Janady13/missionmatch / internal/platform/config/config.go

1// Package config loads and validates the application's runtime configuration. 2// 3// Cloud selection is CONFIGURATION, not code (the cloud-portability mandate): the same binary runs 4// on AWS GovCloud or Azure Government by flipping MM_CLOUD and the provider settings. Nothing here 5// imports a cloud SDK — adapters live behind interfaces in their own packages and are wired in 6// cmd/api from this config. 7package config 8 9import ( 10 "encoding/base64" 11 "errors" 12 "fmt" 13 "os" 14 "strconv" 15 "strings" 16) 17 18// Env is the deployment environment. 19type Env string 20 21const ( 22 EnvDevelopment Env = "development" 23 EnvProduction Env = "production" 24) 25 26// Cloud is the target government cloud. Local is for dev (MinIO, self-hosted embeddings, no managed services). 27type Cloud string 28 29const ( 30 CloudLocal Cloud = "local" 31 CloudAWSGovCloud Cloud = "aws_govcloud" 32 CloudAzureGov Cloud = "azure_gov" 33) 34 35// EmbeddingProvider selects the embedding adapter. "fake" is a deterministic offline provider for 36// dev/tests; "openai" is any OpenAI-compatible endpoint (self-hosted vLLM — the production CUI path — 37// or OpenAI); "bedrock"/"azure_openai" are the managed gov-cloud adapters (wired at deploy time). 38type EmbeddingProvider string 39 40const ( 41 ProviderFake EmbeddingProvider = "fake" 42 ProviderOpenAI EmbeddingProvider = "openai" 43 ProviderBedrock EmbeddingProvider = "bedrock" 44 ProviderAzureOpenAI EmbeddingProvider = "azure_openai" 45) 46 47// Embeddings configures the embedding provider. Dimension MUST match the vector(N) column width in 48// the schema (default 384); changing the provider's native dimension is a re-embed migration, not a 49// config flip (STACK_DECISIONS.md §6). 50type Embeddings struct { 51 Provider EmbeddingProvider 52 Endpoint string // base URL for the OpenAI-compatible / Azure endpoint 53 Model string // e.g. "text-embedding-3-large", "amazon.titan-embed-text-v2:0", a local model id 54 Dimension int 55 APIKey string // bearer/api-key; for Bedrock/Azure-Entra the adapter uses cloud credentials instead 56} 57 58// Auth holds the server side secrets and tunables for the authentication module. Every secret here 59// loads from the environment (the root owned secrets file), never the repo or the browser bundle. 60type Auth struct { 61 PepperVersion int // active credential pepper version stored on new credentials 62 Pepper []byte // active credential pepper key (HMAC applied before PBKDF2) 63 PepperPrevious []byte // optional prior pepper key (version PepperVersion minus 1) for rotation 64 TOTPKEKVersion int // active TOTP secret KEK version 65 TOTPKEK []byte // 32 byte AES 256 key encrypting TOTP secrets at rest 66 CSRFKey []byte // HMAC key binding a CSRF token to its session 67 RecoveryLookupKey []byte // HMAC key for recovery code lookup tags 68 TOTPIssuer string // issuer shown in the authenticator app 69 SessionIdleSeconds int // idle timeout (NIST 800-171 3.1.11 default 900) 70 SessionAbsoluteSeconds int // absolute session cap (default 43200, 12 hours) 71 PendingAbsoluteSeconds int // auth_pending (pre MFA) session cap (default 300) 72 InviteExpirySeconds int // invite and activation link lifetime (default 259200, 72 hours) 73 CookieSecure bool // Secure attribute on the session cookie (true except plain http dev) 74} 75 76// Config is the fully-resolved, validated application configuration. 