Janady13/missionmatch / internal/platform/config/config.go

1// Package config loads and validates the application's runtime configuration. 2// 3// Cloud selection is CONFIGURATION, not code (the cloud-portability mandate): the same binary runs 4// on AWS GovCloud or Azure Government by flipping MM_CLOUD and the provider settings. Nothing here 5// imports a cloud SDK, adapters live behind interfaces in their own packages and are wired in 6// cmd/api from this config. 7package config 8 9import ( 10 "encoding/base64" 11 "encoding/hex" 12 "errors" 13 "fmt" 14 "os" 15 "strconv" 16 "strings" 17) 18 19// Env is the deployment environment. 20type Env string 21 22const ( 23 EnvDevelopment Env = "development" 24 EnvProduction Env = "production" 25) 26 27// Cloud is the target government cloud. Local is for dev (MinIO, self-hosted embeddings, no managed services). 28type Cloud string 29 30const ( 31 CloudLocal Cloud = "local" 32 CloudAWSGovCloud Cloud = "aws_govcloud" 33 CloudAzureGov Cloud = "azure_gov" 34) 35 36// Tenancy selects how a request reaches its tenant's data. "shared" is the original model: one app 37// pool over a single shared database with Row Level Security scoping every row by app.current_org_id. 38// "per_tenant" is the database per tenant model: a shared CONTROL PLANE database holds identity, auth, 39// and the tenant directory, and each tenant's business data lives in its OWN isolated database reached 40// through a per tenant pool resolved from the directory and the secrets port. RLS stays forced inside 41// every tenant database as defense in depth (AWS SaaS Lens silo isolation, the resource boundary is the 42// isolation boundary; Azure data plane vs control plane). The default is shared so the existing 43// deployment keeps working unchanged until the operator cuts over. 44type Tenancy string 45 46const ( 47 TenancyShared Tenancy = "shared" 48 TenancyPerTenant Tenancy = "per_tenant" 49) 50 51// SecretsBackend selects how a per tenant database credential is resolved from the reference stored in 52// the tenant directory. "env" reads a root owned environment file (dev and staging, the keys stay on 53// the server rule); the government cloud backends resolve from a managed secret store (AWS Secrets 54// Manager, Azure Key Vault) and are wired at deploy, never compiled into the core build. 55type SecretsBackend string 56 57const ( 58 SecretsEnv SecretsBackend = "env" 59 SecretsAWSGovCloud SecretsBackend = "aws_govcloud" 60 SecretsAzureGov SecretsBackend = "azure_gov" 61) 62 63// Secrets configures the per tenant credential resolver (see internal/platform/secrets). The reference 64// stored in the directory is a logical pointer (a key), never a credential; the backend maps the key to 65// a DSN at pool open time, with a short cache TTL so a rotated credential is picked up. 66type Secrets struct { 67 Backend SecretsBackend 68 CacheTTLSeconds int 69} 70 71// TenantPools configures the bounded per tenant pool registry (see internal/platform/tenantpool). A 72// bounded number of live pools, each small, keeps MaxPools times MaxConns well under the server 73// max_connections (the pgx maintainer's pool per tenant guidance); idle tenants are evicted whole. 