Endpoint, security? : Array[@security.SecurityRequirement], dependencies? : Array[String], include_in_schema? : Bool, validate? : Bool, openapi_extra? : Json, callbacks? : Array[Route], hoops? : Array[async (@ctx.Context, async (@ctx.Context) -> Reply) -> Reply]) -> Unit

Register a route on the router for an explicit method. An optional endpoint descriptor makes the route fully typed (its parameters, request body, and responses surface in the OpenAPI document and drive validation); security attaches per-operation requirements (emitted as OpenAPI security and enforced before the handler when their scheme has an enforcer); dependencies names provider keys resolved through the app's container (App::depends) before the handler and torn down after it, whatever the handler did.

The rest describe the operation: summary and description are its prose, operation_id the stable handle client generators name their method after, status_code the status its success response is documented under, responses further documented responses, name the handle App::url_for resolves, openapi_extra a fragment merged over the generated operation object, and callbacks the requests this operation makes back to its caller, written as routes whose paths are runtime expressions — the same keyword arguments path operations take. hoops wrap this one route, inside any its routers put around it.

Returns Unit

pub fn Router::route_stream(Self, @method.Method, String, async (@ctx.Context) -> @status.Stream, summary? : String, description? : String, tags? : Array[String], deprecated? : Bool, operation_id? : String, status_code? : Int32, responses? : Array[@endpoint.ResponseSpec], name? : String, endpoint? : @endpoint.Endpoint, security? : Array[@security.SecurityRequirement], dependencies? : Array[String], include_in_schema? : Bool, validate? : Bool, openapi_extra? : Json, callbacks? : Array[Route], hoops? : Array[async (@ctx.Context, async (@ctx.Context) -> Reply) -> Reply]) -> Unit

Register a streaming route StreamingResponse). The handler's chunks reach the client as separate body events, so a long or open-ended reply starts arriving before it is finished.

A stream is only streamed as far as the app can honestly keep it one: a middleware that rewrites the body — gzip does — collapses the reply to a single chunk. Everything else about the route is ordinary; it documents, validates and enforces security exactly as route does.

Returns Unit

pub fn Router::stream(Self, String, async (@ctx.Context) -> @status.Stream, summary? : String, description? : String, tags? : Array[String], deprecated? : Bool, operation_id? : String, status_code? : Int32, responses? : Array[@endpoint.ResponseSpec], name? : String, endpoint? : @endpoint.Endpoint, security? : Array[@security.SecurityRequirement], dependencies? : Array[String], include_in_schema? : Bool, validate? : Bool, openapi_extra? : Json, callbacks? : Array[Route], hoops? : Array[async (@ctx.Context, async (@ctx.Context) -> Reply) -> Reply]) -> Unit

Register a streaming GET route — the verb a stream is nearly always read over, and what an SSE endpoint is. A shorthand for route_stream(Get, ...).

Returns Unit

pub fn Router::trace(Self, String, async (@ctx.Context) -> @http.Response, summary? : String, description? : String, tags? : Array[String], deprecated? : Bool, operation_id? : String, status_code? : Int32, responses? : Array[@endpoint.ResponseSpec], name? : String, endpoint? : @endpoint.Endpoint, security? : Array[@security.SecurityRequirement], dependencies? : Array[String], include_in_schema? : Bool, validate? : Bool, openapi_extra? : Json, callbacks? : Array[Route], hoops? : Array[async (@ctx.Context, async (@ctx.Context) -> Reply) -> Reply]) -> Unit

Register a TRACE route. A shorthand for route(Trace, ...).

Returns Unit

pub fn Router::urls(Self, Array[(Self) -> Unit]) -> Unit

Register every entry of urls, in order — the order a request tries them in.

Returns Unit

pub fn Router::view(Self, String, &View, name? : String, tags? : Array[String], security? : Array[@security.SecurityRequirement], dependencies? : Array[String], deprecated? : Bool, include_in_schema? : Bool, hoops? : Array[async (@ctx.Context, async (@ctx.Context) -> Reply) -> Reply]) -> Unit

Register the methods view answers at path, each as its own route sharing the arguments given here. A view that answers no method is a mistake in the program and aborts.

Returns Unit

pub fn Router::websocket(Self, String, async (@socket.WebSocket) -> Unit, name? : String, security? : Array[@security.SecurityRequirement], dependencies? : Array[String]) -> Unit

Register a WebSocket route on the router . It takes the including prefix like any other route. security and dependencies are checked before the handler runs, as on an HTTP route, and a refusal declines the handshake; name is the handle App::url_for resolves. The OpenAPI attributes do not apply, since a WebSocket route is not an operation.

