soma_auth/

config.rs

use std::collections::HashMap;
use std::path::PathBuf;
use std::time::Duration;

use serde::{Deserialize, Serialize};
use url::Url;

use crate::at_rest::TokenEncryptionKey;
use crate::error::AuthError;

#[path = "config_machine_clients.rs"]
mod config_machine_clients;
#[path = "config_providers.rs"]
mod config_providers;

pub use config_machine_clients::{EnterpriseIssuerConfig, MachineClientConfig};
pub use config_providers::{AutheliaConfig, GitHubConfig, GoogleConfig};
use config_providers::{
    default_authelia_callback_path, default_authelia_scopes, default_github_callback_path,
    default_github_scopes, default_google_scopes,
};

const DEFAULT_CALLBACK_PATH: &str = "/auth/google/callback";
const DEFAULT_AUTH_DB_NAME: &str = "auth.db";
const DEFAULT_KEY_NAME: &str = "auth-jwt.pem";
const DEFAULT_ACCESS_TOKEN_TTL_SECS: u64 = 3600;
const DEFAULT_REFRESH_TOKEN_TTL_SECS: u64 = 30 * 24 * 3600;
const DEFAULT_AUTH_CODE_TTL_SECS: u64 = 300;
const DEFAULT_REGISTER_REQUESTS_PER_MINUTE: u32 = 20;
const DEFAULT_AUTHORIZE_REQUESTS_PER_MINUTE: u32 = 60;
const DEFAULT_TOKEN_REQUESTS_PER_MINUTE: u32 = 120;
const DEFAULT_MAX_PENDING_OAUTH_STATES: usize = 1024;

/// This crate's own fixed, non-configurable routes (see `routes.rs::router`).
/// A configured provider `callback_path` colliding with any of these would
/// make axum's route-registration hit its duplicate-route panic at startup
/// — the same failure mode the pairwise provider-vs-provider collision check
/// above guards against, just for a different pair of colliding paths.
const FIXED_ROUTE_PATHS: &[&str] = &[
    "/authorize",
    "/token",
    "/revoke",
    "/jwks",
    "/auth/login",
    "/native/callback",
    "/native/poll",
    "/register",
];
/// Prefix covering every `/.well-known/oauth-*` metadata route, including
/// the `{*route}` wildcard variant.
const WELL_KNOWN_PREFIX: &str = "/.well-known/";

/// Default env-var prefix used when consumers do not specify one.
/// Backward-compatible with the original `LAB_*` env scheme.
pub const DEFAULT_ENV_PREFIX: &str = "LAB";
/// Default browser session cookie name (preserved for the lab consumer).
pub const DEFAULT_SESSION_COOKIE_NAME: &str = "lab_session";
/// Default OAuth scope label applied when callers do not request one.
pub const DEFAULT_SCOPE: &str = "lab";
/// Default protected resource path (canonical MCP endpoint).
pub const DEFAULT_RESOURCE_PATH: &str = "/mcp";
/// Default browser login path mounted by the auth router.
pub const DEFAULT_LOGIN_PATH: &str = "/auth/login";

#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
#[serde(rename_all = "lowercase")]
pub enum AuthMode {
    #[default]
    Bearer,
    OAuth,
}

impl AuthMode {
    fn parse(value: Option<&str>, env_key_for_diagnostics: &str) -> Result<Self, AuthError> {
        match value
            .unwrap_or("bearer")
            .trim()
            .to_ascii_lowercase()
            .as_str()
        {
            "bearer" => Ok(Self::Bearer),
            "oauth" => Ok(Self::OAuth),
            other => Err(AuthError::Config(format!(
                "{env_key_for_diagnostics} must be `bearer` or `oauth`, got `{other}`"
            ))),
        }
    }
}

#[derive(Clone, Debug, Default, PartialEq, Eq)]
pub struct AuthModeConfig {
    pub mode: AuthMode,
}

impl AuthModeConfig {
    pub fn from_sources(
        vars: impl IntoIterator<Item = (String, String)>,
    ) -> Result<Self, AuthError> {
        Self::from_sources_with_prefix(vars, DEFAULT_ENV_PREFIX)
    }

    pub fn from_sources_with_prefix(
        vars: impl IntoIterator<Item = (String, String)>,
        env_prefix: &str,
    ) -> Result<Self, AuthError> {
        let vars = normalize(vars);
        let key = env_key(env_prefix, "AUTH_MODE");
        Ok(Self {
            mode: AuthMode::parse(vars.get(&key).map(String::as_str), &key)?,
        })
    }
}

#[derive(Clone, Debug, PartialEq, Eq)]
pub struct AuthConfig {
    pub mode: AuthMode,
    pub public_url: Option<Url>,
    pub sqlite_path: PathBuf,
    pub key_path: PathBuf,
    pub bootstrap_secret: Option<String>,
    pub allowed_client_redirect_uris: Vec<String>,
    /// Single bootstrap admin email permitted to log in through any configured
    /// OAuth/OIDC provider.
    /// Required when `mode == AuthMode::OAuth`. Additional users are granted
    /// through the SQLite-backed allowlist managed via the web UI.
    pub admin_email: String,
    pub google: GoogleConfig,
    pub authelia: AutheliaConfig,
    pub github: GitHubConfig,
    /// Which configured provider `/authorize` and `/auth/login` use when the
    /// request omits `?provider=`. Must name a provider that is actually
    /// configured (validated in `AuthConfig::validate`). Resolved
    /// automatically when unset: `google` > `authelia` > `github`, in that
    /// priority order, picking the first one that has credentials — this is
    /// what makes every existing single-provider (Google-only) deployment
    /// keep working with zero config changes after upgrading.
    pub default_provider: String,
    pub access_token_ttl: Duration,
    pub refresh_token_ttl: Duration,
    pub auth_code_ttl: Duration,
    pub register_requests_per_minute: u32,
    pub authorize_requests_per_minute: u32,
    pub token_requests_per_minute: u32,
    pub max_pending_oauth_states: usize,

