Tronax
a5ef8cf3ba
- internal/auth/oidc.go: OIDCService mit go-oidc v3
- id_token-Verifikation via JWKS (Signatur, iss, aud, exp)
- Provider-Caching (sync.Map, lazy init per Issuer-URL)
- Unterstützt Google + Generic OIDC
- internal/auth/user.go: GetByOIDCSubject + CreateOIDCUser
(find-or-create via (oidc_issuer, oidc_subject))
- internal/httpapi/auth.go: POST /auth/oidc Handler
(id_token verifiziern → find-or-create User → issueSession)
- internal/httpapi/api.go: /auth/oidc Route verdrahtet
- internal/config/config.go: OIDC-Validierung
(enabled → client_id + issuer Pflicht)
- go.mod/go.sum: go-oidc/v3 + oauth2 Abhängigkeiten
- AGENTS.md: Phase B vollständig als erledigt markiert
Verifiziert: E2E gegen lokalen Mock-IdP (Discovery → JWKS →
signiertes id_token → User angelegt → 2. Login gleicher User →
tampered Token → 401). Alle Fehlerpfade geprüft.
go build ./... && go vet ./... && go test ./internal/auth/... ✅
94 lines
3.4 KiB
Go
94 lines
3.4 KiB
Go
// Package config holds all runtime configuration for the backend.
|
|
// Values are parsed from environment variables via struct tags.
|
|
package config
|
|
|
|
import (
|
|
"fmt"
|
|
"time"
|
|
|
|
"github.com/caarlos0/env/v11"
|
|
)
|
|
|
|
// Config is the single source of runtime configuration.
|
|
type Config struct {
|
|
// HTTPAddr is the address the HTTP server listens on, e.g. ":8080".
|
|
HTTPAddr string `env:"HTTP_ADDR" envDefault:":8080"`
|
|
|
|
// AppEnv: "development" or "production".
|
|
AppEnv string `env:"APP_ENV" envDefault:"development"`
|
|
|
|
// LogLevel: debug | info | warn | error.
|
|
LogLevel string `env:"LOG_LEVEL" envDefault:"info"`
|
|
|
|
// PublicBaseURL is the externally reachable URL (scheme + host), no trailing slash.
|
|
// Used e.g. for OIDC redirect URIs. Example: "https://mitbringsl.example.com".
|
|
PublicBaseURL string `env:"PUBLIC_BASE_URL" envDefault:"http://localhost:8080"`
|
|
|
|
// Database
|
|
DatabaseURL string `env:"DATABASE_URL,required"`
|
|
DBMaxOpenConns int32 `env:"DB_MAX_OPEN_CONNS" envDefault:"25"`
|
|
DBMaxIdleConns int32 `env:"DB_MAX_IDLE_CONNS" envDefault:"5"`
|
|
DBMaxLifetime time.Duration `env:"DB_MAX_CONN_LIFETIME" envDefault:"30m"`
|
|
|
|
// Session token config (opaque tokens issued by this backend after login).
|
|
SessionTokenBytes int `env:"SESSION_TOKEN_BYTES" envDefault:"32"` // 256-bit
|
|
SessionTokenTTL time.Duration `env:"SESSION_TOKEN_TTL" envDefault:"720h"` // 30 days
|
|
SessionCookieName string `env:"SESSION_COOKIE_NAME" envDefault:"mitbringsl_session"`
|
|
|
|
// OIDC providers. Both optional; enable per provider.
|
|
GoogleOIDC GoogleOIDCConfig
|
|
GenericOIDC GenericOIDCConfig
|
|
|
|
// CORS allowed origins (comma-separated). Empty = no CORS headers.
|
|
CORSAllowedOrigins []string `env:"CORS_ALLOWED_ORIGINS" envSeparator:","`
|
|
}
|
|
|
|
// GoogleOIDCConfig for "Sign in with Google".
|
|
type GoogleOIDCConfig struct {
|
|
Enabled bool `env:"OIDC_GOOGLE_ENABLED" envDefault:"false"`
|
|
ClientID string `env:"OIDC_GOOGLE_CLIENT_ID"` // the audience the verifier accepts
|
|
Issuer string `env:"OIDC_GOOGLE_ISSUER" envDefault:"https://accounts.google.com"`
|
|
}
|
|
|
|
// GenericOIDCConfig for any standards-compliant OIDC IdP (Keycloak, Authentik, ...).
|
|
type GenericOIDCConfig struct {
|
|
Enabled bool `env:"OIDC_GENERIC_ENABLED" envDefault:"false"`
|
|
Issuer string `env:"OIDC_GENERIC_ISSUER"`
|
|
ClientID string `env:"OIDC_GENERIC_CLIENT_ID"`
|
|
}
|
|
|
|
// Load reads configuration from environment variables and validates basic invariants.
|
|
func Load() (*Config, error) {
|
|
var cfg Config
|
|
if err := env.Parse(&cfg); err != nil {
|
|
return nil, fmt.Errorf("parse env: %w", err)
|
|
}
|
|
if err := cfg.validate(); err != nil {
|
|
return nil, err
|
|
}
|
|
return &cfg, nil
|
|
}
|
|
|
|
// validate enforces invariants that env parsing alone can't express.
|
|
func (c *Config) validate() error {
|
|
if c.GoogleOIDC.Enabled {
|
|
if c.GoogleOIDC.ClientID == "" {
|
|
return fmt.Errorf("OIDC_GOOGLE_ENABLED=true requires OIDC_GOOGLE_CLIENT_ID")
|
|
}
|
|
if c.GoogleOIDC.Issuer == "" {
|
|
return fmt.Errorf("OIDC_GOOGLE_ENABLED=true requires OIDC_GOOGLE_ISSUER")
|
|
}
|
|
}
|
|
if c.GenericOIDC.Enabled {
|
|
if c.GenericOIDC.ClientID == "" {
|
|
return fmt.Errorf("OIDC_GENERIC_ENABLED=true requires OIDC_GENERIC_CLIENT_ID")
|
|
}
|
|
if c.GenericOIDC.Issuer == "" {
|
|
return fmt.Errorf("OIDC_GENERIC_ENABLED=true requires OIDC_GENERIC_ISSUER")
|
|
}
|
|
}
|
|
return nil
|
|
}
|
|
|
|
// IsProduction reports whether the app runs in production mode.
|
|
func (c *Config) IsProduction() bool { return c.AppEnv == "production" }
|