first commit

2026-07-29 15:03:49 +00:00 · 2026-04-10 12:04:09 +02:00
commit 3cb40adb23
203 changed files with 40226 additions and 0 deletions
@@ -0,0 +1,256 @@
+package app
+
+import (
+	"errors"
+	"fmt"
+	"net/url"
+	"os"
+	"strconv"
+	"strings"
+	"time"
+)
+
+const (
+	defaultAppMode         = "development"
+	defaultAPIPort         = "8080"
+	defaultShutdownTimeout = 10 * time.Second
+)
+
+var (
+	defaultLocalCORSOrigins = []string{
+		"http://localhost:3000",
+		"http://127.0.0.1:3000",
+		"http://localhost:3001",
+		"http://127.0.0.1:3001",
+	}
+	insecureSecretPlaceholders = map[string]struct{}{
+		"":                                     {},
+		"replace-me-with-a-long-random-secret": {},
+		"replace-me-with-a-dedicated-mail-secret": {},
+		"productier-local-mail-key":               {},
+		"changeme":                                {},
+		"change-me":                               {},
+		"replace-me":                              {},
+	}
+)
+
+type runtimeConfig struct {
+	mode             string
+	apiPort          string
+	authServiceURL   string
+	shutdownTimeout  time.Duration
+	corsAllowOrigins []string
+	mailSecret       string
+	metricsAuthToken string
+}
+
+func loadRuntimeConfig() (runtimeConfig, error) {
+	mode, err := parseAppMode(os.Getenv("APP_ENV"))
+	if err != nil {
+		return runtimeConfig{}, err
+	}
+
+	apiPort, err := parsePort(os.Getenv("API_PORT"), defaultAPIPort, "API_PORT")
+	if err != nil {
+		return runtimeConfig{}, err
+	}
+
+	authServiceURL, err := parseAbsoluteHTTPURL(
+		valueOrDefault(strings.TrimSpace(os.Getenv("AUTH_SERVICE_URL")), "http://localhost:3001"),
+		"AUTH_SERVICE_URL",
+	)
+	if err != nil {
+		return runtimeConfig{}, err
+	}
+
+	shutdownTimeout, err := parseDuration(
+		os.Getenv("API_SHUTDOWN_TIMEOUT"),
+		defaultShutdownTimeout,
+		"API_SHUTDOWN_TIMEOUT",
+	)
+	if err != nil {
+		return runtimeConfig{}, err
+	}
+
+	corsAllowOrigins, err := parseCORSAllowOrigins(mode, os.Getenv("CORS_ALLOW_ORIGINS"))
+	if err != nil {
+		return runtimeConfig{}, err
+	}
+
+	mailSecret, err := resolveMailSecret(mode)
+	if err != nil {
+		return runtimeConfig{}, err
+	}
+
+	metricsAuthToken, err := resolveMetricsAuthToken(mode)
+	if err != nil {
+		return runtimeConfig{}, err
+	}
+
+	return runtimeConfig{
+		mode:             mode,
+		apiPort:          apiPort,
+		authServiceURL:   authServiceURL,
+		shutdownTimeout:  shutdownTimeout,
+		corsAllowOrigins: corsAllowOrigins,
+		mailSecret:       mailSecret,
+		metricsAuthToken: metricsAuthToken,
+	}, nil
+}
+
+func parseAppMode(raw string) (string, error) {
+	mode := strings.TrimSpace(strings.ToLower(raw))
+	if mode == "" {
+		return defaultAppMode, nil
+	}
+	switch mode {
+	case "development", "test", "staging", "production":
+		return mode, nil
+	default:
+		return "", fmt.Errorf("unsupported APP_ENV %q (allowed: development, test, staging, production)", mode)
+	}
+}
+
+func parsePort(raw string, fallback string, envName string) (string, error) {
+	port := strings.TrimSpace(raw)
+	if port == "" {
+		port = fallback
+	}
+	numeric, err := strconv.Atoi(port)
+	if err != nil || numeric < 1 || numeric > 65535 {
+		return "", fmt.Errorf("%s must be a valid TCP port (1-65535)", envName)
+	}
+	return strconv.Itoa(numeric), nil
+}
+
+func parseDuration(raw string, fallback time.Duration, envName string) (time.Duration, error) {
+	value := strings.TrimSpace(raw)
+	if value == "" {
+		return fallback, nil
+	}
+	duration, err := time.ParseDuration(value)
+	if err != nil {
+		return 0, fmt.Errorf("%s must be a valid duration (example: 10s): %w", envName, err)
+	}
+	if duration <= 0 {
+		return 0, fmt.Errorf("%s must be greater than zero", envName)
+	}
+	return duration, nil
