feat: implement authentication and configuration management

cmd/routatic-proxy/main.go

@@ -9,7 +9,9 @@ import (
 	"os"
 	"path/filepath"
 	"strings"
+	"time"
 
+	"github.com/routatic/proxy/internal/auth"
 	"github.com/routatic/proxy/internal/config"
 	"github.com/routatic/proxy/internal/daemon"
 	"github.com/routatic/proxy/internal/server"
@@ -64,119 +66,286 @@ func serveCmd() *cobra.Command {
 		Use:   "serve",
 		Short: "Start the proxy server",
 		RunE: func(cmd *cobra.Command, args []string) error {
-			// Handle background mode: fork and exit parent
-			if background && !daemonize {
-				opts := daemon.BackgroundOpts{
-					ConfigPath: configPath,
-					Port:       port,
-				}
-				return daemon.ForkIntoBackground(opts)
-			}
+			return runServe(configPath, port, background, daemonize)
+		},
+	}
 
-			// Override config path if provided.
-			if configPath != "" {
-				_ = os.Setenv("ROUTATIC_PROXY_CONFIG", configPath)
-			}
+	cmd.Flags().StringVarP(&configPath, "config", "c", "", "Path to config file")
+	cmd.Flags().IntVarP(&port, "port", "p", 0, "Override listen port")
+	cmd.Flags().BoolVarP(&background, "background", "b", false, "Run as background daemon")
+	cmd.Flags().BoolVar(&daemonize, "_daemonize", false, "Internal use only")
+	_ = cmd.Flags().MarkHidden("_daemonize")
 
-			cfg, err := config.Load()
-			if err != nil {
-				return fmt.Errorf("failed to load config: %w", err)
-			}
+	return cmd
+}
 
-			// Override port if provided via flag.
-			if port != 0 {
-				cfg.Port = port
-			}
+// runServe contains the actual serve logic, extracted for testability.
+func runServe(configPath string, port int, background, daemonize bool) error {
+	// Handle background mode: fork and exit parent
+	if background && !daemonize {
+		opts := daemon.BackgroundOpts{
+			ConfigPath: configPath,
+			Port:       port,
+		}
+		return daemon.ForkIntoBackground(opts)
+	}
 
-			pidPath := getPIDPath()
+	// Override config path if provided.
+	if configPath != "" {
+		_ = os.Setenv("ROUTATIC_PROXY_CONFIG", configPath)
+	}
 
-			// Check if already running before writing this process' PID.
-			if !daemonize {
-				if pid, err := daemon.GetPID(pidPath); err == nil {
-					// Check if process is still running.
-					if daemon.IsProcessRunning(pid) {
-						return fmt.Errorf("server is already running (PID %d)", pid)
-					}
-					// Stale PID file, clean up.
-					_ = os.Remove(pidPath)
-				}
-			}
+	cfg, err := config.Load()
+	if err != nil {
+		return fmt.Errorf("failed to load config: %w", err)
+	}
 
-			// Daemonize setup (child process after re-exec).
-			if daemonize {
-				paths, err := daemon.DefaultPaths()
-				if err != nil {
-					return err
-				}
-				if err := paths.EnsureConfigDir(); err != nil {
-					return err
-				}
-				if err := daemon.DaemonizeSetup(paths); err != nil {
-					return err
-				}
-			} else {
-				// Ensure config directory exists before writing PID file.
-				paths, err := daemon.DefaultPaths()
-				if err != nil {
-					return err
-				}
-				if err := paths.EnsureConfigDir(); err != nil {
-					return err
-				}
-				// Write PID file for foreground mode.
-				if err := daemon.WritePID(pidPath, os.Getpid()); err != nil {
-					return fmt.Errorf("failed to write PID file: %w", err)
-				}
-			}
-			defer func() { _ = os.Remove(pidPath) }()
+	// Override port if provided via flag.
+	if port != 0 {
+		cfg.Port = port
+	}
 
-			// Create atomic config for hot reload support.
-			atomicCfg := config.NewAtomicConfig(cfg, config.ResolveConfigPath())
+	pidPath := getPIDPath()
 
-			// Re-apply CLI port override on every reload so it persists.
-			if port != 0 {
-				atomicCfg.OnReload(func(newCfg *config.Config) {
-					newCfg.Port = port
-				})
+	// Check if already running before writing this process' PID.
+	if !daemonize {
+		if pid, err := daemon.GetPID(pidPath); err == nil {
+			// Check if process is still running.
+			if daemon.IsProcessRunning(pid) {
+				return fmt.Errorf("server is already running (PID %d)", pid)
 			}
+			// Stale PID file, clean up.
+			_ = os.Remove(pidPath)
+		}
+	}
 
