config.ts

import * as v from "valibot";
import { randomBytes } from "node:crypto";
import { existsSync, readFileSync } from "node:fs";
import { mkdir, writeFile } from "node:fs/promises";
import { homedir } from "node:os";
import { dirname, join } from "node:path";

const EnvSchema = v.object({
  XDG_CONFIG_HOME: v.optional(v.pipe(v.string(), v.minLength(1))),
  XDG_STATE_HOME: v.optional(v.pipe(v.string(), v.minLength(1))),
});

export type OpsHarborControlPlaneEnv = v.InferOutput<typeof EnvSchema>;

export type OpsHarborControlPlaneConfig = {
  port: number;
  dbPath: string;
  githubAppId?: string;
  githubPrivateKey?: string;
  githubWebhookSecret?: string;
  githubTunnelDisabled: boolean;
  githubTunnelHost?: string;
  internalApiToken?: string;
  githubApiUrl: string;
  defaultAuthor?: string;
};

export type StoredOpsHarborControlPlaneConfig = {
  port?: number;
  dbPath?: string;
  githubAppId?: string;
  githubPrivateKey?: string;
  githubWebhookSecret?: string;
  githubTunnelDisabled?: boolean;
  githubTunnelHost?: string;
  internalApiToken?: string;
  githubApiUrl?: string;
  defaultAuthor?: string;
};

const StoredConfigSchema = v.object({
  port: v.optional(v.pipe(v.number(), v.integer(), v.minValue(1), v.maxValue(65_535))),
  dbPath: v.optional(v.pipe(v.string(), v.minLength(1))),
  githubAppId: v.optional(v.pipe(v.string(), v.minLength(1))),
  githubPrivateKey: v.optional(v.pipe(v.string(), v.minLength(1))),
  githubWebhookSecret: v.optional(v.pipe(v.string(), v.minLength(1))),
  githubTunnelDisabled: v.optional(v.boolean()),
  githubTunnelHost: v.optional(v.pipe(v.string(), v.minLength(1))),
  internalApiToken: v.optional(v.pipe(v.string(), v.minLength(1))),
  githubApiUrl: v.optional(v.pipe(v.string(), v.minLength(1))),
  defaultAuthor: v.optional(v.pipe(v.string(), v.minLength(1))),
});

export function readProcessEnv(env: NodeJS.ProcessEnv = process.env): OpsHarborControlPlaneEnv {
  return v.parse(EnvSchema, env);
}

function configPath(env: OpsHarborControlPlaneEnv): string {
  return join(
    env.XDG_CONFIG_HOME ?? join(homedir(), ".config"),
    "ops-harbor",
    "control-plane.json",
  );
}

function normalizeStoredConfig(
  config: v.InferOutput<typeof StoredConfigSchema>,
): StoredOpsHarborControlPlaneConfig {
  return {
    ...(config.port !== undefined ? { port: config.port } : {}),
    ...(config.dbPath ? { dbPath: config.dbPath } : {}),
    ...(config.githubAppId ? { githubAppId: config.githubAppId } : {}),
    ...(config.githubPrivateKey ? { githubPrivateKey: config.githubPrivateKey } : {}),
    ...(config.githubWebhookSecret ? { githubWebhookSecret: config.githubWebhookSecret } : {}),
    ...(config.githubTunnelDisabled !== undefined
      ? { githubTunnelDisabled: config.githubTunnelDisabled }
      : {}),
    ...(config.githubTunnelHost ? { githubTunnelHost: config.githubTunnelHost } : {}),
    ...(config.internalApiToken ? { internalApiToken: config.internalApiToken } : {}),
    ...(config.githubApiUrl ? { githubApiUrl: config.githubApiUrl } : {}),
    ...(config.defaultAuthor ? { defaultAuthor: config.defaultAuthor } : {}),
  };
}

export function loadStoredConfig(
  env: OpsHarborControlPlaneEnv = readProcessEnv(),
): StoredOpsHarborControlPlaneConfig {
  const path = configPath(env);
  if (!existsSync(path)) {
    return {};
  }

  try {
    return normalizeStoredConfig(
      v.parse(StoredConfigSchema, JSON.parse(readFileSync(path, "utf-8"))),
    );
  } catch (e) {
    // ENOENT is guarded by existsSync above. Remaining errors are JSON parse
    // or schema failures from a corrupt config file. Log and return defaults
    // so the control plane can still start and write a fresh config.
    console.error("[ops-harbor-control-plane] loadStoredConfig: failed to parse config:", e);
    return {};
  }
}

function generateWebhookSecret(): string {
  return randomBytes(32).toString("hex");
}

function shouldProvisionWebhookSecret(config: StoredOpsHarborControlPlaneConfig): boolean {
  return Boolean(config.githubAppId && config.githubPrivateKey);
}

export async function saveStoredConfig(
  config: StoredOpsHarborControlPlaneConfig,
  env: OpsHarborControlPlaneEnv = readProcessEnv(),
): Promise<StoredOpsHarborControlPlaneConfig> {
  const current = loadStoredConfig(env);
  const parsed = normalizeStoredConfig(v.parse(StoredConfigSchema, config));
  const resolved: StoredOpsHarborControlPlaneConfig = {
    ...parsed,
    ...(shouldProvisionWebhookSecret(parsed)
      ? {
          githubWebhookSecret:
            parsed.githubWebhookSecret ?? current.githubWebhookSecret ?? generateWebhookSecret(),
        }
      : {}),
  };
  const path = configPath(env);
  await mkdir(dirname(path), { recursive: true });
  await writeFile(path, `${JSON.stringify(resolved, null, 2)}\n`, {
    encoding: "utf-8",
    mode: 0o600,
  });
  return resolved;
}

export async function ensureStoredConfigSecrets(
  env: OpsHarborControlPlaneEnv = readProcessEnv(),
): Promise<StoredOpsHarborControlPlaneConfig> {
  const stored = loadStoredConfig(env);
  if (!shouldProvisionWebhookSecret(stored) || stored.githubWebhookSecret) {
    return stored;
  }

  return saveStoredConfig(stored, env);
}

export function readConfig(
  env: OpsHarborControlPlaneEnv = readProcessEnv(),
): OpsHarborControlPlaneConfig {
  const stored = loadStoredConfig(env);

  return {
    port: stored.port ?? 4130,
    dbPath:
      stored.dbPath ??
      join(
        env.XDG_STATE_HOME ?? join(homedir(), ".local", "state"),
        "ops-harbor",
        "control-plane.db",
      ),
    githubApiUrl: stored.githubApiUrl ?? "https://api.github.com",
    githubTunnelDisabled: stored.githubTunnelDisabled ?? false,
    ...(stored.githubAppId ? { githubAppId: stored.githubAppId } : {}),
    ...(stored.githubPrivateKey ? { githubPrivateKey: stored.githubPrivateKey } : {}),
    ...(stored.githubWebhookSecret ? { githubWebhookSecret: stored.githubWebhookSecret } : {}),
    ...(stored.githubTunnelHost ? { githubTunnelHost: stored.githubTunnelHost } : {}),
    ...(stored.internalApiToken ? { internalApiToken: stored.internalApiToken } : {}),
    ...(stored.defaultAuthor ? { defaultAuthor: stored.defaultAuthor } : {}),
  };
}