config.go

package main

import (
	"context"
	"crypto/tls"
	"errors"
	"fmt"
	"net/http"
	"net/url"
	"os"
	"runtime/debug"
	"strconv"
	"strings"
	"time"

	"github.com/go-authgate/sdk-go/credstore"
	"github.com/go-authgate/sdk-go/discovery"
	"github.com/go-authgate/sdk-go/oauth"

	retry "github.com/appleboy/go-httpretry"
	"github.com/google/uuid"
	"github.com/joho/godotenv"
	"github.com/spf13/cobra"
)

// version is set at build time via -ldflags "-X main.version=...".
var version string

// Flag variables — Cobra binding targets, read once in loadConfig/loadStoreConfig.
var (
	flagServerURL    string
	flagClientID     string
	flagClientSecret string
	flagRedirectURI  string
	flagCallbackPort int
	flagScope        string
	flagTokenFile    string
	flagTokenStore   string
	flagDevice       bool

	flagTokenExchangeTimeout     string
	flagTokenVerificationTimeout string
	flagRefreshTokenTimeout      string
	flagDeviceCodeRequestTimeout string
	flagCallbackTimeout          string
	flagUserInfoTimeout          string
	flagDiscoveryTimeout         string
	flagRevocationTimeout        string
	flagMaxResponseBodySize      string
)

const (
	defaultTokenExchangeTimeout     = 10 * time.Second
	defaultTokenVerificationTimeout = 10 * time.Second
	defaultRefreshTokenTimeout      = 10 * time.Second
	defaultDeviceCodeRequestTimeout = 10 * time.Second
	defaultCallbackTimeout          = 2 * time.Minute
	defaultUserInfoTimeout          = 10 * time.Second
	defaultDiscoveryTimeout         = 10 * time.Second
	defaultRevocationTimeout        = 10 * time.Second
	defaultMaxResponseBodySize      = 1 * 1024 * 1024 // 1 MB — guards against oversized server responses
	defaultKeyringService           = "authgate-cli"

	// maxDurationConfig caps user-supplied timeout values to prevent the CLI
	// from hanging indefinitely on misconfiguration.
	maxDurationConfig = 10 * time.Minute

	// maxResponseBodySizeCap prevents users from setting an excessively large
	// response body limit that could cause OOM via io.ReadAll.
	maxResponseBodySizeCap int64 = 100 * 1024 * 1024 // 100 MB
)

// AppConfig holds all resolved configuration for the CLI application.
type AppConfig struct {
	ServerURL      string
	ClientID       string
	ClientSecret   string
	RedirectURI    string
	CallbackPort   int
	Scope          string
	ForceDevice    bool
	TokenStoreMode string // "auto", "file", or "keyring"
	RetryClient    *retry.Client
	Store          credstore.Store[credstore.Token]

	// Endpoints holds the resolved OAuth endpoint URLs.
	// Populated by resolveEndpoints after loadConfig.
	Endpoints oauth.Endpoints

	// Timeout configuration (resolved from flag → env → default).
	// Only populated by loadConfig; zero in loadStoreConfig paths.
	TokenExchangeTimeout     time.Duration
	TokenVerificationTimeout time.Duration
	RefreshTokenTimeout      time.Duration
	DeviceCodeRequestTimeout time.Duration
	CallbackTimeout          time.Duration
	UserInfoTimeout          time.Duration
	DiscoveryTimeout         time.Duration
	RevocationTimeout        time.Duration
	MaxResponseBodySize      int64
}

// IsPublicClient returns true when no client secret is configured —
// i.e., this is a public client that must use PKCE.
func (c *AppConfig) IsPublicClient() bool {
	return c.ClientSecret == ""
}

