xinfra/server/internal/config/config.go

package config

import (
	"os"
	"strconv"
	"strings"
	"time"
)

type OAuthClient struct {
	ID           string
	Secret       string
	RedirectURIs []string
}

type Config struct {
	AppEnv                       string
	HTTPAddr                     string
	PublicBaseURL                string
	MySQLDSN                     string
	AutoMigrate                  bool
	SSOEnabled                   bool
	JWTSecret                    string
	JWTIssuer                    string
	JWTTTLMinutes                int
	SAMLEntityID                 string
	SAMLACSURL                   string
	SAMLSPCert                   string
	SAMLSPKey                    string
	SAMLIDPMetaURL               string
	SAMLLogoutURL                string
	WayenLoginURL                string
	WayenTargetURL               string
	WayenUsernameKey             string
	WayenPasswordKey             string
	WayenLoginFormat             string
	WayenLoginValue              string
	WayenOAuthRef                string
	WayenOAuthLoginURL           string
	WayneAPIBaseURL              string
	WayneAdminUsername           string
	WayneAdminPassword           string
	WayneTokenTTLMinutes         int
	WayneInternalAPIBaseURL      string
	WayneServiceName             string
	WayneServiceAPISecretKey     string
	OAuthClientID                string
	OAuthClientSecret            string
	OAuthRedirectURI             string
	OAuthCodeTTLSeconds          int
	OIDCIssuer                   string
	OIDCAuthorizeURL             string
	OIDCTokenURL                 string
	OIDCUserInfoURL              string
	OIDCJWKSURL                  string
	CloudDMClientID              string
	CloudDMClientSecret          string
	CloudDMRedirectURI           string
	CloudDMTargetURL             string
	CloudDMPublicURL             string
	CloudDMLoginURL              string
	CloudDMAdminUsername         string
	CloudDMAdminPassword         string
	CloudDMRegisterURL           string
	CloudDMDeleteURL             string
	CloudDMAPIToken              string
	CloudDMPostgreSQLRegisterURL string
	CloudDMPostgreSQLUsername    string
	CloudDMPostgreSQLPassword    string
	AWXBaseURL                   string
	AWXToken                     string
	AWXUsername                  string
	AWXPassword                  string
	AWXWebhookToken              string
	AWXFactsTemplateID           uint64
	AWXFactsTimeoutSeconds       int
	MySQLDeliveryTemplateName    string
	MySQLInspectTemplateName     string
	MySQLInspectTimeoutSeconds   int
	RollbackTemplateID           uint64
	PostgreSQLRollbackTemplateID uint64
	DeliveryServiceToken         string
	DeliverySchedulerEnabled     bool
	DeliveryDispatchSeconds      int
	DeliveryPollSeconds          int
	DeliveryCallbackBaseURL      string
	DeliveryCredentialSecret     string
	ReservationTTLMinutes        int
	DeliveryGlobalLimit          int
	DeliveryTargetLimit          int
	DeliveryHostInstanceLimit    int
	DeliveryBusinessLimit        int
	DeliveryDataDisks            []string
	SINABaseURL                  string
	SINAUsername                 string
	SINAPassword                 string
}

func Load() Config {
	loadDotEnv(".env")
	httpAddr := env("HTTP_ADDR", ":8080")
	publicBaseURL := env("PUBLIC_BASE_URL", defaultPublicBaseURL(httpAddr))
	samlEntityID := env("SAML_ENTITY_ID", strings.TrimRight(publicBaseURL, "/")+"/auth/api/v1/saml/metadata")
	samlACSURL := env("SAML_ACS_URL", strings.TrimRight(publicBaseURL, "/")+"/auth/api/v1/saml/acs")
	oidcIssuer := env("OIDC_ISSUER", strings.TrimRight(publicBaseURL, "/")+"/auth")
	oidcIssuer = strings.TrimRight(oidcIssuer, "/")