Returns Unit

pub(open) trait ToSchema { fn to_schema(Self) -> Schema }

The impl-able version of a type's descriptor. A user struct implements it — the value is ignored; it exists so descriptor-carrying code can be generic over "a type that knows its own schema". The primary, mctl-friendly shape is still a plain associated function T::schema() -> Schema (no instance needed, mirroring referencing the model *class*); this trait bridges to it.

pub let query_limits : @moonurl.Limits

How much of a query string is a query string.

A thousand parameters is what qs allows by default, and far past anything a link carries; sixty-four kilobytes for one value is well past the eight the common servers allow a whole request line. Beyond either, the request is an attempt to make the server allocate.

An endpoint that genuinely takes more says so: ctx.query("tag", limits=@moonurl.Limits::new(pairs=100000)).

pub fn check_constraints(Json, Array[Constraint], Array[String], Array[ValidationError]) -> Unit

Enforce the constraints on an inbound value, appending a Pydantic-shaped ValidationError (located at loc) for each violation. A constraint that does not apply to the value's kind (a length bound on a number, say) is simply skipped, as pydantic does.

Returns Unit

pub fn emit_schema(Schema, Map[String, Json], OpenApiVersion) -> Json

Emit schema as inline OpenAPI JSON, hoisting every *named* object into defs (keyed by name) and referencing it by $ref. Recursion-safe: a name is reserved in defs before its body is built, so a self-referential schema terminates instead of looping.

Returns Json

pub fn enum_expected(Array[Json]) -> String

The Pydantic-style "expected one of" fragment for an enum error: string members quoted, comma-separated, with a final or before the last.

Returns String

pub fn enum_member(Array[Json], Json) -> Bool

Whether v is one of the allowed enum values.

Returns Bool

pub fn filter_response(Schema, Json) -> Result[Json, Array[ValidationError]]

Validate value against model and, if it conforms, return it filtered down to the model's declared fields (extras dropped, nested objects and arrays projected too). On a mismatch return the located ValidationErrors under ["response"] — the same shape request validation produces. This is response_model: the outgoing shape is the model, not whatever the handler happened to build.

Returns Result[Json, Array[ValidationError]]

pub fn json_model(Int32, Schema, Json) -> @http.Response

A JSON response whose body is value filtered through model. On success a status response carrying only the model's declared fields; on a model mismatch a 500 whose body lists the response-validation errors — the return value didn't match what the route promised, which is a server-side fault.

Returns @http.Response

pub fn parse_int(String) -> Int32?

Parse a base-10 integer, None if s is not a well-formed integer literal (optional leading +/-, then one or more ASCII digits, nothing else).

Not core's @strconv.parse_int: that one also takes 0x prefixes and underscores, which a query or path parameter must not quietly accept.

Returns Int32?

pub fn unprocessable(Array[ValidationError]) -> @http.Response

A 422 Unprocessable Entity response whose application/json body lists the validation errors, exactly as reports a failed request.

Returns @http.Response

pub fn validate_schema(Schema, Json, Array[String], Array[ValidationError]) -> Unit

Validate a JSON value against the descriptor schema, appending -shaped errors to errs (located at loc). This is what "the descriptor drives validation" means: the very tree that emits the OpenAPI body schema also decides whether an inbound body conforms — one source of truth, exactly as pydantic derives both from one model. A named object is validated against its inline fields, so no $ref resolution is needed here.

Returns Unit

pub fn validation_error_body(Array[ValidationError]) -> Json

The {"detail": [ ... ]} body returns when request validation fails, built from a list of ValidationErrors.

Returns Json

pub fn with_constraints(Json, Array[Constraint], OpenApiVersion) -> Json

Merge the constraints into a scalar/array schema object for OpenAPI emission. exclusiveMinimum / exclusiveMaximum are numeric under OpenAPI 3.1 (JSON-Schema 2020-12) but a boolean flag alongside minimum / maximum under Swagger 2.0 and OpenAPI 3.0, so the form is version-aware.

Returns Json

pub fn with_description(Json, String) -> Json

Return j with a description sibling added (legal beside $ref in OpenAPI 3.1 / JSON-Schema 2020-12).

Returns Json

pub fn with_key(Json, String, Json) -> Json

Return j with key set to value. Builds a fresh object so nothing shared mutates; a non-object is returned untouched, since there is nothing to set on it.

Returns Json

pub fn Constraint::equal(Self, Self) -> Bool

Returns Bool

pub fn Constraint::not_equal(Self, Self) -> Bool

Returns Bool

pub fn Constraint::to_repr(Self) -> @debug.Repr

Returns @debug.Repr

pub fn Field::equal(Self, Self) -> Bool

Returns Bool

pub fn Field::is_required(Self) -> Bool

Whether a body must carry this field. A field with a default never must — its absence is answered by the default, exactly as a Python default argument is, so it is left out of the emitted required list and not reported missing.