74type TenantPools struct { 75 MaxPools int // most tenant pools held live at once (LRU evicted beyond this) 76 MaxConnsPerPool int // max connections in each tenant pool (small, because there are many) 77 IdleEvictSecs int // evict a whole tenant pool after this long with no use 78} 79 80// EmbeddingProvider selects the embedding adapter. "fake" is a deterministic offline provider for 81// dev/tests; "openai" is any OpenAI compatible endpoint (self hosted vLLM, the production CUI path, 82// or OpenAI); "bedrock"/"azure_openai" are the managed gov cloud adapters (wired at deploy time). 83type EmbeddingProvider string 84 85const ( 86 ProviderFake EmbeddingProvider = "fake" 87 ProviderOpenAI EmbeddingProvider = "openai" 88 ProviderBedrock EmbeddingProvider = "bedrock" 89 ProviderAzureOpenAI EmbeddingProvider = "azure_openai" 90 // ProviderMegamind routes embeddings through the stateless MEGAMIND inference plane (the typed 91 // inference client to the gateway), the production self hosted path for cleared CUI data. 92 ProviderMegamind EmbeddingProvider = "megamind" 93) 94 95// Embeddings configures the embedding provider. Dimension MUST match the vector(N) column width in 96// the schema (default 384); changing the provider's native dimension is a re-embed migration, not a 97// config flip (STACK_DECISIONS.md §6). 98type Embeddings struct { 99 Provider EmbeddingProvider 100 Endpoint string // base URL for the OpenAI-compatible / Azure endpoint 101 Model string // e.g. "text-embedding-3-large", "amazon.titan-embed-text-v2:0", a local model id 102 Dimension int 103 APIKey string // bearer/api-key; for Bedrock/Azure-Entra the adapter uses cloud credentials instead 104 MegamindURL string // base URL of the MEGAMIND gateway when Provider is "megamind" 105} 106 107// Inference configures the typed client to the stateless MEGAMIND inference plane (embeddings, 108// reranking, generation, faithfulness). The heavy models run out of process on the Apple Silicon 109// cluster; this is the only AI compute the FIPS API binary reaches, over HTTP. URL empty means the AI 110// layer is unconfigured and its routes degrade rather than fail the boot. 111type Inference struct { 112 URL string // MEGAMIND gateway base, reached over Tailscale 113 EmbedModel string // 384 dim embedder (all-minilm or bge-small-en-v1.5) 114 RerankModel string // cross encoder (bge-reranker-v2-m3) or the cosine baseline 115 GenerateModel string // local instruct model (e.g. llama3.1:8b) 116 Dimension int // must match the vector(N) column width 117 TimeoutSeconds int // per request 118 MaxRetries int // additional attempts on a transient failure 119 BreakerTrips int // consecutive failures before the breaker opens 120 BreakerCoolSec int // how long the breaker stays open 121 TeachingEnabled bool // federated craft signal transmission; disabled until multiple live clients exist 122} 123 124// ExtractorProvider selects the Mission Check structured extraction adapter (resume or job description 125// text to proposed fields). "deterministic" is the offline rules plus ontology extractor and the 126// default; an LLM backed provider (self hosted vLLM for CUI in production) is a future addition behind 127// the same port. Extraction runs server side only, so a key here never reaches the browser bundle. 128type ExtractorProvider string 129 130const ( 131 ExtractorDeterministic ExtractorProvider = "deterministic" 132) 133 134// Extraction configures the Mission Check structured extraction provider. Endpoint, Model, and APIKey 135// are reserved for a future provider backed extractor and are unused by the deterministic one. 136type Extraction struct { 137 Provider ExtractorProvider 138 Endpoint string 139 Model string 140 APIKey string 141} 142 143// Auth holds the server side secrets and tunables for the authentication module. Every secret here 144// loads from the environment (the root owned secrets file), never the repo or the browser bundle. 