1use anyhow::{Result, anyhow};
2use secrecy::SecretString;
3
4use super::{
5 AuthConfig, DEFAULT_AUTHENTICATION_TIMEOUT_MS, DEFAULT_MAX_PRE_AUTH_WEBSOCKET_SESSIONS,
6 DEFAULT_MAX_PRE_AUTH_WEBSOCKET_SESSIONS_PER_ORIGIN, DeadlineDuration,
7 env::{Env, positive},
8};
9use crate::runtime::auth::decode_signing_key;
10
11impl AuthConfig {
12 pub(super) fn from_env(env: &Env<'_>) -> Result<Self> {
13 Ok(Self {
14 key: env
15 .var("AUTH_KEY")
16 .or_load_from_file("AUTH_KEY_FILE")
17 .check(validate_auth_key)
18 .required()?,
19 authentication_timeout: env.var("AUTHENTICATION_TIMEOUT_MS").default(
20 DeadlineDuration::from_millis(DEFAULT_AUTHENTICATION_TIMEOUT_MS)?,
21 )?,
22 max_pre_auth_websocket_sessions: env
23 .var("MAX_PRE_AUTH_WEBSOCKET_SESSIONS")
24 .check(positive)
25 .default(DEFAULT_MAX_PRE_AUTH_WEBSOCKET_SESSIONS)?,
26 max_pre_auth_websocket_sessions_per_origin: env
27 .var("MAX_PRE_AUTH_WEBSOCKET_SESSIONS_PER_ORIGIN")
28 .check(positive)
29 .default(DEFAULT_MAX_PRE_AUTH_WEBSOCKET_SESSIONS_PER_ORIGIN)?,
30 })
31 }
32}
33
34fn validate_auth_key(key: &'static str, value: SecretString) -> Result<SecretString> {
35 decode_signing_key(&value).map_err(|error| anyhow!("{key}: {error}"))?;
36 Ok(value)
37}