gochat/backend/internal/config/validator.go

package config

import (
	"fmt"
	"net/url"
	"strconv"
	"strings"
	"time"
)

// Validate checks the configuration for required fields and valid values.
// Similar to Chatwoot's config validation in config/initializers.
func Validate(cfg *Config) error {
	// Server validation
	if cfg.Server.Port < 1 || cfg.Server.Port > 65535 {
		return fmt.Errorf("invalid server port: %d", cfg.Server.Port)
	}
	if cfg.Server.Mode != "debug" && cfg.Server.Mode != "release" && cfg.Server.Mode != "test" {
		return fmt.Errorf("invalid server mode: %s (must be debug, release, or test)", cfg.Server.Mode)
	}

	// Database validation (ref: Chatwoot requires POSTGRES_* env vars)
	if cfg.Database.DSN == "" {
		return fmt.Errorf("database DSN is required")
	}
	dbURL, err := url.Parse(cfg.Database.DSN)
	if err != nil {
		return fmt.Errorf("invalid database DSN: %w", err)
	}
	if dbURL.Scheme != "postgres" && dbURL.Scheme != "postgresql" {
		return fmt.Errorf("invalid database DSN: scheme must be postgres or postgresql, got %s", dbURL.Scheme)
	}
	if dbURL.Host == "" {
		return fmt.Errorf("invalid database DSN: host is required")
	}

	// Redis validation (ref: Chatwoot config/cable.yml requires Redis connection)
	if cfg.Redis.DSN == "" {
		return fmt.Errorf("redis DSN is required")
	}
	redisURL, err := url.Parse(cfg.Redis.DSN)
	if err != nil {
		return fmt.Errorf("invalid redis DSN: %w", err)
	}
	if redisURL.Scheme != "redis" && redisURL.Scheme != "rediss" {
		return fmt.Errorf("invalid redis DSN: scheme must be redis or rediss, got %s", redisURL.Scheme)
	}
	if redisURL.Host == "" {
		return fmt.Errorf("invalid redis DSN: host is required")
	}

	// JWT validation
	if cfg.Server.Mode == "release" {
		if cfg.JWT.AllowInsecureHeaderAuth {
			return fmt.Errorf("insecure header authentication is not allowed in release mode")
		}
		if err := validateProductionJWTSecret("JWT secret", cfg.JWT.Secret); err != nil {
			return err
		}
		seen := map[string]bool{cfg.JWT.Secret: true}
		for _, secret := range cfg.JWT.PreviousSecrets {
			if err := validateProductionJWTSecret("previous JWT secret", secret); err != nil {
				return err
			}
			if seen[secret] {
				return fmt.Errorf("previous JWT secrets must be unique and differ from the active secret")
			}
			seen[secret] = true
		}
	}

	// Log validation
	validLogLevels := map[string]bool{"debug": true, "info": true, "warn": true, "error": true}
	if !validLogLevels[cfg.Log.Level] {
		return fmt.Errorf("invalid log level: %s", cfg.Log.Level)
	}

	// Worker validation (ref: Chatwoot sidekiq.yml concurrency check)
	if cfg.Worker.Concurrency < 1 {
		return fmt.Errorf("worker concurrency must be >= 1")
	}
	if cfg.Worker.BlockTimeoutS < 1 {
		return fmt.Errorf("worker.redis_block_timeout_s must be >= 1")
	}
	if cfg.Worker.SweepIntervalS < 1 {
		return fmt.Errorf("worker.redis_sweep_interval_s must be >= 1")
	}

	// Search validation. Meilisearch is the production parity engine; db remains
	// available only as an explicit development fallback.
	engine := strings.ToLower(cfg.Search.Engine)
	if engine == "" {
		engine = "meilisearch"
	}
	if engine != "meilisearch" && engine != "db" {
		return fmt.Errorf("invalid search engine: %s (must be meilisearch or db)", cfg.Search.Engine)
	}
	if engine == "db" && cfg.Server.Mode == "release" {
		return fmt.Errorf("search.engine=db is only allowed for local development; release mode requires meilisearch")
	}
	if engine == "meilisearch" {
		if cfg.Search.Host == "" {
			return fmt.Errorf("search.host is required when search.engine=meilisearch")
		}
		searchURL, err := url.Parse(cfg.Search.Host)
		if err != nil || searchURL.Scheme == "" || searchURL.Host == "" {
			return fmt.Errorf("invalid search.host: %s", cfg.Search.Host)
		}
	}
	if cfg.Search.TimeoutSeconds < 0 {
		return fmt.Errorf("search.timeout_seconds must be >= 0")
	}

	if cfg.Server.Mode == "release" {
		if len(cfg.Server.CORS.AllowedOrigins) == 0 || containsPlaceholder(strings.Join(cfg.Server.CORS.AllowedOrigins, ",")) {
			return fmt.Errorf("production CORS origins are required and must not contain placeholders")
		}
		if dbURL.User == nil || dbURL.User.Username() == "" {
			return fmt.Errorf("production database credentials are required")
		}
		if password, ok := dbURL.User.Password(); !ok || password == "" || containsPlaceholder(password) {
			return fmt.Errorf("production database password is required and must not contain placeholders")
		}
		sslMode := dbURL.Query().Get("sslmode")
		if !(dbURL.Hostname() == "postgres" && sslMode == "disable") && sslMode != "require" && sslMode != "verify-ca" && sslMode != "verify-full" {
			return fmt.Errorf("production database DSN must use sslmode=require, verify-ca, or verify-full (sslmode=disable is only allowed for the built-in postgres service)")
		}
		if redisURL.User == nil {
			return fmt.Errorf("production Redis credentials are required")
		}
		if password, ok := redisURL.User.Password(); !ok || password == "" || containsPlaceholder(password) {
			return fmt.Errorf("production Redis password is required and must not contain placeholders")
		}
		if len(cfg.Search.APIKey) < 16 || containsPlaceholder(cfg.Search.APIKey) {
			return fmt.Errorf("production search API key must be at least 16 bytes and must not contain placeholders")
		}
	}

	return nil
}

func containsPlaceholder(value string) bool {
	value = strings.ToLower(value)
	return strings.Contains(value, "change_me") || strings.Contains(value, "change-me") || strings.Contains(value, "changeme")
}

func validateProductionJWTSecret(name, secret string) error {
	secret = strings.TrimSpace(secret)
	if len([]byte(secret)) < 32 {
		return fmt.Errorf("%s must be at least 32 bytes (256 bits) in release mode", name)
	}
	normalized := strings.NewReplacer("-", "_", " ", "_").Replace(strings.ToLower(secret))
	for _, placeholder := range []string{"change_me", "changeme", "change_in_production", "replace_me", "your_jwt_secret", "default_secret", "example_secret", "test_secret", "quickstart"} {
		if strings.Contains(normalized, placeholder) {
			return fmt.Errorf("%s contains a common placeholder", name)
		}
	}
	return nil
}

// ParseStatementTimeout converts the string timeout to time.Duration.
func ParseStatementTimeout(timeout string) (time.Duration, error) {
	if timeout == "" {
		return 14 * time.Second, nil
	}

	// Handle plain seconds (e.g., "14s")
	if secs, err := strconv.Atoi(timeout); err == nil {
		return time.Duration(secs) * time.Second, nil
	}

	// Handle Go duration format (e.g., "14s", "500ms")
	d, err := time.ParseDuration(timeout)
	if err != nil {
		return 0, fmt.Errorf("invalid statement_timeout format: %s", timeout)
	}
	return d, nil
}