145type Auth struct { 146 PepperVersion int // active credential pepper version stored on new credentials 147 Pepper []byte // active credential pepper key (HMAC applied before PBKDF2) 148 PepperPrevious []byte // optional prior pepper key (version PepperVersion minus 1) for rotation 149 TOTPKEKVersion int // active TOTP secret KEK version 150 TOTPKEK []byte // 32 byte AES 256 key encrypting TOTP secrets at rest 151 TOTPKEKPrevious []byte // optional prior TOTP KEK (version TOTPKEKVersion minus 1) so a rotated KEK still decrypts older secrets 152 CSRFKey []byte // HMAC key binding a CSRF token to its session 153 RecoveryLookupKey []byte // HMAC key for recovery code lookup tags 154 TOTPIssuer string // issuer shown in the authenticator app 155 SessionIdleSeconds int // idle timeout (NIST 800-171 3.1.11 default 900) 156 SessionAbsoluteSeconds int // absolute session cap (default 43200, 12 hours) 157 PendingAbsoluteSeconds int // auth_pending (pre MFA) session cap (default 300) 158 InviteExpirySeconds int // invite and activation link lifetime (default 259200, 72 hours) 159 CookieSecure bool // Secure attribute on the session cookie (true except plain http dev) 160 MFARequired bool // when false, login mints an active session after password with no TOTP step (pilot only, forbidden in production) 161} 162 163// Config is the fully-resolved, validated application configuration. 164type Config struct { 165 Env Env 166 HTTPAddr string 167 Tenancy Tenancy // shared (one RLS database) or per_tenant (control plane + per tenant databases) 168 AppDatabaseURL string // NOBYPASSRLS app role DSN. In shared mode this IS the database; in per_tenant mode it is the control plane app DSN (identity, auth, directory) 169 MigratorDatabaseURL string // BYPASSRLS migrator role DSN (goose, and per_tenant directory writes against the control plane) 170 ComplianceDatabaseURL string // compliance role DSN, the only path that reads the eeo schema; empty disables adverse impact reporting (503) 171 Secrets Secrets 172 TenantPools TenantPools 173 DecisionRetentionDays int // retention window for identifiable screening artifacts after a decision (default 90) 174 Cloud Cloud 175 Embeddings Embeddings 176 Inference Inference 177 Extraction Extraction 178 RequireFIPS bool // when true, cmd/api aborts unless crypto/fips140.Enabled() 179 AllowDevHeaderAuth bool // dev only X-Org-ID resolver toggle; MUST be false in production 180 AllowedOrigins []string // CSRF Origin allowlist for unsafe verbs; empty disables the check (dev) 181 TrustedProxyHeader string // header carrying the real client IP (set by a trusted reverse proxy); empty uses the TCP peer 182 Auth Auth 183} 184 185// Load reads configuration from the environment, applies defaults, and validates it. 186func Load() (Config, error) { 187 // Secret key decode errors are collected and surfaced alongside validation errors, so a 188 // misconfigured deploy sees every problem at once instead of one boot failure at a time. 189 var secretErrs []error 190 getB := func(key string) []byte { 191 b, err := getBytes(key) 192 if err != nil { 193 secretErrs = append(secretErrs, err) 194 } 195 return b 196 } 197 c := Config{ 198 Env: Env(getDefault("MM_ENV", string(EnvDevelopment))), 199 HTTPAddr: getDefault("MM_HTTP_ADDR", ":8080"), 200 Tenancy: Tenancy(getDefault("MM_TENANCY", string(TenancyShared))), 201 AppDatabaseURL: os.Getenv("MM_DATABASE_URL"), 202 MigratorDatabaseURL: os.Getenv("MM_MIGRATOR_DATABASE_URL"), 203 ComplianceDatabaseURL: os.Getenv("MM_COMPLIANCE_DATABASE_URL"), 204 Secrets: Secrets{ 205 Backend: SecretsBackend(getDefault("MM_SECRETS_BACKEND", string(SecretsEnv))), 206 CacheTTLSeconds: getInt("MM_SECRET_CACHE_TTL_SECONDS", 900), 207 }, 208 TenantPools: TenantPools{ 209 MaxPools: getInt("MM_TENANT_MAX_POOLS", 64), 210 MaxConnsPerPool: getInt("MM_TENANT_POOL_MAX_CONNS", 4), 211 IdleEvictSecs: getInt("MM_TENANT_POOL_IDLE_EVICT_SECONDS", 1800), 212 }, 213 DecisionRetentionDays: getInt("MM_DECISION_RETENTION_DAYS", 90), 214 Cloud: Cloud(getDefault("MM_CLOUD", string(CloudLocal))), 215 Embeddings: Embeddings{ 216 Provider: EmbeddingProvider(getDefault("MM_EMBED_PROVIDER", string(ProviderFake))), 217 Endpoint: os.Getenv("MM_EMBED_ENDPOINT"), 218 Model: os.Getenv("MM_EMBED_MODEL"), 219 Dimension: getInt("MM_EMBED_DIMENSION", 384), 220 APIKey: os.Getenv("MM_EMBED_API_KEY"), 221 MegamindURL: os.Getenv("MM_MEGAMIND_URL"), 222 }, 223 Inference: Inference{ 224 URL: os.Getenv("MM_MEGAMIND_URL"), 225 // bge-small-en-v1.5 (384 dim) is the production embedder, served on Ollama as the qllama handle. 226 // Stored and query vectors MUST use the same model: switching the model requires a FULL re 227 // backfill (existing vectors from another model are incompatible), see DEPLOY_PLAN.md. 228 EmbedModel: getDefault("MM_MEGAMIND_EMBED_MODEL", "qllama/bge-small-en-v1.5"), 229 RerankModel: getDefault("MM_MEGAMIND_RERANK_MODEL", "bge-reranker-v2-m3"), 230 GenerateModel: getDefault("MM_MEGAMIND_GENERATE_MODEL", "llama3.1:8b"), 231 Dimension: getInt("MM_EMBED_DIMENSION", 384), 232 TimeoutSeconds: getInt("MM_MEGAMIND_TIMEOUT_SECONDS", 30), 233 MaxRetries: getInt("MM_MEGAMIND_MAX_RETRIES", 2), 234 BreakerTrips: getInt("MM_MEGAMIND_BREAKER_TRIPS", 5), 235 BreakerCoolSec: getInt("MM_MEGAMIND_BREAKER_COOL_SECONDS", 30), 236 TeachingEnabled: getBool("MM_MEGAMIND_TEACHING_ENABLED", false), 237 }, 238 Extraction: Extraction{ 239 Provider: ExtractorProvider(getDefault("MM_EXTRACT_PROVIDER", string(ExtractorDeterministic))), 240 Endpoint: os.Getenv("MM_EXTRACT_ENDPOINT"), 241 Model: os.Getenv("MM_EXTRACT_MODEL"), 242 APIKey: os.Getenv("MM_EXTRACT_API_KEY"), 243 }, 244 RequireFIPS: getBool("MM_REQUIRE_FIPS", false), 245 AllowDevHeaderAuth: getBool("MM_ALLOW_DEV_HEADER_AUTH", false), 246 AllowedOrigins: splitCSV(os.Getenv("MM_ALLOWED_ORIGINS")), 247 TrustedProxyHeader: os.Getenv("MM_TRUSTED_PROXY_HEADER"), 248 Auth: Auth{ 249 PepperVersion: getInt("MM_CREDENTIAL_PEPPER_VERSION", 1), 250 Pepper: getB("MM_CREDENTIAL_PEPPER"), 251 PepperPrevious: getB("MM_CREDENTIAL_PEPPER_PREVIOUS"), 252 TOTPKEKVersion: getInt("MM_TOTP_KEK_VERSION", 1), 253 TOTPKEK: getB("MM_TOTP_KEK"), 254 TOTPKEKPrevious: getB("MM_TOTP_KEK_PREVIOUS"), 255 CSRFKey: getB("MM_CSRF_KEY"), 256 RecoveryLookupKey: getB("MM_RECOVERY_LOOKUP_KEY"), 257 TOTPIssuer: getDefault("MM_TOTP_ISSUER", "missionMATCH"), 258 SessionIdleSeconds: getInt("MM_SESSION_IDLE_SECONDS", 900), 259 SessionAbsoluteSeconds: getInt("MM_SESSION_ABSOLUTE_SECONDS", 43200), 260 PendingAbsoluteSeconds: getInt("MM_SESSION_PENDING_SECONDS", 300), 261 InviteExpirySeconds: getInt("MM_INVITE_EXPIRY_SECONDS", 259200), 262 CookieSecure: getBool("MM_COOKIE_SECURE", true), 263 MFARequired: getBool("MM_MFA_REQUIRED", true), 264 }, 265 } 266 if err := c.Validate(); err != nil { 267 secretErrs = append(secretErrs, err) 268 } 269 if len(secretErrs) > 0 { 270 return Config{}, errors.Join(secretErrs...) 