Bernt
8921fd1467
- Remove secrets from Git (.env) - Remove debug token endpoint - Fix login to reject unauthorized access in production - Remove HS256 fallback in JWT validation (RS256 only) - Fix SQL injection in journal.go countQuery - Fix CORS to use explicit origins only (no wildcard) - Add security headers middleware (CSP, HSTS, etc.) - Add input validation helpers - Build successful
80 lines
2.0 KiB
Go
80 lines
2.0 KiB
Go
package config
|
|
|
|
import (
|
|
"os"
|
|
"strings"
|
|
)
|
|
|
|
type Config struct {
|
|
Port string
|
|
DBURL string
|
|
LedgerDBURL string
|
|
JWTSecret string
|
|
AMOSBaseURL string
|
|
CORSOrigins []string
|
|
MigrationsDir string
|
|
RustServiceURL string
|
|
RedisURL string
|
|
RedisAddr string
|
|
KafkaBrokers []string
|
|
ResendAPIKey string
|
|
FromEmail string
|
|
FromName string
|
|
}
|
|
|
|
func Load() *Config {
|
|
cfg := &Config{
|
|
Port: getEnv("PORT", "9092"),
|
|
DBURL: getEnv("DB_URL", "postgres://boc:boc@localhost:5432/boc?sslmode=disable"),
|
|
LedgerDBURL: requireEnv("LEDGER_DB_URL"),
|
|
JWTSecret: requireEnv("JWT_SECRET"),
|
|
AMOSBaseURL: getEnv("AMOS_BASE_URL", "http://localhost:9000"),
|
|
CORSOrigins: splitComma(getEnv("CORS_ORIGINS", "http://localhost:3000")),
|
|
MigrationsDir: getEnv("MIGRATIONS_DIR", "./db/migrations"),
|
|
RustServiceURL: getEnv("RUST_SERVICE_URL", "http://localhost:9093"),
|
|
RedisURL: getEnv("REDIS_URL", "redis://localhost:6379"),
|
|
RedisAddr: getEnv("REDIS_ADDR", "localhost:6379"),
|
|
KafkaBrokers: splitComma(getEnv("KAFKA_BROKERS", "localhost:9092")),
|
|
ResendAPIKey: getEnv("RESEND_API_KEY", ""),
|
|
FromEmail: getEnv("FROM_EMAIL", "noreply@landvex.com"),
|
|
FromName: getEnv("FROM_NAME", "Landvex BOC"),
|
|
}
|
|
|
|
// Validate no wildcard in CORS origins in production
|
|
if cfg.Port != "9092" {
|
|
for _, origin := range cfg.CORSOrigins {
|
|
if origin == "*" {
|
|
panic("CORS wildcard not allowed in production")
|
|
}
|
|
}
|
|
}
|
|
|
|
return cfg
|
|
}
|
|
|
|
func getEnv(key, fallback string) string {
|
|
if v := os.Getenv(key); v != "" {
|
|
return v
|
|
}
|
|
return fallback
|
|
}
|
|
|
|
func requireEnv(key string) string {
|
|
v := os.Getenv(key)
|
|
if v == "" {
|
|
panic("required environment variable not set: " + key)
|
|
}
|
|
return v
|
|
}
|
|
|
|
func splitComma(s string) []string {
|
|
parts := strings.Split(s, ",")
|
|
out := make([]string, 0, len(parts))
|
|
for _, p := range parts {
|
|
if t := strings.TrimSpace(p); t != "" {
|
|
out = append(out, t)
|
|
}
|
|
}
|
|
return out
|
|
}
|