Bedrud uses the Fiber web framework. Production routes are registered in server/internal/server/server.go (used by bedrud run). Interactive OpenAPI: API Reference.
Route Groups
| Prefix | Auth | Purpose |
|---|---|---|
/api/auth/* | Mixed | Register, login, OAuth, passkeys, profile, preferences, verify, password reset |
/api/room/* | Mostly protected | Create/join/list/moderate rooms, chat upload |
/api/admin/* | Superadmin | Users, rooms, settings, invite tokens, webhooks, queue, overview |
/api/livekit/webhook | LiveKit JWT | Inbound media disconnect events |
/api/cert | Public | Cert metadata for clients (when applicable) |
/livekit/* | Proxied | Embedded LiveKit signaling (unless livekit.external) |
/uploads/chat/* | Protected | Chat image files |
/uploads/avatars/* | Public | Avatar files |
/* | SPA | Embedded frontend |
Admin group middleware: Protected → RequireEmailVerified → RequireAccess(superadmin).
Auth Highlights
- Local register/login/refresh, OAuth (
/auth/:provider/login|callback) - Passkey register/login/signup begin/finish
- Profile + avatar:
GET/PUT /auth/me, avatar upload/delete - Preferences:
GET/PUT /auth/preferences - Email verify + resend; forgot/reset password
- Public settings:
GET /auth/settings
Room Highlights
POST /room/create,/room/join,/room/guest-join,/room/refresh-tokenGET /room/list,/room/archived- Moderation: kick, mute, ban, video off, promote/demote, chat block, deafen, ask, spotlight, screenshare stop, stage bring/remove
PUT /room/:roomId/settings,DELETE /room/:roomId(async job → 202)POST /room/:roomId/chat/upload- Presence:
GET /room/:roomId/presence
Admin Highlights
- Users: list, detail, status, accesses, force-logout, set password, verify, sessions, delete (async), bulk ban/promote/delete
- Rooms: list, events, token, close, suspend, reactivate, update, participants, bulk suspend/close
- Settings: get/put, send-test-email, validate connectivity
- Invite tokens CRUD; webhooks CRUD + rotate-secret + test
- Overview, online-count, LiveKit stats, cert-info, queue stats
Recording admin/user routes are not registered in production (planned feature).
Async Operations (Job Queue)
Destructive work and some side effects return 202 Accepted and enqueue jobs:
| Endpoint | Job type (approx.) |
|---|---|
DELETE /api/room/:roomId | room_delete |
DELETE /api/admin/rooms/:roomId | room_delete |
POST /api/admin/rooms/:roomId/suspend | room_suspend |
POST /api/admin/rooms/bulk/suspend | bulk suspend |
POST /api/admin/rooms/bulk/close | bulk close |
DELETE /api/admin/users/:id | user_delete |
POST /api/admin/users/bulk/delete | bulk user_delete |
Other job types: dispatch_webhook, email sends, chat upload processing. Worker polls ~500ms (configurable); retries with exponential backoff 2^attempts * 5s (cap 1h).
Room Creation & Join (summary)
Create (POST /api/room/create): normalize/generate name → LiveKit room → DB metadata → optional room.created webhook.
Join (POST /api/room/join): authorize → LiveKit JWT (identity, name, grants) → client connects via WebRTC.
Request Lifecycle
- Fiber receives request
- Middleware: recover, CORS, rate limit, optional JWT + email-verified
- Handler parses body, calls repo/service, returns JSON
Static Frontend
Built React assets are embedded and served from the binary. Non-/api routes fall through to the SPA shell.