func registerFlags(cmd *cobra.Command) {
	_ = godotenv.Load()
	cmd.PersistentFlags().
		StringVar(&flagServerURL, "server-url", "", "OAuth server URL (default: http://localhost:8080 or SERVER_URL env)")
	cmd.PersistentFlags().
		StringVar(&flagClientID, "client-id", "", "OAuth client ID (required, or set CLIENT_ID env)")
	cmd.PersistentFlags().
		StringVar(&flagClientSecret, "client-secret", "", "OAuth client secret (confidential clients only; omit for public/PKCE clients)")
	cmd.PersistentFlags().
		StringVar(&flagRedirectURI, "redirect-uri", "", "Redirect URI registered with the OAuth server (default: http://localhost:PORT/callback)")
	cmd.PersistentFlags().
		IntVar(&flagCallbackPort, "port", 0, "Local callback port for browser flow (default: 8888 or CALLBACK_PORT env)")
	cmd.PersistentFlags().
		StringVar(&flagScope, "scope", "", "Space-separated OAuth scopes (default: \"email profile\")")
	cmd.PersistentFlags().
		StringVar(&flagTokenFile, "token-file", "", "Token storage file (default: .authgate-tokens.json or TOKEN_FILE env)")
	cmd.PersistentFlags().
		StringVar(&flagTokenStore, "token-store", "", "Token storage backend: auto, file, keyring (default: auto or TOKEN_STORE env)")
	cmd.PersistentFlags().
		BoolVar(&flagDevice, "device", false, "Force Device Code Flow (skip browser detection)")
	cmd.PersistentFlags().
		StringVar(&flagTokenExchangeTimeout, "token-exchange-timeout", "", "Timeout for token exchange requests (e.g. 10s, 1m)")
	cmd.PersistentFlags().
		StringVar(&flagTokenVerificationTimeout, "token-verification-timeout", "", "Timeout for token verification requests (e.g. 10s, 1m)")
	cmd.PersistentFlags().
		StringVar(&flagRefreshTokenTimeout, "refresh-token-timeout", "", "Timeout for token refresh requests (e.g. 10s, 1m)")
	cmd.PersistentFlags().
		StringVar(&flagDeviceCodeRequestTimeout, "device-code-request-timeout", "", "Timeout for device code requests (e.g. 10s, 1m)")
	cmd.PersistentFlags().
		StringVar(&flagCallbackTimeout, "callback-timeout", "", "Timeout waiting for browser callback (e.g. 2m, 5m)")
	cmd.PersistentFlags().
		StringVar(&flagUserInfoTimeout, "userinfo-timeout", "", "Timeout for UserInfo requests (e.g. 10s, 1m)")
	cmd.PersistentFlags().
		StringVar(&flagDiscoveryTimeout, "discovery-timeout", "", "Timeout for OIDC Discovery requests (e.g. 10s, 30s)")
	cmd.PersistentFlags().
		StringVar(&flagRevocationTimeout, "revocation-timeout", "", "Timeout for token revocation requests (e.g. 10s, 1m)")
	cmd.PersistentFlags().
		StringVar(&flagMaxResponseBodySize, "max-response-body-size", "", "Maximum response body size in bytes (e.g. 1048576)")
}

// loadStoreConfig initialises only the token store and client ID — the minimum
// needed for commands like `token get` that read local credentials without
// making any network calls.
func loadStoreConfig() *AppConfig {
	cfg := &AppConfig{}

	cfg.ClientID = getConfig(flagClientID, "CLIENT_ID", "")
	cfg.TokenStoreMode = getConfig(flagTokenStore, "TOKEN_STORE", "auto")
	tokenFile := getConfig(flagTokenFile, "TOKEN_FILE", ".authgate-tokens.json")

	if cfg.ClientID == "" {
		fmt.Fprintln(os.Stderr, "Error: CLIENT_ID not set. Please provide it via:")
		fmt.Fprintln(os.Stderr, "  1. Command-line flag: --client-id=<your-client-id>")
		fmt.Fprintln(os.Stderr, "  2. Environment variable: CLIENT_ID=<your-client-id>")
		fmt.Fprintln(os.Stderr, "  3. .env file: CLIENT_ID=<your-client-id>")
		fmt.Fprintln(os.Stderr, "\nYou can find the client_id in the server startup logs.")
		os.Exit(1)
	}

	var storeErr error
	cfg.Store, storeErr = newTokenStore(cfg.TokenStoreMode, tokenFile, defaultKeyringService)
	if storeErr != nil {
		fmt.Fprintln(os.Stderr, storeErr)
		os.Exit(1)
	}

	return cfg
}

// loadConfig resolves all configuration from flags, environment, and defaults.
func loadConfig() *AppConfig {
	cfg := loadStoreConfig()

	cfg.ForceDevice = flagDevice
	cfg.ServerURL = getConfig(flagServerURL, "SERVER_URL", "http://localhost:8080")
	cfg.ClientSecret = getConfig(flagClientSecret, "CLIENT_SECRET", "")
	cfg.Scope = getConfig(flagScope, "SCOPE", "email profile")

	// Resolve callback port (int flag needs special handling).
	portStr := ""
	if flagCallbackPort != 0 {
		portStr = strconv.Itoa(flagCallbackPort)
	}
	portStr = getConfig(portStr, "CALLBACK_PORT", "8888")
	if port, err := strconv.Atoi(portStr); err != nil || port <= 0 {
		cfg.CallbackPort = 8888
	} else {
		cfg.CallbackPort = port
	}

