Atharva Pandey/Lesson 6: API Gateway Patterns — One entry point, many backends

// Mobile client making 4 calls to render one screen — WRONG architectural approach
// This is what the mobile developer has to do without a gateway:

// Call 1: Get user profile
GET https://user-service.internal:8081/users/123

// Call 2: Get recent orders
GET https://order-service.internal:8082/users/123/orders?limit=5

// Call 3: Get account balance
GET https://payment-service.internal:8083/accounts/123/balance

// Call 4: Get notifications
GET https://notification-service.internal:8084/users/123/notifications?unread=true

// The mobile client now knows about 4 internal services, 4 ports,
// 4 authentication tokens, and must handle 4 independent failure modes.

// gateway/main.go
package main

import (
    "net/http"
    "net/http/httputil"
    "net/url"
)

type Gateway struct {
    routes []Route
    mw     []Middleware
}

type Route struct {
    Prefix  string
    Backend *url.URL
    Rewrite func(r *http.Request) // optional path rewriting
}

func (g *Gateway) ServeHTTP(w http.ResponseWriter, r *http.Request) {
    for _, route := range g.routes {
        if strings.HasPrefix(r.URL.Path, route.Prefix) {
            if route.Rewrite != nil {
                route.Rewrite(r)
            }
            proxy := httputil.NewSingleHostReverseProxy(route.Backend)
            proxy.ServeHTTP(w, r)
            return
        }
    }
    http.NotFound(w, r)
}

func main() {
    gw := &Gateway{
        routes: []Route{
            {
                Prefix:  "/api/users",
                Backend: mustParseURL("http://user-service:8080"),
            },
            {
                Prefix:  "/api/orders",
                Backend: mustParseURL("http://order-service:8080"),
            },
            {
                Prefix:  "/api/payments",
                Backend: mustParseURL("http://payment-service:8080"),
            },
        },
    }

    // Apply middleware: auth → rate limit → logging → proxy
    handler := authMiddleware(rateLimitMiddleware(loggingMiddleware(gw)))
    http.ListenAndServe(":8080", handler)
}

// gateway/middleware/auth.go
func authMiddleware(next http.Handler) http.Handler {
    return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
        token := r.Header.Get("Authorization")
        if token == "" {
            http.Error(w, "unauthorized", http.StatusUnauthorized)
            return
        }

        claims, err := verifyJWT(token)
        if err != nil {
            http.Error(w, "invalid token", http.StatusUnauthorized)
            return
        }

        // Downstream services receive identity as a trusted header
        // They don't need to verify the JWT — the gateway already did
        r.Header.Set("X-User-ID", strconv.FormatInt(claims.UserID, 10))
        r.Header.Set("X-User-Role", claims.Role)
        r.Header.Del("Authorization") // Don't forward the raw token

        next.ServeHTTP(w, r)
    })
}

// gateway/handlers/dashboard.go
// A single endpoint that aggregates data from multiple services
func (h *DashboardHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
    userID := r.Header.Get("X-User-ID")
    ctx := r.Context()

    // Fan out to all three services concurrently
    type result[T any] struct {
        val T
        err error
    }

    profileCh := make(chan result[*UserProfile], 1)
    ordersCh := make(chan result[[]Order], 1)
    balanceCh := make(chan result[*Balance], 1)

    go func() {
        p, err := h.users.GetProfile(ctx, userID)
        profileCh <- result[*UserProfile]{p, err}
    }()
    go func() {
        o, err := h.orders.GetRecent(ctx, userID, 5)
        ordersCh <- result[[]Order]{o, err}
    }()
    go func() {
        b, err := h.payments.GetBalance(ctx, userID)
        balanceCh <- result[*Balance]{b, err}
    }()

    profile := <-profileCh
    orders := <-ordersCh
    balance := <-balanceCh

    if profile.err != nil {
        http.Error(w, "failed to load profile", http.StatusInternalServerError)
        return
    }

    // Non-critical data — return partial response if these fail
    resp := DashboardResponse{
        Profile: profile.val,
        Orders:  orders.val,  // nil if orders.err != nil
        Balance: balance.val, // nil if balance.err != nil
    }

    json.NewEncoder(w).Encode(resp)
}