Returns Bool

pub fn Field::new(String, Schema, required? : Bool, description? : String, constraints? : Array[Constraint], default? : Json, examples? : Array[Json]) -> Self

Build a field. required defaults to true ( treats a field without a default as required). constraints are the Pydantic-style value constraints (ge/le/min_length/pattern/…) that are both emitted into the field's OpenAPI schema and enforced when validating an inbound value. default is emitted into the schema and makes the field optional, since a value that has one is never missing.

Returns Self

pub fn Field::not_equal(Self, Self) -> Bool

Returns Bool

pub fn Field::to_repr(Self) -> @debug.Repr

Returns @debug.Repr

pub fn ObjectSchema::equal(Self, Self) -> Bool

Returns Bool

pub fn ObjectSchema::not_equal(Self, Self) -> Bool

Returns Bool

pub fn ObjectSchema::to_repr(Self) -> @debug.Repr

Returns @debug.Repr

pub fn OpenApiVersion::equal(Self, Self) -> Bool

Returns Bool

pub fn OpenApiVersion::not_equal(Self, Self) -> Bool

Returns Bool

pub fn Schema::array(Self) -> Self

An array schema whose elements all conform to item.

Returns Self

pub fn Schema::binary() -> Self

The schema of file content: a string with OpenAPI's binary format — what an upload is described as, and what a multipart file field carries.

Returns Self

pub fn Schema::equal(Self, Self) -> Bool

Returns Bool

pub fn Schema::format(Self, String) -> Self

base refined by an OpenAPI format. The format is documentation: it tells a reader and a client generator what the string holds, and validation still checks only base, which is what pydantic does for a format it has no validator for.

Returns Self

pub fn Schema::json(Json) -> Self

A schema written as JSON Schema itself (2020-12, which is what OpenAPI 3.1 is). Use it for what the other constructors cannot say; it goes into the document unchanged.

Returns Self

pub fn Schema::map(Self) -> Self

An object with no declared fields whose values all conform to value . Schema::map(SAny) is the free-form object.

Returns Self

pub fn Schema::not_equal(Self, Self) -> Bool

Returns Bool

pub fn Schema::nullable(Self) -> Self

A schema that also admits null . Wrapping rather than a flag because the three dialects express it three different ways.

Returns Self

pub fn Schema::object(String, Array[Field]) -> Self

A named object schema: hoisted to components/schemas under name and referenced by $ref wherever it is used.

Returns Self

pub fn Schema::of_model(@moonmodel.Model, known? : Array[@moonmodel.Model]) -> (Self, Array[Unresolved])

A moonmodel description as a schema.

One description, written once, drives request validation and the OpenAPI document here, and the DDL and the SDL in their own libraries. known is where a Ref is looked up: a reference to a model that is not in it, or one that leads back to a model already being written, is reported instead — a schema is a finite value, so a cycle cannot be written out, and the name alone does not say what the thing looks like.

Returns (Self, Array[Unresolved])

pub fn Schema::to_repr(Self) -> @debug.Repr

Returns @debug.Repr

pub fn Unresolved::equal(Self, Self) -> Bool

Returns Bool

pub fn Unresolved::not_equal(Self, Self) -> Bool

Returns Bool

pub fn ValidationError::missing(Array[String]) -> Self

The canonical "a required parameter was not supplied" error located at loc, matching {"type": "missing", "msg": "Field required"}.

Returns Self

pub fn ValidationError::to_json(Self) -> Json

Render one validation error as its JSON object.

Returns Json

pub fn ValidationError::type_error(Array[String], String, String) -> Self

A type/parse error located at loc, e.g. kind = "int_parsing" with the matching pydantic message — the shape reports for a value of the wrong type.

Returns Self

pub struct ApiKey { loc : ApiKeyIn name : String verify : (String) -> Bool }

An API-key scheme: the parameter name the key arrives under, where it arrives, and the predicate that accepts a presented key. APIKeyHeader only extracts and leaves the check to a dependency; a route guard needs both, so the check travels with the scheme.

pub struct BasicAuth { realm : String verify : (@ctx.HttpBasicCredentials) -> Bool }

An HTTP Basic scheme : the realm named in the challenge, and the predicate that accepts a presented username/password.

pub struct DigestAuth { realm : String verify : (String) -> Bool }

An HTTP Digest scheme credential and no more): verify decides whether the Digest parameter string a client sent is acceptable. Computing the RFC 7616 response digest is the application's, since only it holds the password store.