	return Config{
		AppEnv:                       env("APP_ENV", "dev"),
		HTTPAddr:                     httpAddr,
		PublicBaseURL:                publicBaseURL,
		MySQLDSN:                     env("MYSQL_DSN", "auth:auth@tcp(127.0.0.1:3306)/authserver?charset=utf8mb4&parseTime=True&loc=Local"),
		AutoMigrate:                  envBool("AUTO_MIGRATE", true),
		SSOEnabled:                   envBool("SSO_ENABLED", true),
		JWTSecret:                    env("JWT_SECRET", "change-this-secret"),
		JWTIssuer:                    env("JWT_ISSUER", "authserver"),
		JWTTTLMinutes:                envInt("JWT_TTL_MINUTES", 120),
		SAMLEntityID:                 samlEntityID,
		SAMLACSURL:                   samlACSURL,
		SAMLSPCert:                   env("SAML_SP_CERT_FILE", "certs/sp.crt"),
		SAMLSPKey:                    env("SAML_SP_KEY_FILE", "certs/sp.key"),
		SAMLIDPMetaURL:               env("SAML_IDP_METADATA_URL", "http://sso-internal.dev.qiniu.io/saml2/meta"),
		SAMLLogoutURL:                trimURL(env("SAML_LOGOUT_URL", "")),
		WayenLoginURL:                env("WAYEN_LOGIN_URL", ""),
		WayenTargetURL:               env("WAYEN_TARGET_URL", ""),
		WayenUsernameKey:             env("WAYEN_USERNAME_KEY", "email"),
		WayenPasswordKey:             env("WAYEN_PASSWORD_KEY", "password"),
		WayenLoginFormat:             env("WAYEN_LOGIN_FORMAT", "form"),
		WayenLoginValue:              env("WAYEN_LOGIN_VALUE", "email"),
		WayenOAuthRef:                env("WAYEN_OAUTH_REF", "/portal/namespace/1/app"),
		WayenOAuthLoginURL:           trimURL(env("WAYEN_OAUTH_LOGIN_URL", "")),
		WayneAPIBaseURL:              trimURL(env("WAYNE_API_BASE_URL", env("WAYNE_INTERNAL_API_BASE_URL", ""))),
		WayneAdminUsername:           env("WAYNE_ADMIN_USERNAME", ""),
		WayneAdminPassword:           env("WAYNE_ADMIN_PASSWORD", ""),
		WayneTokenTTLMinutes:         envInt("WAYNE_TOKEN_TTL_MINUTES", 1440),
		WayneInternalAPIBaseURL:      trimURL(env("WAYNE_INTERNAL_API_BASE_URL", "")),
		WayneServiceName:             env("WAYNE_SERVICE_NAME", "xinfra"),
		WayneServiceAPISecretKey:     env("WAYNE_SERVICE_API_SECRET_KEY", ""),
		OAuthClientID:                env("OAUTH_WAYNE_CLIENT_ID", "wayne"),
		OAuthClientSecret:            env("OAUTH_WAYNE_CLIENT_SECRET", "wayne-secret"),
		OAuthRedirectURI:             env("OAUTH_WAYNE_REDIRECT_URI", ""),
		OAuthCodeTTLSeconds:          envInt("OAUTH_CODE_TTL_SECONDS", 120),
		OIDCIssuer:                   oidcIssuer,
		OIDCAuthorizeURL:             trimURL(env("OIDC_AUTHORIZATION_ENDPOINT", oidcIssuer+"/oauth/authorize")),
		OIDCTokenURL:                 trimURL(env("OIDC_TOKEN_ENDPOINT", oidcIssuer+"/oauth/token")),
		OIDCUserInfoURL:              trimURL(env("OIDC_USERINFO_ENDPOINT", oidcIssuer+"/oauth/userinfo")),
		OIDCJWKSURL:                  trimURL(env("OIDC_JWKS_URI", oidcIssuer+"/oauth/jwks")),
		CloudDMClientID:              env("OIDC_CLOUDDM_CLIENT_ID", "clouddm"),
		CloudDMClientSecret:          env("OIDC_CLOUDDM_CLIENT_SECRET", ""),
