40 lines
1003 B
Go
40 lines
1003 B
Go
package config
|
|
|
|
import (
|
|
"errors"
|
|
"fmt"
|
|
"os"
|
|
)
|
|
|
|
const (
|
|
EnvJWTSecret = "JWT_SECRET"
|
|
MinJWTSecretBytes = 32
|
|
EnvSmtpAllowInsecure = "SMTP_ALLOW_INSECURE"
|
|
DefaultSmtpAllowInsecure = "false"
|
|
)
|
|
|
|
var ErrWeakJWTSecret = errors.New("JWT_SECRET is too weak")
|
|
|
|
var placeholderJWTSecrets = map[string]bool{
|
|
"change-me-to-a-long-random-string": true,
|
|
"replace-with-output-of-openssl-rand-hex-32": true,
|
|
}
|
|
|
|
func ValidateJWTSecret(secret string) error {
|
|
if placeholderJWTSecrets[secret] {
|
|
return fmt.Errorf("%w: it is still the example value; generate one with `openssl rand -hex 32`", ErrWeakJWTSecret)
|
|
}
|
|
if len(secret) < MinJWTSecretBytes {
|
|
return fmt.Errorf("%w: it must be at least %d bytes long; generate one with `openssl rand -hex 32`", ErrWeakJWTSecret, MinJWTSecretBytes)
|
|
}
|
|
return nil
|
|
}
|
|
|
|
func jwtSecretFromEnv() (string, error) {
|
|
secret := os.Getenv(EnvJWTSecret)
|
|
if err := ValidateJWTSecret(secret); err != nil {
|
|
return "", err
|
|
}
|
|
return secret, nil
|
|
}
|