	// Resolve redirect URI (depends on port, so compute after port is known).
	defaultRedirectURI := fmt.Sprintf("http://localhost:%d/callback", cfg.CallbackPort)
	cfg.RedirectURI = getConfig(flagRedirectURI, "REDIRECT_URI", defaultRedirectURI)

	if err := validateServerURL(cfg.ServerURL); err != nil {
		fmt.Fprintf(os.Stderr, "Error: Invalid SERVER_URL: %v\n", err)
		os.Exit(1)
	}

	if strings.HasPrefix(strings.ToLower(cfg.ServerURL), "http://") {
		fmt.Fprintln(
			os.Stderr,
			"WARNING: Using HTTP instead of HTTPS. Tokens will be transmitted in plaintext!",
		)
		fmt.Fprintln(
			os.Stderr,
			"WARNING: This is only safe for local development. Use HTTPS in production.",
		)
		fmt.Fprintln(os.Stderr)
	}

	if _, err := uuid.Parse(cfg.ClientID); err != nil {
		fmt.Fprintf(
			os.Stderr,
			"WARNING: CLIENT_ID doesn't appear to be a valid UUID: %s\n",
			cfg.ClientID,
		)
		fmt.Fprintln(os.Stderr)
	}

	baseHTTPClient := &http.Client{
		Transport: &http.Transport{
			TLSClientConfig:     &tls.Config{MinVersion: tls.VersionTLS12},
			MaxIdleConns:        10,
			IdleConnTimeout:     90 * time.Second,
			TLSHandshakeTimeout: 10 * time.Second,
		},
	}

	var err error
	cfg.RetryClient, err = retry.NewBackgroundClient(retry.WithHTTPClient(baseHTTPClient))
	if err != nil {
		fmt.Fprintf(os.Stderr, "Error: failed to create retry HTTP client: %v\n", err)
		os.Exit(1)
	}

	// Resolve timeout configuration.
	cfg.TokenExchangeTimeout = getDurationConfig(
		flagTokenExchangeTimeout, "TOKEN_EXCHANGE_TIMEOUT", defaultTokenExchangeTimeout)
	cfg.TokenVerificationTimeout = getDurationConfig(
		flagTokenVerificationTimeout, "TOKEN_VERIFICATION_TIMEOUT", defaultTokenVerificationTimeout)
	cfg.RefreshTokenTimeout = getDurationConfig(
		flagRefreshTokenTimeout, "REFRESH_TOKEN_TIMEOUT", defaultRefreshTokenTimeout)
	cfg.DeviceCodeRequestTimeout = getDurationConfig(
		flagDeviceCodeRequestTimeout,
		"DEVICE_CODE_REQUEST_TIMEOUT",
		defaultDeviceCodeRequestTimeout,
	)
	cfg.CallbackTimeout = getDurationConfig(
		flagCallbackTimeout, "CALLBACK_TIMEOUT", defaultCallbackTimeout)
	cfg.UserInfoTimeout = getDurationConfig(
		flagUserInfoTimeout, "USERINFO_TIMEOUT", defaultUserInfoTimeout)
	cfg.DiscoveryTimeout = getDurationConfig(
		flagDiscoveryTimeout, "DISCOVERY_TIMEOUT", defaultDiscoveryTimeout)
	cfg.RevocationTimeout = getDurationConfig(
		flagRevocationTimeout, "REVOCATION_TIMEOUT", defaultRevocationTimeout)
	cfg.MaxResponseBodySize = getInt64Config(
		flagMaxResponseBodySize, "MAX_RESPONSE_BODY_SIZE", defaultMaxResponseBodySize)
	if cfg.MaxResponseBodySize > maxResponseBodySizeCap {
		fmt.Fprintf(os.Stderr,
			"WARNING: MAX_RESPONSE_BODY_SIZE exceeds %d, capping\n", maxResponseBodySizeCap)
		cfg.MaxResponseBodySize = maxResponseBodySizeCap
	}

	if cfg.TokenStoreMode == "auto" {
		if ss, ok := cfg.Store.(*credstore.SecureStore[credstore.Token]); ok && !ss.UseKeyring() {
			fmt.Fprintln(
				os.Stderr,
				"WARNING: OS keyring unavailable, falling back to file-based token storage",
			)
		}
	}

	return cfg
}

// newTokenStore creates a token store backend based on the given mode.
func newTokenStore(
	mode, tokenFilePath, keyringService string,
) (credstore.Store[credstore.Token], error) {
	switch mode {
	case "file":
		return credstore.NewTokenFileStore(tokenFilePath), nil
	case "keyring":
		return credstore.NewTokenKeyringStore(keyringService), nil
	case "auto":
		return credstore.DefaultTokenSecureStore(keyringService, tokenFilePath), nil
	default:
		return nil, fmt.Errorf("invalid token store mode: %q (valid: auto, file, keyring)", mode)
	}
}