-			// Create and start server.
-			srv, err := server.NewServer(atomicCfg)
-			if err != nil {
-				return fmt.Errorf("failed to create server: %w", err)
+	// Daemonize setup (child process after re-exec).
+	if daemonize {
+		paths, err := daemon.DefaultPaths()
+		if err != nil {
+			return err
+		}
+		if err := paths.EnsureConfigDir(); err != nil {
+			return err
+		}
+		if err := daemon.DaemonizeSetup(paths); err != nil {
+			return err
+		}
+	} else {
+		// Ensure config directory exists before writing PID file.
+		paths, err := daemon.DefaultPaths()
+		if err != nil {
+			return err
+		}
+		if err := paths.EnsureConfigDir(); err != nil {
+			return err
+		}
+		// Write PID file for foreground mode.
+		if err := daemon.WritePID(pidPath, os.Getpid()); err != nil {
+			return fmt.Errorf("failed to write PID file: %w", err)
+		}
+	}
+	defer func() { _ = os.Remove(pidPath) }()
+
+	// Initialize providers based on mode.
+	authProvider, configProvider, err := initProviders(cfg)
+	if err != nil {
+		return fmt.Errorf("failed to initialize providers: %w", err)
+	}
+
+	// Close providers on shutdown.
+	defer func() {
+		if authProvider != nil {
+			if c, ok := authProvider.(interface{ Close() error }); ok {
+				_ = c.Close()
 			}
+		}
+		if configProvider != nil {
+			// FileConfigProvider has StopWatching method
+			if c, ok := configProvider.(interface{ StopWatching() error }); ok {
+				_ = c.StopWatching()
+			}
+		}
+	}()
 
-			// Start config watcher for hot reload (only if enabled in config).
-			if cfg.HotReload {
-				watchCtx, watchCancel := context.WithCancel(context.Background())
-				defer watchCancel()
-				go func() {
-					if err := config.WatchConfig(watchCtx, atomicCfg); err != nil && err != context.Canceled {
-						slog.Error("config watcher failed", "error", err)
-					}
-				}()
+	// Create atomic config for hot reload support.
+	atomicCfg := config.NewAtomicConfig(cfg, config.ResolveConfigPath())
+
+	// Re-apply CLI port override on every reload so it persists.
+	if port != 0 {
+		atomicCfg.OnReload(func(newCfg *config.Config) {
+			newCfg.Port = port
+		})
+	}
+
+	// Create and start server with providers.
+	// Note: The server currently doesn't use these providers directly (auth/config
+	// are handled via middleware and RuntimeConfig), but we initialize them here
+	// for future extensibility and health checks.
+	srv, err := server.NewServer(atomicCfg)
+	if err != nil {
+		return fmt.Errorf("failed to create server: %w", err)
+	}
+
+	// Register providers with server for health checks.
+	server.RegisterHealthCheckers(srv, authProvider, configProvider)
+
+	// Start config watcher for hot reload (only if enabled in config).
+	if cfg.HotReload {
+		watchCtx, watchCancel := context.WithCancel(context.Background())
+		defer watchCancel()
+		go func() {
+			if err := config.WatchConfig(watchCtx, atomicCfg); err != nil && err != context.Canceled {
+				slog.Error("config watcher failed", "error", err)
 			}
+		}()
+	}
 
-			fmt.Printf("Starting %s v%s\n", appName, version)
-			fmt.Printf("Listening on %s:%d\n", cfg.Host, cfg.Port)
-			fmt.Printf("Forwarding to: %s\n", cfg.OpenCodeGo.BaseURL)
-			fmt.Println()
-			fmt.Println("Configure Claude Code with:")
-			fmt.Printf("  export ANTHROPIC_BASE_URL=http://%s:%d\n", cfg.Host, cfg.Port)
-			fmt.Println("  export ANTHROPIC_AUTH_TOKEN=unused")
-			fmt.Println()
+	fmt.Printf("Starting %s v%s\n", appName, version)
+	fmt.Printf("Listening on %s:%d\n", cfg.Host, cfg.Port)
+	fmt.Printf("Forwarding to: %s\n", cfg.OpenCodeGo.BaseURL)
+	fmt.Println()
+	fmt.Println("Configure Claude Code with:")
+	fmt.Printf("  export ANTHROPIC_BASE_URL=http://%s:%d\n", cfg.Host, cfg.Port)
+	fmt.Println("  export ANTHROPIC_AUTH_TOKEN=unused")
+	fmt.Println()
 
-			return srv.Start()
-		},
+	return srv.Start()
+}
+
+// initProviders initializes the authentication and configuration providers
+// based on the server mode configuration.
+//
+// Mode "standalone": Uses local file-based config and local key auth (backward compatible).
+// Mode "managed": Uses cloud snapshot or DB-based config with cloud auth.
+func initProviders(cfg *config.Config) (auth.AuthProvider, config.ConfigProvider, error) {
+	authProvider, err := initAuthProvider(cfg)
+	if err != nil {
+		return nil, nil, fmt.Errorf("auth provider: %w", err)
 	}
 