77type Config struct { 78 Env Env 79 HTTPAddr string 80 AppDatabaseURL string // NOBYPASSRLS app role DSN 81 MigratorDatabaseURL string // BYPASSRLS migrator role DSN (used by goose only) 82 ComplianceDatabaseURL string // compliance role DSN, the only path that reads the eeo schema; empty disables adverse impact reporting (503) 83 DecisionRetentionDays int // retention window for identifiable screening artifacts after a decision (default 90) 84 Cloud Cloud 85 Embeddings Embeddings 86 RequireFIPS bool // when true, cmd/api aborts unless crypto/fips140.Enabled() 87 AllowDevHeaderAuth bool // dev only X-Org-ID resolver toggle; MUST be false in production 88 AllowedOrigins []string // CSRF Origin allowlist for unsafe verbs; empty disables the check (dev) 89 TrustedProxyHeader string // header carrying the real client IP (set by a trusted reverse proxy); empty uses the TCP peer 90 Auth Auth 91} 92 93// Load reads configuration from the environment, applies defaults, and validates it. 94func Load() (Config, error) { 95 c := Config{ 96 Env: Env(getDefault("MM_ENV", string(EnvDevelopment))), 97 HTTPAddr: getDefault("MM_HTTP_ADDR", ":8080"), 98 AppDatabaseURL: os.Getenv("MM_DATABASE_URL"), 99 MigratorDatabaseURL: os.Getenv("MM_MIGRATOR_DATABASE_URL"), 100 ComplianceDatabaseURL: os.Getenv("MM_COMPLIANCE_DATABASE_URL"), 101 DecisionRetentionDays: getInt("MM_DECISION_RETENTION_DAYS", 90), 102 Cloud: Cloud(getDefault("MM_CLOUD", string(CloudLocal))), 103 Embeddings: Embeddings{ 104 Provider: EmbeddingProvider(getDefault("MM_EMBED_PROVIDER", string(ProviderFake))), 105 Endpoint: os.Getenv("MM_EMBED_ENDPOINT"), 106 Model: os.Getenv("MM_EMBED_MODEL"), 107 Dimension: getInt("MM_EMBED_DIMENSION", 384), 108 APIKey: os.Getenv("MM_EMBED_API_KEY"), 109 }, 110 RequireFIPS: getBool("MM_REQUIRE_FIPS", false), 111 AllowDevHeaderAuth: getBool("MM_ALLOW_DEV_HEADER_AUTH", false), 112 AllowedOrigins: splitCSV(os.Getenv("MM_ALLOWED_ORIGINS")), 113 TrustedProxyHeader: os.Getenv("MM_TRUSTED_PROXY_HEADER"), 114 Auth: Auth{ 115 PepperVersion: getInt("MM_CREDENTIAL_PEPPER_VERSION", 1), 116 Pepper: getBytes("MM_CREDENTIAL_PEPPER"), 117 PepperPrevious: getBytes("MM_CREDENTIAL_PEPPER_PREVIOUS"), 118 TOTPKEKVersion: getInt("MM_TOTP_KEK_VERSION", 1), 119 TOTPKEK: getBytes("MM_TOTP_KEK"), 120 CSRFKey: getBytes("MM_CSRF_KEY"), 121 RecoveryLookupKey: getBytes("MM_RECOVERY_LOOKUP_KEY"), 122 TOTPIssuer: getDefault("MM_TOTP_ISSUER", "missionMATCH"), 123 SessionIdleSeconds: getInt("MM_SESSION_IDLE_SECONDS", 900), 124 SessionAbsoluteSeconds: getInt("MM_SESSION_ABSOLUTE_SECONDS", 43200), 125 PendingAbsoluteSeconds: getInt("MM_SESSION_PENDING_SECONDS", 300), 126 InviteExpirySeconds: getInt("MM_INVITE_EXPIRY_SECONDS", 259200), 127 CookieSecure: getBool("MM_COOKIE_SECURE", true), 128 }, 129 } 130 if err := c.Validate(); err != nil { 131 return Config{}, err 132 } 133 return c, nil 134} 135 136// Validate enforces invariants and environment-specific requirements. Errors are joined so a 137// misconfigured deploy surfaces every problem at once. 138func (c Config) Validate() error { 139 var errs []error 140 141 switch c.Env { 142 case EnvDevelopment, EnvProduction: 143 default: 144 errs = append(errs, fmt.Errorf("MM_ENV %q invalid (want development|production)", c.Env)) 145 } 146 switch c.Cloud { 147 case CloudLocal, CloudAWSGovCloud, CloudAzureGov: 148 default: 149 errs = append(errs, fmt.Errorf("MM_CLOUD %q invalid (want local|aws_govcloud|azure_gov)", c.Cloud)) 150 } 151 switch c.Embeddings.Provider { 152 case ProviderFake, ProviderOpenAI, ProviderBedrock, ProviderAzureOpenAI: 153 default: 154 errs = append(errs, fmt.Errorf("MM_EMBED_PROVIDER %q invalid", c.Embeddings.Provider)) 155 } 156 if c.Embeddings.Dimension <= 0 { 157 errs = append(errs, errors.New("MM_EMBED_DIMENSION must be > 0")) 158 } 159 160 // OpenAI-compatible providers need an endpoint + model. 161 if c.Embeddings.Provider == ProviderOpenAI || c.Embeddings.Provider == ProviderAzureOpenAI { 162 if c.Embeddings.Endpoint == "" { 163 errs = append(errs, fmt.Errorf("MM_EMBED_ENDPOINT required for provider %q", c.Embeddings.Provider)) 164 } 165 if c.Embeddings.Model == "" { 166 errs = append(errs, fmt.Errorf("MM_EMBED_MODEL required for provider %q", c.Embeddings.Provider)) 167 } 168 } 169 170 // TOTP secrets are AES 256, so the KEK must be exactly 32 bytes whenever it is set, in any env. 171 if len(c.Auth.TOTPKEK) != 0 && len(c.Auth.TOTPKEK) != 32 { 172 errs = append(errs, errors.New("MM_TOTP_KEK must decode to exactly 32 bytes (AES 256)")) 173 } 174 if c.Auth.PepperVersion <= 0 { 175 errs = append(errs, errors.New("MM_CREDENTIAL_PEPPER_VERSION