func getConfig(flagValue, envKey, defaultValue string) string {
	if flagValue != "" {
		return flagValue
	}
	return getEnv(envKey, defaultValue)
}

func getEnv(key, defaultValue string) string {
	if value := os.Getenv(key); value != "" {
		return value
	}
	return defaultValue
}

func validateServerURL(rawURL string) error {
	if rawURL == "" {
		return errors.New("server URL cannot be empty")
	}
	u, err := url.Parse(rawURL)
	if err != nil {
		return fmt.Errorf("invalid URL format: %w", err)
	}
	if u.Scheme != "http" && u.Scheme != "https" {
		return fmt.Errorf("URL scheme must be http or https, got: %s", u.Scheme)
	}
	if u.Host == "" {
		return errors.New("URL must include a host")
	}
	return nil
}

// defaultEndpoints returns hardcoded endpoint paths appended to serverURL.
// Used as fallback when OIDC Discovery is unavailable.
func defaultEndpoints(serverURL string) oauth.Endpoints {
	return oauth.Endpoints{
		AuthorizeURL:           serverURL + "/oauth/authorize",
		TokenURL:               serverURL + "/oauth/token",
		DeviceAuthorizationURL: serverURL + "/oauth/device/code",
		TokenInfoURL:           serverURL + "/oauth/tokeninfo",
		UserinfoURL:            serverURL + "/oauth/userinfo",
		RevocationURL:          serverURL + "/oauth/revoke",
	}
}

// resolveEndpoints attempts OIDC Discovery and falls back to hardcoded paths.
func resolveEndpoints(ctx context.Context, cfg *AppConfig) {
	disco, err := discovery.NewClient(
		cfg.ServerURL,
		discovery.WithHTTPClient(cfg.RetryClient),
	)
	if err != nil {
		fmt.Fprintf(os.Stderr,
			"WARNING: OIDC Discovery init failed: %v (using default endpoints)\n", err)
		cfg.Endpoints = defaultEndpoints(cfg.ServerURL)
		return
	}

	fetchCtx, cancel := context.WithTimeout(ctx, cfg.DiscoveryTimeout)
	defer cancel()

	meta, err := disco.Fetch(fetchCtx)
	if err != nil {
		fmt.Fprintf(os.Stderr,
			"WARNING: OIDC Discovery fetch failed: %v (using default endpoints)\n", err)
		cfg.Endpoints = defaultEndpoints(cfg.ServerURL)
		return
	}

	cfg.Endpoints = meta.Endpoints()
}

// getDurationConfig resolves a time.Duration from flag → env → default.
// The value is parsed with time.ParseDuration (e.g. "10s", "2m", "1m30s").
// On parse error or non-positive value, it falls back to the default and prints a warning.
func getDurationConfig(flagValue, envKey string, defaultValue time.Duration) time.Duration {
	raw := getConfig(flagValue, envKey, "")
	if raw == "" {
		return defaultValue
	}
	d, err := time.ParseDuration(raw)
	if err != nil {
		fmt.Fprintf(os.Stderr, "WARNING: invalid duration %q for %s, using default %s\n",
			raw, envKey, defaultValue)
		return defaultValue
	}
	if d <= 0 {
		fmt.Fprintf(os.Stderr, "WARNING: %s must be positive, got %s, using default %s\n",
			envKey, d, defaultValue)
		return defaultValue
	}
	if d > maxDurationConfig {
		fmt.Fprintf(os.Stderr, "WARNING: %s exceeds maximum %s, capping at %s\n",
			envKey, maxDurationConfig, maxDurationConfig)
		return maxDurationConfig
	}
	return d
}

// getInt64Config resolves an int64 from flag → env → default.
// On parse error or non-positive value, it falls back to the default and prints a warning.
func getInt64Config(flagValue, envKey string, defaultValue int64) int64 {
	raw := getConfig(flagValue, envKey, "")
	if raw == "" {
		return defaultValue
	}
	v, err := strconv.ParseInt(raw, 10, 64)
	if err != nil || v <= 0 {
		fmt.Fprintf(os.Stderr, "WARNING: invalid value %q for %s, using default %d\n",
			raw, envKey, defaultValue)
		return defaultValue
	}
	return v
}

// getVersion returns the build version, preferring the ldflags-injected value
// and falling back to debug.ReadBuildInfo().
func getVersion() string {
	if version != "" {
		return version
	}
	if build, ok := debug.ReadBuildInfo(); ok &&
		build.Main.Version != "" &&
		build.Main.Version != "(devel)" {
		return build.Main.Version
	}
	return "unknown version"
}