		CloudDMRedirectURI:           env("OIDC_CLOUDDM_REDIRECT_URI", ""),
		CloudDMTargetURL:             env("CLOUDDM_TARGET_URL", ""),
		CloudDMPublicURL:             trimURL(env("CLOUDDM_PUBLIC_URL", "")),
		CloudDMLoginURL:              trimURL(env("CLOUDDM_LOGIN_URL", "")),
		CloudDMAdminUsername:         env("CLOUDDM_ADMIN_USERNAME", ""),
		CloudDMAdminPassword:         env("CLOUDDM_ADMIN_PASSWORD", ""),
		CloudDMRegisterURL:           trimURL(env("CLOUDDM_REGISTER_URL", "")),
		CloudDMDeleteURL:             trimURL(env("CLOUDDM_DELETE_URL", "")),
		CloudDMAPIToken:              env("CLOUDDM_API_TOKEN", ""),
		CloudDMPostgreSQLRegisterURL: trimURL(env("CLOUDDM_POSTGRESQL_REGISTER_URL", "")),
		CloudDMPostgreSQLUsername:    env("CLOUDDM_POSTGRESQL_USERNAME", "postgres"),
		CloudDMPostgreSQLPassword:    env("CLOUDDM_POSTGRESQL_PASSWORD", ""),
		AWXBaseURL:                   trimURL(env("AWX_BASE_URL", "")),
		AWXToken:                     env("AWX_TOKEN", ""),
		AWXUsername:                  env("AWX_USERNAME", ""),
		AWXPassword:                  env("AWX_PASSWORD", ""),
		AWXWebhookToken:              env("AWX_WEBHOOK_TOKEN", ""),
		AWXFactsTemplateID:           envUint64("AWX_FACTS_TEMPLATE_ID", 0),
		AWXFactsTimeoutSeconds:       envInt("AWX_FACTS_TIMEOUT_SECONDS", 45),
		MySQLDeliveryTemplateName:    env("DELIVERY_MYSQL_TEMPLATE_NAME", "XINFRA MySQL Native Prototype"),
		MySQLInspectTemplateName:     env("DELIVERY_MYSQL_INSPECT_TEMPLATE_NAME", "XINFRA MySQL Inspect"),
		MySQLInspectTimeoutSeconds:   envInt("DELIVERY_MYSQL_INSPECT_TIMEOUT_SECONDS", 90),
		RollbackTemplateID:           uint64(envInt("DELIVERY_ROLLBACK_TEMPLATE_ID", 0)),
		PostgreSQLRollbackTemplateID: uint64(envInt("DELIVERY_POSTGRESQL_ROLLBACK_TEMPLATE_ID", 0)),
		DeliveryServiceToken:         env("DELIVERY_SERVICE_TOKEN", ""),
		DeliverySchedulerEnabled:     envBool("DELIVERY_SCHEDULER_ENABLED", false),
		DeliveryDispatchSeconds:      envInt("DELIVERY_DISPATCH_SECONDS", 5),
		DeliveryPollSeconds:          envInt("DELIVERY_POLL_SECONDS", 5),
		DeliveryCallbackBaseURL:      trimURL(env("DELIVERY_CALLBACK_BASE_URL", publicBaseURL)),
		DeliveryCredentialSecret:     env("DELIVERY_CREDENTIAL_SECRET", env("JWT_SECRET", "change-this-secret")),
		ReservationTTLMinutes:        envInt("DELIVERY_RESERVATION_TTL_MINUTES", 120),
		DeliveryGlobalLimit:          envInt("DELIVERY_GLOBAL_LIMIT", 2),
		DeliveryTargetLimit:          envInt("DELIVERY_TARGET_LIMIT", 2),
		DeliveryHostInstanceLimit:    envInt("DELIVERY_HOST_INSTANCE_LIMIT", 4),
		DeliveryBusinessLimit:        envInt("DELIVERY_BUSINESS_LIMIT", 1),
		DeliveryDataDisks:            splitCSV(env("DELIVERY_DATA_DISKS", "/data,/disk1,/mnt,/opt/mysql-delivery")),
		SINABaseURL:                  trimURL(env("SINA_BASE_URL", "https://sinai.qiniu.io:443")),
		SINAUsername:                 env("SINA_USERNAME", ""),
		SINAPassword:                 env("SINA_PASSWORD", ""),
	}
}

