initial commit

internal/config/config.go

@@ -0,0 +1,102 @@
+package config
+
+import (
+	"errors"
+	"net/url"
+	"os"
+	"strconv"
+	"strings"
+	"time"
+)
+
+type Config struct {
+	Addr                    string
+	BaseURL                 string
+	AuthDomain              string
+	DatabaseURL             string
+	SessionSecret           string
+	DevLogin                bool
+	DevUser                 string
+	LocalLogin              bool
+	LocalAdminEmail         string
+	LocalAdminPassword      string
+	OIDCIssuer              string
+	OIDCClientID            string
+	OIDCClientSecret        string
+	OIDCRedirectURL         string
+	AllowedEmailDomains     []string
+	AllowPrivateContractURL bool
+	BootstrapTenant         string
+	BootstrapApp            string
+	HTTPTimeout             time.Duration
+}
+
+func Load() (Config, error) {
+	cfg := Config{
+		Addr:                    env("GO_LOOSE_ADDR", ":8080"),
+		BaseURL:                 strings.TrimRight(env("GO_LOOSE_BASE_URL", "http://localhost:8080"), "/"),
+		AuthDomain:              strings.TrimPrefix(strings.ToLower(env("GO_LOOSE_AUTH_DOMAIN", "auth.local")), "."),
+		DatabaseURL:             env("GO_LOOSE_DATABASE_URL", "postgres://goloose:goloose@localhost:5432/goloose?sslmode=disable"),
+		SessionSecret:           os.Getenv("GO_LOOSE_SESSION_SECRET"),
+		DevLogin:                envBool("GO_LOOSE_DEV_LOGIN", false),
+		DevUser:                 env("GO_LOOSE_DEV_USER", "admin@local.test"),
+		LocalLogin:              envBool("GO_LOOSE_LOCAL_LOGIN", false),
+		LocalAdminEmail:         strings.ToLower(env("GO_LOOSE_LOCAL_ADMIN_EMAIL", "admin@goloose.local")),
+		LocalAdminPassword:      os.Getenv("GO_LOOSE_LOCAL_ADMIN_PASSWORD"),
+		OIDCIssuer:              strings.TrimRight(os.Getenv("GO_LOOSE_OIDC_ISSUER"), "/"),
+		OIDCClientID:            os.Getenv("GO_LOOSE_OIDC_CLIENT_ID"),
+		OIDCClientSecret:        os.Getenv("GO_LOOSE_OIDC_CLIENT_SECRET"),
+		OIDCRedirectURL:         env("GO_LOOSE_OIDC_REDIRECT_URL", "http://localhost:8080/auth/callback"),
+		AllowedEmailDomains:     csv(os.Getenv("GO_LOOSE_ALLOWED_EMAIL_DOMAINS")),
+		AllowPrivateContractURL: envBool("GO_LOOSE_ALLOW_PRIVATE_CONTRACT_URLS", false),
+		BootstrapTenant:         env("GO_LOOSE_BOOTSTRAP_TENANT", "default"),
+		BootstrapApp:            env("GO_LOOSE_BOOTSTRAP_APP", "default"),
+		HTTPTimeout:             10 * time.Second,
+	}
+	if len(cfg.SessionSecret) < 32 {
+		return Config{}, errors.New("GO_LOOSE_SESSION_SECRET must contain at least 32 characters")
+	}
+	if cfg.AuthDomain == "" || strings.ContainsAny(cfg.AuthDomain, "/:") {
+		return Config{}, errors.New("GO_LOOSE_AUTH_DOMAIN must be a hostname such as auth.local")
+	}
+	oidcConfigured := cfg.OIDCIssuer != "" && cfg.OIDCClientID != "" && cfg.OIDCClientSecret != ""
+	if cfg.LocalAdminPassword != "" && len(cfg.LocalAdminPassword) < 12 {
+		return Config{}, errors.New("GO_LOOSE_LOCAL_ADMIN_PASSWORD must contain at least 12 characters")
+	}
+	if oidcConfigured {
+		baseURL, err := url.Parse(cfg.BaseURL)
+		if err != nil || (baseURL.Hostname() != cfg.AuthDomain && !strings.HasSuffix(baseURL.Hostname(), "."+cfg.AuthDomain)) {
+			return Config{}, errors.New("GO_LOOSE_BASE_URL must be inside GO_LOOSE_AUTH_DOMAIN for shared OIDC login")
+		}
+	}
+	return cfg, nil
+}
+
+func env(name, fallback string) string {
+	if value := os.Getenv(name); value != "" {
+		return value
+	}
+	return fallback
+}
+
+func envBool(name string, fallback bool) bool {
+	value := os.Getenv(name)
+	if value == "" {
+		return fallback
+	}
+	parsed, err := strconv.ParseBool(value)
+	if err != nil {
+		return fallback
+	}
+	return parsed
+}
+
+func csv(value string) []string {
+	var result []string
+	for _, item := range strings.Split(value, ",") {
+		if item = strings.TrimSpace(strings.ToLower(item)); item != "" {
+			result = append(result, item)
+		}
+	}
+	return result
+}

internal/config/config_test.go

@@ -0,0 +1,45 @@
+package config
+
+import "testing"
+
+func TestLoadRequiresSessionSecret(t *testing.T) {
+	t.Setenv("GO_LOOSE_SESSION_SECRET", "short")
+	t.Setenv("GO_LOOSE_DEV_LOGIN", "true")
+	if _, err := Load(); err == nil {
+		t.Fatal("expected an error for a short session secret")
+	}
+}
+
+func TestLoadDevelopmentConfiguration(t *testing.T) {
+	t.Setenv("GO_LOOSE_SESSION_SECRET", "01234567890123456789012345678901")
+	t.Setenv("GO_LOOSE_DEV_LOGIN", "true")
+	t.Setenv("GO_LOOSE_ALLOWED_EMAIL_DOMAINS", "Example.com, internal.test")
+	cfg, err := Load()
+	if err != nil {
+		t.Fatalf("Load() error = %v", err)
+	}
+	if len(cfg.AllowedEmailDomains) != 2 || cfg.AllowedEmailDomains[0] != "example.com" {
+		t.Fatalf("unexpected domains: %#v", cfg.AllowedEmailDomains)
+	}
+}
+
+func TestLoadAllowsFirstRunWithoutConfiguredLogin(t *testing.T) {
+	t.Setenv("GO_LOOSE_SESSION_SECRET", "01234567890123456789012345678901")
+	t.Setenv("GO_LOOSE_DEV_LOGIN", "false")
+	t.Setenv("GO_LOOSE_LOCAL_LOGIN", "false")
+	t.Setenv("GO_LOOSE_OIDC_ISSUER", "")
+	t.Setenv("GO_LOOSE_OIDC_CLIENT_ID", "")
+	t.Setenv("GO_LOOSE_OIDC_CLIENT_SECRET", "")
+	if _, err := Load(); err != nil {
+		t.Fatalf("Load() error = %v", err)
+	}
+}
+
+func TestLoadAllowsDatabaseLoginWithoutBootstrapAccount(t *testing.T) {
+	t.Setenv("GO_LOOSE_SESSION_SECRET", "01234567890123456789012345678901")
+	t.Setenv("GO_LOOSE_LOCAL_LOGIN", "true")
+	t.Setenv("GO_LOOSE_LOCAL_ADMIN_PASSWORD", "")
+	if _, err := Load(); err != nil {
+		t.Fatalf("Load() error = %v", err)
+	}
+}