271 } 272 return c, nil 273} 274 275// Validate enforces invariants and environment-specific requirements. Errors are joined so a 276// misconfigured deploy surfaces every problem at once. 277func (c Config) Validate() error { 278 var errs []error 279 280 switch c.Env { 281 case EnvDevelopment, EnvProduction: 282 default: 283 errs = append(errs, fmt.Errorf("MM_ENV %q invalid (want development|production)", c.Env)) 284 } 285 switch c.Cloud { 286 case CloudLocal, CloudAWSGovCloud, CloudAzureGov: 287 default: 288 errs = append(errs, fmt.Errorf("MM_CLOUD %q invalid (want local|aws_govcloud|azure_gov)", c.Cloud)) 289 } 290 // Empty is the zero value of a directly constructed Config and means the default (shared tenancy, env 291 // secrets); Load always fills these explicitly. Only a non empty invalid value is rejected. 292 switch c.Tenancy { 293 case TenancyShared, TenancyPerTenant, "": 294 default: 295 errs = append(errs, fmt.Errorf("MM_TENANCY %q invalid (want shared|per_tenant)", c.Tenancy)) 296 } 297 switch c.Secrets.Backend { 298 case SecretsEnv, SecretsAWSGovCloud, SecretsAzureGov, "": 299 default: 300 errs = append(errs, fmt.Errorf("MM_SECRETS_BACKEND %q invalid (want env|aws_govcloud|azure_gov)", c.Secrets.Backend)) 301 } 302 if c.Tenancy == TenancyPerTenant { 303 // In per tenant mode the AppDatabaseURL is the control plane app DSN; it must be set so identity, 304 // auth, and the tenant directory have a home, and the pool bounds must be sane so the fleet of 305 // tenant pools cannot exhaust the server connection budget. 306 if c.AppDatabaseURL == "" { 307 errs = append(errs, errors.New("MM_DATABASE_URL (the control plane app DSN) required when MM_TENANCY=per_tenant")) 308 } 309 if c.TenantPools.MaxPools <= 0 || c.TenantPools.MaxConnsPerPool <= 0 || c.TenantPools.IdleEvictSecs <= 0 { 310 errs = append(errs, errors.New("MM_TENANT_MAX_POOLS, MM_TENANT_POOL_MAX_CONNS, and MM_TENANT_POOL_IDLE_EVICT_SECONDS must all be positive in per_tenant mode")) 311 } 312 } 313 switch c.Embeddings.Provider { 314 case ProviderFake, ProviderOpenAI, ProviderBedrock, ProviderAzureOpenAI, ProviderMegamind: 315 default: 316 errs = append(errs, fmt.Errorf("MM_EMBED_PROVIDER %q invalid", c.Embeddings.Provider)) 317 } 318 if c.Embeddings.Dimension <= 0 { 319 errs = append(errs, errors.New("MM_EMBED_DIMENSION must be > 0")) 320 } 321 // Empty selects the deterministic extractor (the same default extraction.New applies), so a Config 322 // built without an explicit provider validates. 323 switch c.Extraction.Provider { 324 case ExtractorDeterministic, "": 325 default: 326 errs = append(errs, fmt.Errorf("MM_EXTRACT_PROVIDER %q invalid (want deterministic)", c.Extraction.Provider)) 327 } 328 329 // OpenAI-compatible providers need an endpoint + model. 