must be positive")) 176 } 177 if c.Auth.SessionIdleSeconds <= 0 || c.Auth.SessionAbsoluteSeconds <= 0 || c.Auth.PendingAbsoluteSeconds <= 0 { 178 errs = append(errs, errors.New("session timeout seconds must all be positive")) 179 } 180 if c.DecisionRetentionDays <= 0 { 181 errs = append(errs, errors.New("MM_DECISION_RETENTION_DAYS must be positive")) 182 } 183 184 if c.Env == EnvProduction { 185 if c.AppDatabaseURL == "" { 186 errs = append(errs, errors.New("MM_DATABASE_URL required in production")) 187 } 188 if c.Embeddings.Provider == ProviderFake { 189 errs = append(errs, errors.New("the fake embedding provider must not be used in production")) 190 } 191 if c.Cloud == CloudLocal { 192 errs = append(errs, errors.New("MM_CLOUD must be a government cloud in production")) 193 } 194 // The dev X-Org-ID resolver may never be the production tenant source. 195 if c.AllowDevHeaderAuth { 196 errs = append(errs, errors.New("MM_ALLOW_DEV_HEADER_AUTH must be false in production")) 197 } 198 // FIPS must be enforced, not optional, so the validated crypto path is the one that runs. 199 if !c.RequireFIPS { 200 errs = append(errs, errors.New("MM_REQUIRE_FIPS must be true in production")) 201 } 202 // Every auth secret must be present so the validated crypto has its keys. 203 if len(c.Auth.Pepper) == 0 { 204 errs = append(errs, errors.New("MM_CREDENTIAL_PEPPER required in production")) 205 } 206 if len(c.Auth.TOTPKEK) != 32 { 207 errs = append(errs, errors.New("MM_TOTP_KEK (32 byte AES 256 key) required in production")) 208 } 209 if len(c.Auth.CSRFKey) == 0 { 210 errs = append(errs, errors.New("MM_CSRF_KEY required in production")) 211 } 212 if len(c.Auth.RecoveryLookupKey) == 0 { 213 errs = append(errs, errors.New("MM_RECOVERY_LOOKUP_KEY required in production")) 214 } 215 // The CSRF Origin allowlist must be enforced; an empty list disables it (a dev only path). 216 if len(c.AllowedOrigins) == 0 { 217 errs = append(errs, errors.New("MM_ALLOWED_ORIGINS required in production (the CSRF Origin allowlist must be enforced)")) 218 } 219 // Both cookies use the __Host- prefix, which a browser only accepts when Secure is set; a non 220 // Secure production deploy silently breaks all auth and exposes the token. 221 if !c.Auth.CookieSecure { 222 errs = append(errs, errors.New("MM_COOKIE_SECURE must be true in production (the __Host- cookie prefix requires Secure)")) 223 } 224 } 225 226 return errors.Join(errs...) 227} 228 229// IsProduction reports whether this is a production deployment. 230func (c Config) IsProduction() bool { return c.Env == EnvProduction } 231 232func getDefault(key, def string) string { 233 if v := strings.TrimSpace(os.Getenv(key)); v != "" { 234 return v 235 } 236 return def 237} 238 239func getInt(key string, def int) int { 240 if v := strings.TrimSpace(os.Getenv(key)); v != "" { 241 if n, err := strconv.Atoi(v); err == nil { 242 return n 243 } 244 } 245 return def 246} 247 248func getBool(key string, def bool) bool { 249 if v := strings.TrimSpace(os.Getenv(key)); v != "" { 250 if b, err := strconv.ParseBool(v); err == nil { 251 return b 252 } 253 } 254 return def 255} 256 257// splitCSV splits a comma separated env value into trimmed, non empty entries. 258func splitCSV(v string) []string { 259 if strings.TrimSpace(v) == "" { 260 return nil 261 } 262 parts := strings.Split(v, ",") 263 out := make([]string, 0, len(parts)) 264 for _, p := range parts { 265 if t := strings.TrimSpace(p); t != "" { 266 out = append(out, t) 267 } 268 } 269 return out 270} 271 272// getBytes loads a secret key from the environment. The value is decoded as standard base64 when it 273// parses as such, otherwise the raw bytes of the string are used, so an operator can supply either a 274// base64 key or a raw passphrase. An unset variable yields nil. 275func getBytes(key string) []byte { 276 v := strings.TrimSpace(os.Getenv(key)) 277 if v == "" { 278 return nil 279 } 280 if decoded, err := base64.StdEncoding.DecodeString(v); err == nil { 281 return decoded 282 } 283 return []byte(v) 284} 285