2010 | Use a Library for Reading Configuration from Environment Variables

esignet-service/.env.example

@@ -4,8 +4,10 @@
 # Copy this file to .env and adjust values for your environment:
 #   cp .env.example .env
 #
-# make.sh loads .env automatically when present.
-# Precedence: VAR=VALUE on the command line > .env > shell environment > defaults.
+# make.sh loads .env into the environment before starting the service, so these
+# values apply to `go run`, the binary, and tests. For Docker/CI, pass the same
+# variables through your usual mechanism. Variables already set in the real
+# environment always take precedence over .env.
 # ─────────────────────────────────────────────────────────────────────────────
 
 # ── HTTP / ThunderID engine ───────────────────────────────────────────────────
@@ -53,14 +55,14 @@ OIDC_UI_ERROR_PATH=/error
 
 # ── PostgreSQL (client management persistence) ────────────────────────────────
 # Option A: full DSN (takes precedence over individual vars)
-# POSTGRES_URL=postgres://esignet:secret@localhost:5432/mosip_esignet?sslmode=disable
+# DATABASE_URL=postgres://esignet:secret@localhost:5432/mosip_esignet?sslmode=disable
 
 # Option B: individual connection params
 DATABASE_HOST=localhost
 DATABASE_PORT=5432
 DATABASE_NAME=mosip_esignet
 DATABASE_USERNAME=esignet
-# DB_DBUSER_PASSWORD=secret
+# DATABASE_PASSWORD=secret
 
 # Connection pool tuning (optional — defaults shown)
 # DB_MAX_OPEN_CONNS=25

esignet-service/README.md

@@ -60,12 +60,14 @@ The checked-in `go.mod` `replace` directive pins a Thunder backend fork until th
 ### Quick start (development)
 
 ```bash
-cp .env.example .env          # fill in DATABASE_* / DB_DBUSER_PASSWORD and REDIS_* at minimum
+cp .env.example .env          # fill in DATABASE_* and REDIS_* at minimum
 ./make.sh run
 ```
 
 Copy `.env.example` to `.env` to override defaults, or pass overrides on the command line (`./make.sh run PORT=9090`).
 
