fix: security & privacy (rate limiter fix, csrf session cookie, logout on server, drafts stale token passw, login timing, password over 72b, JWT_SECRET complexity, SMTP TLS, CSV export neutralised, fonts bundled, upload metadata, hourly cleanup job, privacy.md report)

internal/infrastructure/config/securitySettings.go

@@ -0,0 +1,39 @@
+package config
+
+import (
+	"errors"
+	"fmt"
+	"os"
+)
+
+const (
+	EnvJWTSecret             = "JWT_SECRET"
+	MinJWTSecretBytes        = 32
+	EnvSmtpAllowInsecure     = "SMTP_ALLOW_INSECURE"
+	DefaultSmtpAllowInsecure = "false"
+)
+
+var ErrWeakJWTSecret = errors.New("JWT_SECRET is too weak")
+
+var placeholderJWTSecrets = map[string]bool{
+	"change-me-to-a-long-random-string":          true,
+	"replace-with-output-of-openssl-rand-hex-32": true,
+}
+
+func ValidateJWTSecret(secret string) error {
+	if placeholderJWTSecrets[secret] {
+		return fmt.Errorf("%w: it is still the example value; generate one with `openssl rand -hex 32`", ErrWeakJWTSecret)
+	}
+	if len(secret) < MinJWTSecretBytes {
+		return fmt.Errorf("%w: it must be at least %d bytes long; generate one with `openssl rand -hex 32`", ErrWeakJWTSecret, MinJWTSecretBytes)
+	}
+	return nil
+}
+
+func jwtSecretFromEnv() (string, error) {
+	secret := os.Getenv(EnvJWTSecret)
+	if err := ValidateJWTSecret(secret); err != nil {
+		return "", err
+	}
+	return secret, nil
+}