+}
+
+func parseAbsoluteHTTPURL(raw string, envName string) (string, error) {
+	value := strings.TrimSpace(raw)
+	if value == "" {
+		return "", fmt.Errorf("%s is required", envName)
+	}
+	parsed, err := url.Parse(value)
+	if err != nil {
+		return "", fmt.Errorf("%s must be a valid URL: %w", envName, err)
+	}
+	if parsed.Scheme != "http" && parsed.Scheme != "https" {
+		return "", fmt.Errorf("%s must use http or https", envName)
+	}
+	if parsed.Host == "" {
+		return "", fmt.Errorf("%s must include a host", envName)
+	}
+	return strings.TrimRight(parsed.String(), "/"), nil
+}
+
+func parseCORSAllowOrigins(mode string, raw string) ([]string, error) {
+	value := strings.TrimSpace(raw)
+	if value == "" {
+		if mode == "staging" || mode == "production" {
+			return nil, errors.New("CORS_ALLOW_ORIGINS is required in staging/production (comma-separated origins)")
+		}
+		return append([]string(nil), defaultLocalCORSOrigins...), nil
+	}
+
+	parts := strings.Split(value, ",")
+	origins := make([]string, 0, len(parts))
+	seen := make(map[string]struct{}, len(parts))
+	for _, part := range parts {
+		origin := strings.TrimSpace(part)
+		if origin == "" {
+			continue
+		}
+		if origin == "*" {
+			return nil, errors.New("CORS_ALLOW_ORIGINS cannot include '*' when credentials are enabled")
+		}
+		validated, err := parseOrigin(origin, "CORS_ALLOW_ORIGINS")
+		if err != nil {
+			return nil, err
+		}
+		if _, exists := seen[validated]; exists {
+			continue
+		}
+		seen[validated] = struct{}{}
+		origins = append(origins, validated)
+	}
+	if len(origins) == 0 {
+		return nil, errors.New("CORS_ALLOW_ORIGINS must include at least one valid origin")
+	}
+	return origins, nil
+}
+
+func parseOrigin(raw string, envName string) (string, error) {
+	parsed, err := url.Parse(strings.TrimSpace(raw))
+	if err != nil {
+		return "", fmt.Errorf("%s must contain valid origins: %w", envName, err)
+	}
+	if parsed.Scheme != "http" && parsed.Scheme != "https" {
+		return "", fmt.Errorf("%s origins must use http or https", envName)
+	}
+	if parsed.Host == "" {
+		return "", fmt.Errorf("%s origins must include a host", envName)
+	}
+	if parsed.Path != "" && parsed.Path != "/" {
+		return "", fmt.Errorf("%s origins cannot include URL paths", envName)
+	}
+	if parsed.RawQuery != "" || parsed.Fragment != "" {
+		return "", fmt.Errorf("%s origins cannot include query or fragment components", envName)
+	}
+	return parsed.Scheme + "://" + parsed.Host, nil
+}
+
+func resolveMailSecret(mode string) (string, error) {
+	mailSecret := strings.TrimSpace(os.Getenv("MAIL_ENCRYPTION_KEY"))
+	if mailSecret == "" {
+		mailSecret = strings.TrimSpace(os.Getenv("BETTER_AUTH_SECRET"))
+	}
+
+	if mode != "staging" && mode != "production" {
+		return mailSecret, nil
+	}
+	if isInsecureSecret(mailSecret) {
+		return "", errors.New("set a strong MAIL_ENCRYPTION_KEY (or BETTER_AUTH_SECRET fallback) for staging/production")
+	}
+	return mailSecret, nil
+}
+
+func resolveMetricsAuthToken(mode string) (string, error) {
+	token := strings.TrimSpace(os.Getenv("METRICS_AUTH_TOKEN"))
+	if token == "" {
+		return "", nil
+	}
+
+	if mode == "production" && isInsecureSecret(token) {
+		return "", errors.New("METRICS_AUTH_TOKEN must be a strong non-placeholder secret when set in production")
+	}
+
+	return token, nil
+}
+
+func isInsecureSecret(secret string) bool {
+	normalized := strings.TrimSpace(strings.ToLower(secret))
+	if _, exists := insecureSecretPlaceholders[normalized]; exists {
+		return true
+	}
+	return len(strings.TrimSpace(secret)) < 16
+}
+
+func valueOrDefault(value string, fallback string) string {
+	if strings.TrimSpace(value) == "" {
+		return fallback
+	}
+	return value
+}