330 if c.Embeddings.Provider == ProviderOpenAI || c.Embeddings.Provider == ProviderAzureOpenAI { 331 if c.Embeddings.Endpoint == "" { 332 errs = append(errs, fmt.Errorf("MM_EMBED_ENDPOINT required for provider %q", c.Embeddings.Provider)) 333 } 334 if c.Embeddings.Model == "" { 335 errs = append(errs, fmt.Errorf("MM_EMBED_MODEL required for provider %q", c.Embeddings.Provider)) 336 } 337 } 338 // The MEGAMIND provider needs the gateway URL and the embed model name. 339 if c.Embeddings.Provider == ProviderMegamind { 340 if c.Embeddings.MegamindURL == "" { 341 errs = append(errs, errors.New("MM_MEGAMIND_URL required for provider \"megamind\"")) 342 } 343 if c.Embeddings.Model == "" && c.Inference.EmbedModel == "" { 344 errs = append(errs, errors.New("MM_EMBED_MODEL or MM_MEGAMIND_EMBED_MODEL required for provider \"megamind\"")) 345 } 346 } 347 348 // TOTP secrets are AES 256, so the KEK must be exactly 32 bytes whenever it is set, in any env. 349 if len(c.Auth.TOTPKEK) != 0 && len(c.Auth.TOTPKEK) != 32 { 350 errs = append(errs, errors.New("MM_TOTP_KEK must decode to exactly 32 bytes (AES 256)")) 351 } 352 if len(c.Auth.TOTPKEKPrevious) != 0 && len(c.Auth.TOTPKEKPrevious) != 32 { 353 errs = append(errs, errors.New("MM_TOTP_KEK_PREVIOUS must decode to exactly 32 bytes (AES 256)")) 354 } 355 if c.Auth.PepperVersion <= 0 { 356 errs = append(errs, errors.New("MM_CREDENTIAL_PEPPER_VERSION must be positive")) 357 } 358 if c.Auth.SessionIdleSeconds <= 0 || c.Auth.SessionAbsoluteSeconds <= 0 || c.Auth.PendingAbsoluteSeconds <= 0 { 359 errs = append(errs, errors.New("session timeout seconds must all be positive")) 360 } 361 if c.DecisionRetentionDays <= 0 { 362 errs = append(errs, errors.New("MM_DECISION_RETENTION_DAYS must be positive")) 363 } 364 365 if c.Env == EnvProduction { 366 if c.AppDatabaseURL == "" { 367 errs = append(errs, errors.New("MM_DATABASE_URL required in production")) 368 } 369 if c.Embeddings.Provider == ProviderFake { 370 errs = append(errs, errors.New("the fake embedding provider must not be used in production")) 371 } 372 if c.Cloud == CloudLocal { 373 errs = append(errs, errors.New("MM_CLOUD must be a government cloud in production")) 374 } 375 // In production the per tenant credentials must come from a managed secret store, never the env 376 // file backend (that is the dev and staging convenience). The cloud adapter is wired at deploy. 377 if c.Tenancy == TenancyPerTenant && c.Secrets.Backend == SecretsEnv { 378 errs = append(errs, errors.New("MM_SECRETS_BACKEND must be a government cloud secret store in production per_tenant mode, not env")) 379 } 380 // The dev X-Org-ID resolver may never be the production tenant source. 381 if c.AllowDevHeaderAuth { 382 errs = append(errs, errors.New("MM_ALLOW_DEV_HEADER_AUTH must be false in production")) 383 } 384 // FIPS must be enforced, not optional, so the validated crypto path is the one that runs. 385 if !c.RequireFIPS { 386 errs = append(errs, errors.New("MM_REQUIRE_FIPS must be true in production")) 387 } 388 // Every auth secret must be present so the validated crypto has its keys. 389 if len(c.Auth.Pepper) == 0 { 390 errs = append(errs, errors.New("MM_CREDENTIAL_PEPPER required in production")) 391 } 392 if len(c.Auth.TOTPKEK) != 32 { 393 errs = append(errs, errors.New("MM_TOTP_KEK (32 byte AES 256 key) required in production")) 394 } 395 if len(c.Auth.CSRFKey) == 0 { 396 errs = append(errs, errors.New("MM_CSRF_KEY required in production")) 397 } 398 if len(c.Auth.RecoveryLookupKey) == 0 { 399 errs = append(errs, errors.New("MM_RECOVERY_LOOKUP_KEY required in production")) 400 } 401 // The CSRF Origin allowlist must be enforced; an empty list disables it (a dev only path). 402 if len(c.AllowedOrigins) == 0 { 403 errs = append(errs, errors.New("MM_ALLOWED_ORIGINS required in production (the CSRF Origin allowlist must be enforced)")) 404 } 405 // Both cookies use the __Host- prefix, which a browser only accepts when Secure is set; a non 406 // Secure production deploy silently breaks all auth and exposes the token. 