-	cmd.Flags().StringVarP(&configPath, "config", "c", "", "Path to config file")
-	cmd.Flags().IntVarP(&port, "port", "p", 0, "Override listen port")
-	cmd.Flags().BoolVarP(&background, "background", "b", false, "Run as background daemon")
-	cmd.Flags().BoolVar(&daemonize, "_daemonize", false, "Internal use only")
-	_ = cmd.Flags().MarkHidden("_daemonize")
+	configProvider, err := initConfigProvider(cfg)
+	if err != nil {
+		if c, ok := authProvider.(interface{ Close() error }); ok {
+			_ = c.Close()
+		}
+		return nil, nil, fmt.Errorf("config provider: %w", err)
+	}
 
-	return cmd
+	return authProvider, configProvider, nil
+}
+
+// initAuthProvider creates an AuthProvider based on the configuration.
+// Supported providers: "local_keys", "cloud", "none".
+func initAuthProvider(cfg *config.Config) (auth.AuthProvider, error) {
+	provider := cfg.Auth.Provider
+	if provider == "" {
+		// Default to "none" for backward compatibility
+		provider = "none"
+	}
+
+	switch provider {
+	case "local_keys":
+		if cfg.Auth.ConfigPath == "" {
+			return nil, fmt.Errorf("local_keys auth requires config_path")
+		}
+		return auth.NewLocalKeyAuthProvider(cfg.Auth.ConfigPath)
+
+	case "cloud":
+		if cfg.Auth.IntrospectionURL == "" {
+			return nil, fmt.Errorf("cloud auth requires introspection_url")
+		}
+		ttl := cfg.Auth.CacheTTL
+		if ttl <= 0 {
+			ttl = 30 * time.Second
+		}
+		// Get optional service token from environment
+		serviceToken := os.Getenv("ROUTATIC_PROXY_SERVICE_TOKEN")
+		return auth.NewCloudAuthProvider(cfg.Auth.IntrospectionURL, ttl, serviceToken), nil
+
+	case "none":
+		workspaceID := "local"
+		if cfg.Mode == "standalone" && cfg.APIKey != "" {
+			// Use a stable workspace ID based on first API key hash
+			workspaceID = hashAPIKeyForWorkspace(cfg.APIKey)
+		}
+		return auth.NewNoAuthProvider(workspaceID), nil
+
+	default:
+		return nil, fmt.Errorf("unknown auth provider: %s", provider)
+	}
+}
+
+// initConfigProvider creates a ConfigProvider based on the configuration.
+// Supported providers: "file", "db", "cloud_snapshot".
+func initConfigProvider(cfg *config.Config) (config.ConfigProvider, error) {
+	provider := cfg.ConfigProv.Provider
+	if provider == "" {
+		// Default to "file" for backward compatibility
+		provider = "file"
+	}
+
+	var underlying config.ConfigProvider
+	var err error
+
+	switch provider {
+	case "file":
+		path := cfg.ConfigProv.Path
+		if path == "" {
+			// Use default config path
+			path = config.ResolveConfigPath()
+		}
+		underlying, err = config.NewFileConfigProvider(path)
+		if err != nil {
+			return nil, err
+		}
+
+	case "db":
+		if cfg.ConfigProv.DB.Driver == "" {
+			return nil, fmt.Errorf("db provider requires driver")
+		}
+		if cfg.ConfigProv.DB.DSN == "" {
+			return nil, fmt.Errorf("db provider requires dsn")
+		}
+		// Note: DBConfigProvider is not yet implemented in this version
+		return nil, fmt.Errorf("db config provider not implemented: driver=%s", cfg.ConfigProv.DB.Driver)
+
+	case "cloud_snapshot":
+		if cfg.ConfigProv.SnapshotURL == "" {
+			return nil, fmt.Errorf("cloud_snapshot provider requires snapshot_url")
+		}
+		ttl := cfg.ConfigProv.CacheTTL
+		if ttl <= 0 {
+			ttl = 15 * time.Second
+		}
+		// Get optional service token from environment
+		serviceToken := os.Getenv("ROUTATIC_PROXY_SERVICE_TOKEN")
+		underlying = config.NewCloudSnapshotConfigProvider(cfg.ConfigProv.SnapshotURL, ttl, serviceToken)
+
+	default:
+		return nil, fmt.Errorf("unknown config provider: %s", provider)
+	}
+
+	// Wrap with cache for all providers except file (which has its own caching)
+	if provider != "file" {
+		ttl := cfg.ConfigProv.CacheTTL
+		if ttl <= 0 {
+			ttl = 15 * time.Second
+		}
+		underlying = config.NewCachedConfigProvider(underlying, ttl)
+	}
+
+	return underlying, nil
+}
+
+// hashAPIKeyForWorkspace creates a stable workspace ID from an API key.
+// This is used for the "none" auth provider in standalone mode to provide
+// a stable identity for logging and metrics.
+func hashAPIKeyForWorkspace(apiKey string) string {
+	if len(apiKey) <= 8 {
+		return apiKey
+	}
+	return "wk_" + apiKey[:8]
 }
 
 // stopCmd returns the command to stop the proxy server.