query-orchestration/internal/cognitoauth/config.go

package cognitoauth

import (
	"fmt"
	"log"
	"log/slog"
	"os"
	"strings"
)

// Config holds the configuration for AWS Cognito
// Contains all necessary parameters to interact with Cognito endpoints
type Config struct {
	ClientID         string              // OAuth2 client ID registered with Cognito
	RedirectURI      string              // URL where Cognito redirects after authentication
	TokenURL         string              // Cognito endpoint for token operations
	JwksURL          string              // URL for JSON Web Key Set (for token verification)
	UserPoolID       string              // Cognito User Pool ID
	AuthURL          string              // Cognito authorization endpoint for initiating login
	ClientSecret     string              // Client secret for authenticated clients
	Region           string              // AWS region where the Cognito User Pool is located
	LoginPath        string              // Path for initiating login
	CallbackPath     string              // Path for OAuth callback
	HomePath         string              // Path for home page
	LogoutPath       string              // Path for logout
	Logger           *slog.Logger        // Logger instance
	RoutePermissions map[string][]string // Map of routes to required permissions
}

// NewConfigFromEnv creates a new Config from environment variables
func NewConfigFromEnv(baseURL string, logger *slog.Logger) *Config {
	// Set default logger if not provided
	if logger == nil {
		var logLevel slog.Level
		if os.Getenv("DEBUG") == "true" {
			logLevel = slog.LevelDebug
		} else {
			logLevel = slog.LevelInfo
		}

		logHandler := slog.NewTextHandler(os.Stdout, &slog.HandlerOptions{
			Level: logLevel,
		})
		logger = slog.New(logHandler)
	}

	// Set paths with defaults
	loginPath := os.Getenv("COGNITO_LOGIN_PATH")
	if loginPath == "" {
		loginPath = "/login"
	}

	callbackPath := os.Getenv("COGNITO_CALLBACK_PATH")
	if callbackPath == "" {
		callbackPath = "/login-callback"
	}

	homePath := os.Getenv("COGNITO_HOME_PATH")
	if homePath == "" {
		homePath = "/home"
	}

	logoutPath := os.Getenv("COGNITO_LOGOUT_PATH")
	if logoutPath == "" {
		logoutPath = "/logout"
	}

	// Get AWS region with fallback
	region := os.Getenv("AWS_REGION")
	if region == "" {
		region = "us-east-2" // Fallback to default value
	}

	// Get User Pool ID with fallback
	userPoolID := os.Getenv("COGNITO_USER_POOL_ID")
	if userPoolID == "" {
		userPoolID = "" // No default, will need to be provided
		logger.Warn("COGNITO_USER_POOL_ID environment variable is not set")
	}

	// Get Cognito domain
	domain := os.Getenv("COGNITO_DOMAIN")
	if domain == "" {
		//logger.Warn("COGNITO_DOMAIN environment variable is not set, using default")
		//// Use the user pool ID directly as part of the domain
		//domain = fmt.Sprintf("%s.auth.%s.amazoncognito.com", userPoolID, region)
		log.Fatalf("COGNITO_DOMAIN environment variable is not set")
	}

	// Ensure domain format is correct (no protocol prefix)
	domain = strings.TrimPrefix(domain, "https://")
	domain = strings.TrimPrefix(domain, "http://")

	// Sanitize base URL (remove trailing slash)
	baseURL = strings.TrimSuffix(baseURL, "/")

	config := &Config{
		ClientID:         os.Getenv("COGNITO_CLIENT_ID"),
		ClientSecret:     os.Getenv("COGNITO_CLIENT_SECRET"),
		RedirectURI:      baseURL + callbackPath,
		TokenURL:         fmt.Sprintf("https://%s/oauth2/token", domain),
		AuthURL:          fmt.Sprintf("https://%s/oauth2/authorize", domain),
		JwksURL:          fmt.Sprintf("https://cognito-idp.%s.amazonaws.com/%s/.well-known/jwks.json", region, userPoolID),
		UserPoolID:       userPoolID,
		Region:           region,
		LoginPath:        loginPath,
		CallbackPath:     callbackPath,
		HomePath:         homePath,
		LogoutPath:       logoutPath,
		Logger:           logger,
		RoutePermissions: make(map[string][]string),
	}

	config.PrettyPrint()
	return config
}

func (c *Config) PrettyPrint() {
	fmt.Printf("Config:\n")
	fmt.Printf("  ClientID: %s\n", c.ClientID)
	fmt.Printf("  ClientSecret: %s\n", c.ClientSecret)
	fmt.Printf("  RedirectURI: %s\n", c.RedirectURI)
	fmt.Printf("  TokenURL: %s\n", c.TokenURL)
	fmt.Printf("  AuthURL: %s\n", c.AuthURL)
	fmt.Printf("  JwksURL: %s\n", c.JwksURL)
	fmt.Printf("  UserPoolID: %s\n", c.UserPoolID)
	fmt.Printf("  Region: %s\n", c.Region)
	fmt.Printf("  LoginPath: %s\n", c.LoginPath)
	fmt.Printf("  CallbackPath: %s\n", c.CallbackPath)
	fmt.Printf("  HomePath: %s\n", c.HomePath)
	fmt.Printf("  LogoutPath: %s\n", c.LogoutPath)

	// pretty print the route permissions map
	for route, permissions := range c.RoutePermissions {
		fmt.Printf("  Route: %s, Permissions: %v\n", route, permissions)
	}

}

// SetRoutePermissions sets the route permissions map
func (c *Config) SetRoutePermissions(permissions map[string][]string) {
	c.RoutePermissions = permissions
}