func loadDotEnv(path string) {
	content, err := os.ReadFile(path)
	if err != nil {
		return
	}
	lines := strings.Split(string(content), "\n")
	for _, line := range lines {
		line = strings.TrimSpace(line)
		if line == "" || strings.HasPrefix(line, "#") {
			continue
		}
		key, value, ok := strings.Cut(line, "=")
		if !ok {
			continue
		}
		key = strings.TrimSpace(key)
		value = strings.Trim(strings.TrimSpace(value), `"'`)
		if key == "" || os.Getenv(key) != "" {
			continue
		}
		_ = os.Setenv(key, value)
	}
}

func (c Config) JWTTTL() time.Duration {
	return time.Duration(c.JWTTTLMinutes) * time.Minute
}

func (c Config) OAuthCodeTTL() time.Duration {
	return time.Duration(c.OAuthCodeTTLSeconds) * time.Second
}

func (c Config) OAuthClients() map[string]OAuthClient {
	clients := make(map[string]OAuthClient)
	addOAuthClient(clients, c.OAuthClientID, c.OAuthClientSecret, c.OAuthRedirectURI)
	addOAuthClient(clients, c.CloudDMClientID, c.CloudDMClientSecret, c.CloudDMRedirectURI)
	return clients
}

func addOAuthClient(clients map[string]OAuthClient, id, secret, redirectURIs string) {
	id = strings.TrimSpace(id)
	secret = strings.TrimSpace(secret)
	if id == "" || secret == "" {
		return
	}
	clients[id] = OAuthClient{
		ID:           id,
		Secret:       secret,
		RedirectURIs: splitCSV(redirectURIs),
	}
}

func splitCSV(value string) []string {
	parts := strings.Split(value, ",")
	items := make([]string, 0, len(parts))
	for _, part := range parts {
		part = strings.TrimSpace(part)
		if part != "" {
			items = append(items, part)
		}
	}
	return items
}

func trimURL(value string) string {
	return strings.TrimRight(strings.TrimSpace(value), "/")
}

func env(key, fallback string) string {
	value := os.Getenv(key)
	if value == "" {
		return fallback
	}
	return value
}

func envBool(key string, fallback bool) bool {
	value := os.Getenv(key)
	if value == "" {
		return fallback
	}
	parsed, err := strconv.ParseBool(value)
	if err != nil {
		return fallback
	}
	return parsed
}

func envInt(key string, fallback int) int {
	value := os.Getenv(key)
	if value == "" {
		return fallback
	}
	parsed, err := strconv.Atoi(value)
	if err != nil {
		return fallback
	}
	return parsed
}

func envUint64(key string, fallback uint64) uint64 {
	value := os.Getenv(key)
	if value == "" {
		return fallback
	}
	parsed, err := strconv.ParseUint(value, 10, 64)
	if err != nil {
		return fallback
	}
	return parsed
}

func defaultPublicBaseURL(httpAddr string) string {
	addr := strings.TrimSpace(httpAddr)
	if addr == "" {
		return "http://localhost:8080"
	}
	if strings.HasPrefix(addr, ":") {
		return "http://localhost" + addr
	}
	return "http://" + addr
}