Split Config

Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>

pkg/probod/auth_config.go

@@ -26,6 +26,16 @@ type (
 		DisableSignup bool           `json:"disable-signup"`
 	}
 
+	trustAuthConfig struct {
+		CookieName     string `json:"cookie-name"`
+		CookieDomain   string `json:"cookie-domain"`
+		CookieDuration int    `json:"cookie-duration"`
+		TokenDuration  int    `json:"token-duration"`
+		TokenSecret    string `json:"token-secret"`
+		Scope          string `json:"scope"`
+		TokenType      string `json:"token-type"`
+	}
+
 	cookieConfig struct {
 		Domain   string `json:"domain"`
 		Secret   string `json:"secret"`
@@ -76,3 +86,22 @@ func (c authConfig) GetCookieSecretBytes() ([]byte, error) {
 
 	return []byte(c.Cookie.Secret), nil
 }
+
+func (c trustAuthConfig) GetTokenSecretBytes() ([]byte, error) {
+	if c.TokenSecret == "" {
+		return nil, fmt.Errorf("token secret cannot be empty")
+	}
+
+	if decoded, err := base64.StdEncoding.DecodeString(c.TokenSecret); err == nil {
+		if len(decoded) < 32 {
+			return nil, fmt.Errorf("decoded token secret must be at least 32 bytes long")
+		}
+		return decoded, nil
+	}
+
+	if len(c.TokenSecret) < 32 {
+		return nil, fmt.Errorf("token secret must be at least 32 bytes long")
+	}
+
+	return []byte(c.TokenSecret), nil
+}

pkg/probod/probod.go

@@ -59,6 +59,7 @@ type (
 		Pg            pgConfig             `json:"pg"`
 		Api           apiConfig            `json:"api"`
 		Auth          authConfig           `json:"auth"`
+		TrustAuth     trustAuthConfig      `json:"trust-auth"`
 		AWS           awsConfig            `json:"aws"`
 		Mailer        mailerConfig         `json:"mailer"`
 		Connectors    []connectorConfig    `json:"connectors"`
@@ -100,6 +101,15 @@ func New() *Implm {
 				},
 				DisableSignup: false,
 			},
+			TrustAuth: trustAuthConfig{
+				CookieName:     "TCT",
+				CookieDomain:   "localhost",
+				CookieDuration: 24,
+				TokenDuration:  168,
+				TokenSecret:    "this-is-a-secure-secret-for-trust-token-signing-at-least-32-bytes",
+				Scope:          "trust_center_readonly",
+				TokenType:      "trust_center_access",
+			},
 			AWS: awsConfig{
 				Region: "us-east-1",
 				Bucket: "probod",
@@ -157,6 +167,12 @@ func (impl *Implm) Run(
 		return fmt.Errorf("cannot get cookie secret bytes: %w", err)
 	}
 
+	_, err = impl.cfg.TrustAuth.GetTokenSecretBytes()
+	if err != nil {
+		rootSpan.RecordError(err)
+		return fmt.Errorf("cannot get trust auth token secret bytes: %w", err)
+	}
+
 	awsConfig := awsconfig.NewConfig(
 		l,
 		httpclient.DefaultPooledClient(
@@ -203,6 +219,12 @@ func (impl *Implm) Run(
 		ModelName:    impl.cfg.OpenAI.ModelName,
 	}
 
+	trustConfig := probo.TrustConfig{
+		TokenSecret:   impl.cfg.TrustAuth.TokenSecret,
+		TokenDuration: time.Duration(impl.cfg.TrustAuth.TokenDuration) * time.Hour,
+		TokenType:     impl.cfg.TrustAuth.TokenType,
+	}
+
 	agent := agents.NewAgent(l.Named("agent"), agentConfig)
 
 	usrmgrService, err := usrmgr.NewService(
@@ -225,6 +247,7 @@ func (impl *Implm) Run(
 		impl.cfg.AWS.Bucket,
 		impl.cfg.Hostname,
 		impl.cfg.Auth.Cookie.Secret,
+		trustConfig,
 		agentConfig,
 		html2pdfConverter,
 		usrmgrService,
@@ -238,7 +261,7 @@ func (impl *Implm) Run(
 		s3Client,
 		impl.cfg.AWS.Bucket,
 		impl.cfg.EncryptionKey,
-		impl.cfg.Auth.Cookie.Secret,
+		impl.cfg.TrustAuth.TokenSecret,
 		usrmgrService,
 		html2pdfConverter,
 	)
@@ -254,12 +277,21 @@ func (impl *Implm) Run(
 			Agent:             agent,
 			SafeRedirect:      &saferedirect.SafeRedirect{AllowedHost: impl.cfg.Hostname},
 			Logger:            l.Named("http.server"),
-			Auth: api.AuthConfig{
+			Auth: api.ConsoleAuthConfig{
 				CookieName:      impl.cfg.Auth.Cookie.Name,
 				CookieDomain:    impl.cfg.Auth.Cookie.Domain,
 				SessionDuration: time.Duration(impl.cfg.Auth.Cookie.Duration) * time.Hour,
 				CookieSecret:    impl.cfg.Auth.Cookie.Secret,
 			},
+			TrustAuth: api.TrustAuthConfig{
+				CookieName:     impl.cfg.TrustAuth.CookieName,
+				CookieDomain:   impl.cfg.TrustAuth.CookieDomain,
+				CookieDuration: time.Duration(impl.cfg.TrustAuth.CookieDuration) * time.Hour,
+				TokenDuration:  time.Duration(impl.cfg.TrustAuth.TokenDuration) * time.Hour,
+				TokenSecret:    impl.cfg.TrustAuth.TokenSecret,
+				Scope:          impl.cfg.TrustAuth.Scope,
+				TokenType:      impl.cfg.TrustAuth.TokenType,
+			},
 		},
 	)
 	if err != nil {