bd62fcb599
Apps run on different hostnames (crm.gosec.internal, chronos.gosec.internal, …) so the browser fetch from <AppShell> to shell-api.gosec.internal is cross-origin and was being blocked. Add Fiber's cors middleware. Allowlist: any *.gosec.internal or *.gosec.cloud origin (override via CORS_ORIGINS env if a tighter list is needed). Allow Authorization + Content-Type + If-None-Match on the request side; expose ETag on the response side. Methods limited to GET + OPTIONS. Image: v0.1.4 Verified: curl -X OPTIONS https://shell-api.gosec.internal/api/v1/shell/gsc-crm -H "Origin: https://crm.gosec.internal" → 204 with access-control-allow-origin: https://crm.gosec.internal Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
52 lines
1.4 KiB
Go
52 lines
1.4 KiB
Go
package config
|
|
|
|
import (
|
|
"fmt"
|
|
"os"
|
|
"strconv"
|
|
)
|
|
|
|
// Config holds runtime configuration. All values come from env.
|
|
type Config struct {
|
|
Port int
|
|
DatabaseURL string
|
|
KeycloakIssuer string // e.g. https://auth.gosec.cloud/realms/gosecCloud
|
|
KeycloakDiscovery string // optional in-cluster discovery URL override
|
|
KeycloakAudCSV string // comma-separated allowed audiences (client_id values)
|
|
CacheTTLSeconds int // for client-side Cache-Control hint
|
|
CORSAllowOrigins string // comma-separated; empty = allow *.gosec.internal/*.gosec.cloud
|
|
}
|
|
|
|
func Load() (*Config, error) {
|
|
c := &Config{
|
|
Port: 8080,
|
|
KeycloakIssuer: os.Getenv("KEYCLOAK_ISSUER"),
|
|
KeycloakDiscovery: os.Getenv("KEYCLOAK_DISCOVERY_URL"),
|
|
KeycloakAudCSV: os.Getenv("KEYCLOAK_AUDIENCES"),
|
|
DatabaseURL: os.Getenv("DATABASE_URL"),
|
|
CacheTTLSeconds: 60,
|
|
CORSAllowOrigins: os.Getenv("CORS_ORIGINS"),
|
|
}
|
|
if p := os.Getenv("PORT"); p != "" {
|
|
v, err := strconv.Atoi(p)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("PORT: %w", err)
|
|
}
|
|
c.Port = v
|
|
}
|
|
if t := os.Getenv("CACHE_TTL_SECONDS"); t != "" {
|
|
v, err := strconv.Atoi(t)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("CACHE_TTL_SECONDS: %w", err)
|
|
}
|
|
c.CacheTTLSeconds = v
|
|
}
|
|
if c.DatabaseURL == "" {
|
|
return nil, fmt.Errorf("DATABASE_URL is required")
|
|
}
|
|
if c.KeycloakIssuer == "" {
|
|
return nil, fmt.Errorf("KEYCLOAK_ISSUER is required")
|
|
}
|
|
return c, nil
|
|
}
|