407 if !c.Auth.CookieSecure { 408 errs = append(errs, errors.New("MM_COOKIE_SECURE must be true in production (the __Host- cookie prefix requires Secure)")) 409 } 410 // MFA is mandatory in production. The pilot only password only relaxation can never ship to a 411 // government cloud, so a production deploy with it set is a hard configuration error. 412 if !c.Auth.MFARequired { 413 errs = append(errs, errors.New("MM_MFA_REQUIRED must be true in production (MFA is mandatory)")) 414 } 415 } 416 417 return errors.Join(errs...) 418} 419 420// IsProduction reports whether this is a production deployment. 421func (c Config) IsProduction() bool { return c.Env == EnvProduction } 422 423func getDefault(key, def string) string { 424 if v := strings.TrimSpace(os.Getenv(key)); v != "" { 425 return v 426 } 427 return def 428} 429 430func getInt(key string, def int) int { 431 if v := strings.TrimSpace(os.Getenv(key)); v != "" { 432 if n, err := strconv.Atoi(v); err == nil { 433 return n 434 } 435 } 436 return def 437} 438 439func getBool(key string, def bool) bool { 440 if v := strings.TrimSpace(os.Getenv(key)); v != "" { 441 if b, err := strconv.ParseBool(v); err == nil { 442 return b 443 } 444 } 445 return def 446} 447 448// splitCSV splits a comma separated env value into trimmed, non empty entries. 449func splitCSV(v string) []string { 450 if strings.TrimSpace(v) == "" { 451 return nil 452 } 453 parts := strings.Split(v, ",") 454 out := make([]string, 0, len(parts)) 455 for _, p := range parts { 456 if t := strings.TrimSpace(p); t != "" { 457 out = append(out, t) 458 } 459 } 460 return out 461} 462 463// getBytes loads a secret key from the environment using an EXPLICIT encoding prefix so the key 464// material is never ambiguous: "base64:", "hex:", or "raw:". A bare value (no prefix) is decoded as 465// standard base64, and a decode failure is a hard error rather than a silent fall back to the raw 466// string. The silent fall back was a real footgun: a passphrase that happens to be valid base64 would 467// be decoded to different bytes than the operator intended, so the same variable could mean two 468// different keys in two contexts (a TOTP KEK that no longer decrypts its secrets, a pepper that no 469// longer verifies its passwords). Forcing the operator to declare the encoding removes that class of 470// bug. An unset variable yields nil with no error. 471func getBytes(key string) ([]byte, error) { 472 v := strings.TrimSpace(os.Getenv(key)) 473 if v == "" { 474 return nil, nil 475 } 476 switch { 477 case strings.HasPrefix(v, "raw:"): 478 return []byte(strings.TrimPrefix(v, "raw:")), nil 479 case strings.HasPrefix(v, "hex:"): 480 b, err := hex.DecodeString(strings.TrimPrefix(v, "hex:")) 481 if err != nil { 482 return nil, fmt.Errorf("%s: invalid hex value: %w", key, err) 483 } 484 return b, nil 485 case strings.HasPrefix(v, "base64:"): 486 b, err := base64.StdEncoding.DecodeString(strings.TrimPrefix(v, "base64:")) 487 if err != nil { 488 return nil, fmt.Errorf("%s: invalid base64 value: %w", key, err) 489 } 490 return b, nil 491 default: 492 b, err := base64.StdEncoding.DecodeString(v) 493 if err != nil { 494 return nil, fmt.Errorf("%s: value must be base64, or carry a raw: / hex: / base64: prefix: %w", key, err) 495 } 496 return b, nil 497 } 498} 499