+`make.sh` loads `.env` from the working directory into the environment before starting the service, so it applies to `go run`, the built binary, and tests. The service itself only reads variables already present in the environment; for Docker/CI, supply them through your usual mechanism. Real environment variables already set always take precedence over `.env`.
+
 ### Binary
 
 ```bash
@@ -75,7 +77,7 @@ export PORT=8088
 export MOSIP_ESIGNET_HOST=http://127.0.0.1:8088
 export DATABASE_HOST=localhost
 export DATABASE_USERNAME=esignet
-export DB_DBUSER_PASSWORD=secret
+export DATABASE_PASSWORD=secret
 export DATABASE_NAME=mosip_esignet
 export REDIS_HOST=localhost
 export AUTHN_PROVIDER=mosip
@@ -139,12 +141,12 @@ Authorize redirects are sent to the Thunder gate client:
 
 | Variable | Default | Purpose |
 |----------|---------|---------|
-| `POSTGRES_URL` | _(empty)_ | Full DSN — takes precedence if set |
+| `DATABASE_URL` | _(empty)_ | Full DSN — takes precedence if set |
 | `DATABASE_HOST` | `localhost` | |
 | `DATABASE_PORT` | `5432` | |
 | `DATABASE_NAME` | `mosip_esignet` | |
 | `DATABASE_USERNAME` | `postgres` | |
-| `DB_DBUSER_PASSWORD` | _(empty)_ | |
+| `DATABASE_PASSWORD` | _(empty)_ | |
 | `DB_MAX_OPEN_CONNS` | `25` | Max open connections |
 | `DB_MAX_IDLE_CONNS` | `5` | Max idle connections |
 | `DB_CONN_MAX_LIFETIME_SECS` | `300` | Connection lifetime |
@@ -339,7 +341,7 @@ curl -s http://127.0.0.1:8088/health
 docker run --rm -p 8088:8088 \
   -e MOSIP_ESIGNET_HOST=http://127.0.0.1:8088 \
   -e CRYPTO_ENCRYPTION_KEY=your-64-char-hex-key \
-  -e POSTGRES_URL=postgres://esignet:secret@host.docker.internal:5432/mosip_esignet?sslmode=disable \
+  -e DATABASE_URL=postgres://esignet:secret@host.docker.internal:5432/mosip_esignet?sslmode=disable \
   -e REDIS_URL=redis://host.docker.internal:6379/0 \
   -e AUTHN_PROVIDER=mosip \
   esignet:latest

esignet-service/cmd/esignet/main.go

@@ -2,20 +2,28 @@
 package main
 
 import (
-	"context"
+	"fmt"
 	"net/http"
 
 	"github.com/thunder-id/thunderid/pkg/thunderidengine"
+	"github.com/thunder-id/thunderid/pkg/thunderidengine/providers"
 
 	"github.com/mosip/esignet/internal/clientmgmt"
 	"github.com/mosip/esignet/internal/config"
 	"github.com/mosip/esignet/internal/engine"
+	"github.com/mosip/esignet/internal/engine/shared"
 	applog "github.com/mosip/esignet/internal/log"
 )
 
 func main() {
 	logger := applog.GetLogger()
-	appCfg := config.LoadAppConfig()
+	appCfg, err := config.LoadAppConfig()
+	if err != nil {
+		logger.Fatal("failed to load app config", applog.Error(err))
+	}
+	if err := config.ApplyEnvOverrides(appCfg); err != nil {
+		logger.Fatal("failed to apply env overrides", applog.Error(err))
+	}
 
 	pgConn, err := appCfg.DB.Open()
 	if err != nil {
@@ -63,48 +71,47 @@ func main() {
 	})
 	clientHandler.RegisterRoutes(mux, scopeMW)
 
-	hostCfg := engine.LoadConfig()
-	thunderCfg, executors, err := engine.BuildThunderConfig(appCfg)
-	if err != nil {
-		logger.Fatal("build thunder config", applog.Error(err))
-	}
-	certFile, keyFile, err := engine.PKIPaths(appCfg.DataDir)
-	if err != nil {
-		logger.Fatal("signing key paths", applog.Error(err))
-	}
-	actorProvider := engine.NewActorProvider(clientSvc, hostCfg)
-	roleProvider := engine.NewRoleProvider()
-	logger.Info("authn provider selected", applog.String("provider", hostCfg.Provider))
-	authnProvider, err := engine.NewAuthnProviderFromConfig(hostCfg.Provider, clientSvc)
+	authnProvider, err := engine.NewAuthnProvider(appCfg.Provider, appCfg, clientSvc)
 	if err != nil {
 		logger.Fatal("authn provider", applog.Error(err))
 	}
+	logger.Info("authn provider selected", applog.String("provider", appCfg.Provider))
 
-	eng, err := thunderidengine.New(
-		thunderidengine.WithRedis(redisClient, appCfg.Redis.KeyPrefix),
-		thunderidengine.WithConfig(appCfg.DataDir, thunderCfg),
-		thunderidengine.WithPKIKey("default-key", certFile, keyFile),
-		thunderidengine.WithHostActorProvider(actorProvider),
-		thunderidengine.WithHostAuthnProvider(authnProvider),
-		thunderidengine.WithHostRoleProvider(roleProvider),
-		thunderidengine.WithExecutorDependencies(thunderidengine.ExecutorDependencies{
-			ConsentEnforcer: engine.NewConsentEnforcer(),
-		}),
-		thunderidengine.WithEnabledExecutors(executors...),
-		thunderidengine.WithCustomExecutors(engine.CustomExecutors(authnProvider, hostCfg.Provider)),
+	_ = thunderidengine.New(mux,
+		thunderidengine.WithServerHome(appCfg.DataDir),
+		thunderidengine.WithServerConfig(appCfg.Server),
+		thunderidengine.WithCacheConfig(appCfg.Cache),
+		thunderidengine.WithOAuthConfig(appCfg.OAuth),
+		thunderidengine.WithJWTConfig(appCfg.JWT),
+		thunderidengine.WithFlowConfig(appCfg.Flow),
+		thunderidengine.WithObservabilityConfig(appCfg.Observability),
+		thunderidengine.WithActorProvider(engine.NewActorProvider(clientSvc, appCfg)),
+		thunderidengine.WithAuthnProvider(authnProvider),
+		thunderidengine.WithAuthorizationProvider(engine.NewAuthorizationProvider(appCfg)),
+		thunderidengine.WithConsentProvider(engine.NewConsentEnforcer()),
+		thunderidengine.WithDesignResolveProvider(engine.NewDesignProvider(appCfg)),
+		thunderidengine.WithFlowProvider(engine.NewFlowProvider(appCfg)),
+		thunderidengine.WithI18nProvider(engine.NewI18nProvider(appCfg)),
+		thunderidengine.WithOUProvider(engine.NewOUProvider(appCfg)),
+		thunderidengine.WithResourceProvider(engine.NewResourceProvider(appCfg)),
+		thunderidengine.WithObservabilityProvider(engine.NewObservabilityProvider(appCfg.Observability)),
+		thunderidengine.WithCustomExecutors(getCustomExecutors(authnProvider)),
 	)
-	if err != nil {
-		logger.Fatal("initialize engine", applog.Error(err))
-	}
-	defer func() { _ = eng.Shutdown(context.Background()) }()
-
-	if err := eng.RegisterRoutes(mux); err != nil {
-		logger.Fatal("register engine routes", applog.Error(err))
-	}
 
-	addr := ":" + appCfg.Port
+	addr := fmt.Sprintf(":%d", appCfg.Port)
 	logger.Info("server listening", applog.String("addr", addr), applog.String("issuer", appCfg.Issuer))
 	if err := http.ListenAndServe(addr, mux); err != nil {
 		logger.Fatal("server", applog.Error(err))
 	}
 }
+
+// CustomExecutors returns embedder-supplied flow executors keyed by executor name.
+func getCustomExecutors(authn providers.AuthnProviderManager) map[string]providers.Executor {
+	otpAuthn, ok := authn.(shared.ConsolidatedAuthnProvider)
+	if !ok {
+		return map[string]providers.Executor{}
+	}
+	return map[string]providers.Executor{
+		engine.ExecutorNameMosipOTP: engine.NewMosipOtpExecutor(otpAuthn),
+	}
+}