thermograph/backend/daemon/internal/config/config.go

// Package config loads and validates the daemon's environment. All knobs are
// env vars because the daemon runs as a sibling container to the web service
// and shares its /etc/thermograph.env — a config file would be a second source
// of truth for the same values.
package config

import (
	"crypto/hmac"
	"crypto/sha256"
	"encoding/hex"
	"errors"
	"os"
	"strconv"
	"strings"
	"time"
)

// Defaults mirror the Python scheduler they replace (notifications/scheduler.py):
// warm-cities daily — a warm cache mostly stays warm, and every already-cached
// city is a cheap skip; IndexNow every 6h — submit_if_changed() is a no-op when
// nothing changed, so it can tick more often without spending anything.
const (
	DefaultWarmCitiesIntervalHours = 24
	DefaultIndexNowIntervalHours   = 6
)

// Config is the daemon's fully-resolved configuration. Construct it only via
// Load so the required/optional split is enforced in one place.
type Config struct {
	// InternalToken is the shared secret sent as X-Thermograph-Internal-Token
	// on every callback into Python. Required: if it is unset the web app
	// disables its /internal/* routes (fail closed), so a daemon without it
	// could only ever fail every call — better to refuse to start.
	InternalToken string

	// APIBase is the in-network base URL of the FastAPI app (e.g.
	// http://web:8137). Same env var the frontend already uses for its
	// server-side calls, so there is one name for "where is the backend".
	APIBase string

	// DiscordEnabled gates the gateway connection. Off by default: a gateway
	// connection is a new persistent behaviour, so it takes an explicit opt-in
	// (THERMOGRAPH_DISCORD_BOT truthy AND a token) rather than piggybacking on
	// the token being present for DMs.
	DiscordEnabled bool

	// DiscordToken is the bot token; only meaningful when DiscordEnabled.
	DiscordToken string

	// DiscordGuildMentions gates whether an @mention in a *server channel* gets
	// a grade card from us. On by default — that is the behaviour this daemon
	// shipped with.
	//
	// It exists because the same bot identity can be answered for from two
	// places. The operator's desktop runs a conversational agent that replies as
	// this account (see the discord-voice-bot repo, AGENTS.md); it grades through
	// the same API we do, and can also hold a conversation. With both live, one
	// mention gets two answers. Setting THERMOGRAPH_DISCORD_BOT_MENTIONS to a
	// falsey value hands the channel surface to that agent.
	//
	// DMs are unaffected and always answered here: the agent polls guild
	// channels only, so a DM has no other responder. The /grade slash command is
	// a separate HTTP path and keeps working either way — which matters, because
	// it is then what still answers while the desktop is asleep.
	DiscordGuildMentions bool

	WarmCitiesInterval time.Duration
	IndexNowInterval   time.Duration
}

// truthy matches the Python side's _TRUTHY set exactly, so the same env file
// enables/disables the bot regardless of which process reads it.
func truthy(s string) bool {
	switch strings.ToLower(strings.TrimSpace(s)) {
	case "1", "true", "yes", "on":
		return true
	}
	return false
}

// truthyDefault is truthy for a knob that has a non-false default: unset (or
// whitespace) keeps the default, anything else is read normally. Distinguishing
// "unset" from "set to something falsey" is the whole point — plain truthy()
// would silently read an absent var as off.
func truthyDefault(s string, def bool) bool {
	if strings.TrimSpace(s) == "" {
		return def
	}
	return truthy(s)
}

// intervalHours parses an interval env var. A malformed or non-positive value
// falls back to the default rather than erroring — mirrors the Python
// `int(os.environ.get(..., "24") or 24)` behaviour where a bad knob degrades
// to the documented default instead of taking the process down.
func intervalHours(raw string, def int) time.Duration {
	hours := def
	if v := strings.TrimSpace(raw); v != "" {
		if n, err := strconv.Atoi(v); err == nil && n > 0 {
			hours = n
		}
	}
	return time.Duration(hours) * time.Hour
}

// Load reads the environment and returns a validated Config, or an error that
// should abort startup. The daemon must never run half-configured: a missing
// token or API base means every callback would fail, silently, forever.
func Load() (*Config, error) {
	return load(os.Getenv)
}

// load takes a getenv func so tests can inject an environment without mutating
// the real one.
func load(getenv func(string) string) (*Config, error) {
	cfg := &Config{
		InternalToken: strings.TrimSpace(getenv("THERMOGRAPH_INTERNAL_TOKEN")),
		APIBase:       strings.TrimSpace(getenv("THERMOGRAPH_API_BASE_INTERNAL")),
		DiscordToken:  strings.TrimSpace(getenv("THERMOGRAPH_DISCORD_BOT_TOKEN")),
	}
	if cfg.InternalToken == "" {
		cfg.InternalToken = deriveInternalToken(strings.TrimSpace(getenv("THERMOGRAPH_AUTH_SECRET")))
	}
	if cfg.InternalToken == "" {
		return nil, errors.New("neither THERMOGRAPH_INTERNAL_TOKEN nor THERMOGRAPH_AUTH_SECRET is set; refusing to start (the web app disables /internal/* without a token, so every callback would fail)")
	}
	if cfg.APIBase == "" {
		return nil, errors.New("THERMOGRAPH_API_BASE_INTERNAL is not set; refusing to start (no way to reach the backend)")
	}
	// The gateway needs both the opt-in flag and a token; missing either just
	// disables it — the cron half is still worth running on its own.
	cfg.DiscordEnabled = truthy(getenv("THERMOGRAPH_DISCORD_BOT")) && cfg.DiscordToken != ""
	// Defaults on when unset: this is a switch for turning existing behaviour
	// off, so an env file that has never heard of it must keep working.
	cfg.DiscordGuildMentions = truthyDefault(getenv("THERMOGRAPH_DISCORD_BOT_MENTIONS"), true)

	cfg.WarmCitiesInterval = intervalHours(getenv("THERMOGRAPH_WARM_CITIES_INTERVAL_HOURS"), DefaultWarmCitiesIntervalHours)
	cfg.IndexNowInterval = intervalHours(getenv("THERMOGRAPH_INDEXNOW_INTERVAL_HOURS"), DefaultIndexNowIntervalHours)
	return cfg, nil
}

// deriveLabel is the domain-separation label for the derived internal token.
// It MUST match backend/api/internal_routes.py's _DERIVE_LABEL byte-for-byte,
// or the daemon and the web app compute different tokens and every callback
// 401s. TestDeriveInternalTokenMatchesPython pins the pair to a shared vector.
const deriveLabel = "thermograph/internal-api/v1"

// deriveInternalToken computes the shared secret from THERMOGRAPH_AUTH_SECRET,
// which every environment already provisions. This is what lets the daemon
// stand up with no new vault entry and no operator step -- one less secret to
// rotate, leak, or forget on a new host. An explicit THERMOGRAPH_INTERNAL_TOKEN
// still wins when set.
//
// HMAC under a distinct label rather than reusing the auth secret directly:
// ordinary domain separation, so a leak of this token cannot be replayed as the
// session-signing key it came from, and the derivation is one-way.
//
// Returns "" for an empty secret, which the caller turns into a refusal to
// start. It must never silently invent a token: the web app would have derived
// a different one (or none), and every call would fail as an auth error rather
// than as the missing configuration it actually is.
func deriveInternalToken(authSecret string) string {
	if authSecret == "" {
		return ""
	}
	mac := hmac.New(sha256.New, []byte(authSecret))
	mac.Write([]byte(deriveLabel))
	return hex.EncodeToString(mac.Sum(nil))
}