Connect sign-up to Sendico Facts intake (#46)

backend/product/providers/sendico/config.go

@@ -0,0 +1,87 @@
+// Package sendico consumes only Sendico's public HTTP contracts.
+package sendico
+
+import (
+	"crypto/sha256"
+	"encoding/base64"
+	"encoding/hex"
+	"encoding/json"
+	"net/http"
+	"net/url"
+	"os"
+	"strings"
+	"time"
+
+	merrors "git.sendico.io/tech/sxchnge/shared/errors"
+	"go.mongodb.org/mongo-driver/v2/bson"
+)
+
+type Config struct {
+	APIURL         string `yaml:"api_url"`
+	OrganizationID string `yaml:"organization_ref"`
+	SourceID       string `yaml:"source_account_ref"`
+	TokenFile      string `yaml:"token_file"`
+}
+
+type Client struct {
+	config    Config
+	base      string
+	namespace string
+	http      *http.Client
+}
+
+func Open(c Config) (*Client, error) {
+	u, err := url.Parse(c.APIURL)
+	if err != nil || u.Host == "" || u.User != nil || u.RawQuery != "" || u.Fragment != "" || u.RawPath != "" || (u.Scheme != "https" && !(u.Scheme == "http" && (u.Hostname() == "localhost" || u.Hostname() == "127.0.0.1"))) {
+		return nil, merrors.InvalidArgument("Sendico API URL must be absolute HTTPS (HTTP allowed on localhost)")
+	}
+	for _, ref := range []string{c.OrganizationID, c.SourceID} {
+		id, err := bson.ObjectIDFromHex(ref)
+		if err != nil || id.IsZero() || ref != id.Hex() {
+			return nil, merrors.InvalidArgument("Sendico organization and source references must be lowercase object IDs")
+		}
+	}
+	if strings.TrimSpace(c.TokenFile) == "" {
+		return nil, merrors.InvalidArgument("Sendico token file required")
+	}
+	base := strings.TrimRight(c.APIURL, "/")
+	hash := sha256.Sum256([]byte(base + "\x00" + c.OrganizationID + "\x00" + c.SourceID))
+	client := &Client{config: c, base: base, namespace: hex.EncodeToString(hash[:]), http: &http.Client{Timeout: 4 * time.Second, CheckRedirect: func(*http.Request, []*http.Request) error { return http.ErrUseLastResponse }}}
+	if _, err := client.token(); err != nil {
+		return nil, err
+	}
+	return client, nil
+}
+
+func (c *Client) Namespace() string { return c.namespace }
+
+// Rotation may replace this file, but must retain the authenticated account.
+// Claim inspection only protects the replay namespace from operator mistakes;
+// Sendico remains responsible for signature validation and authorization.
+func (c *Client) token() (string, error) {
+	raw, err := os.ReadFile(c.config.TokenFile)
+	if err != nil {
+		return "", merrors.OpaqueWrap(merrors.ErrServiceUnavailable, err, "read Sendico credential")
+	}
+	token := strings.TrimSpace(string(raw))
+	parts := strings.Split(token, ".")
+	if len(token) > 16384 || len(parts) != 3 {
+		return "", merrors.FailedPrecondition("invalid Sendico credential")
+	}
+	claims, err := base64.RawURLEncoding.DecodeString(parts[1])
+	if err != nil {
+		return "", merrors.OpaqueWrap(merrors.ErrFailedPrecondition, err, "invalid Sendico credential claims")
+	}
+	var payload struct {
+		ID      string `json:"id"`
+		Pending bool   `json:"pending"`
+		Exp     int64  `json:"exp"`
+	}
+	if err := json.Unmarshal(claims, &payload); err != nil {
+		return "", merrors.OpaqueWrap(merrors.ErrFailedPrecondition, err, "invalid Sendico credential claims")
+	}
+	if payload.ID != c.config.SourceID || payload.Pending || payload.Exp <= time.Now().Unix() {
+		return "", merrors.FailedPrecondition("Sendico credential must be unexpired and match configured source account")
+	}
+	return token, nil
+}