    // ---- Brand / consumer-specific parameterization (see L1 bead) ----
    /// Env var prefix used for diagnostics (e.g. `"LAB"`, `"SYSLOG_MCP"`).
    /// Set via [`AuthConfigBuilder::env_prefix`] BEFORE any env reads.
    pub env_prefix: String,
    /// Default base directory for `auth.db` and `auth-jwt.pem` when the
    /// corresponding env vars are unset.
    pub default_data_dir: PathBuf,
    /// Browser session cookie name. Lab consumer leaves this at the default
    /// (`"lab_session"`); other consumers override with their own brand.
    pub session_cookie_name: String,
    /// Scopes advertised on `/.well-known/oauth-authorization-server` and
    /// `/.well-known/oauth-protected-resource`.
    pub scopes_supported: Vec<String>,
    /// Path appended to `public_url` to form the canonical resource URL
    /// returned in the protected-resource metadata document.
    pub resource_path: String,
    /// Default scope applied when `/authorize` requests omit one and the
    /// only scope accepted by the legacy single-scope validator.
    pub default_scope: String,
    /// Scopes minted into the static-bearer-derived AuthContext so legacy
    /// admin tools keep functioning when the dual-mode middleware (L2) is
    /// deployed. Lab keeps the legacy `["lab:read","lab:admin"]` defaults;
    /// cortex will override with `["syslog:read","syslog:admin"]`.
    pub static_token_scopes: Vec<String>,
    /// Path of the browser login route (typically `/auth/login`).
    pub login_path: String,
    /// Whether `POST /register` (RFC 7591 dynamic client registration) is
    /// mounted. Defaults to `false` (closed) — opt-in per consumer.
    pub enable_dynamic_registration: bool,
    /// When `true`, dual-mode middleware MUST reject the static bearer
    /// token whenever OAuth is active. Defaults to `false` (lab keeps the
    /// historical break-glass behavior); cortex overrides to `true`.
    pub disable_static_token_with_oauth: bool,
    /// Optional at-rest encryption key for upstream provider refresh tokens.
    ///
    /// When present, provider refresh tokens are encrypted with
    /// ChaCha20-Poly1305 before being written to SQLite.  Set via
    /// `{PREFIX}_TOKEN_ENCRYPTION_KEY` (64 hex digits or 43 base64url chars).
    /// When absent, tokens are stored as plaintext (backward-compatible).
    pub token_encryption_key: Option<TokenEncryptionKey>,
    /// Out-of-band machine identities authorized for OAuth client credentials.
    pub machine_clients: Vec<MachineClientConfig>,
    /// Trusted enterprise identity providers authorized to issue ID-JAG grants.
    pub enterprise_issuers: Vec<EnterpriseIssuerConfig>,
}

impl Default for AuthConfig {
    fn default() -> Self {
        let base_dir = default_auth_dir();
        Self {
            mode: AuthMode::Bearer,
            public_url: None,
            sqlite_path: base_dir.join(DEFAULT_AUTH_DB_NAME),
            key_path: base_dir.join(DEFAULT_KEY_NAME),
            bootstrap_secret: None,
            allowed_client_redirect_uris: Vec::new(),
            admin_email: String::new(),
            google: GoogleConfig::default(),
            authelia: AutheliaConfig::default(),
            github: GitHubConfig::default(),
            default_provider: String::new(),
            access_token_ttl: Duration::from_secs(DEFAULT_ACCESS_TOKEN_TTL_SECS),
            refresh_token_ttl: Duration::from_secs(DEFAULT_REFRESH_TOKEN_TTL_SECS),
            auth_code_ttl: Duration::from_secs(DEFAULT_AUTH_CODE_TTL_SECS),
            register_requests_per_minute: DEFAULT_REGISTER_REQUESTS_PER_MINUTE,
            authorize_requests_per_minute: DEFAULT_AUTHORIZE_REQUESTS_PER_MINUTE,
            token_requests_per_minute: DEFAULT_TOKEN_REQUESTS_PER_MINUTE,
            max_pending_oauth_states: DEFAULT_MAX_PENDING_OAUTH_STATES,
            env_prefix: DEFAULT_ENV_PREFIX.to_string(),
            default_data_dir: base_dir,
            session_cookie_name: DEFAULT_SESSION_COOKIE_NAME.to_string(),
            // Advertise both the base scope and `:admin` so MCP clients that
            // need destructive operations can request the elevated scope at
            // /authorize. Allowed-emails users also receive `:admin` implicitly
            // (see `authorize::elevate_scope_for_allowed_user`).
            scopes_supported: vec![DEFAULT_SCOPE.to_string(), format!("{DEFAULT_SCOPE}:admin")],
            resource_path: DEFAULT_RESOURCE_PATH.to_string(),
            default_scope: DEFAULT_SCOPE.to_string(),
            static_token_scopes: vec!["lab:read".to_string(), "lab:admin".to_string()],
            login_path: DEFAULT_LOGIN_PATH.to_string(),
            enable_dynamic_registration: false,
            disable_static_token_with_oauth: false,
            token_encryption_key: None,
            machine_clients: Vec::new(),
            enterprise_issuers: Vec::new(),
        }
    }
}

impl AuthConfig {
    /// Backward-compatible convenience: read env vars using the default
    /// `LAB` prefix. Equivalent to `AuthConfigBuilder::new().build_from_sources(vars)`.
    pub fn from_sources(
        vars: impl IntoIterator<Item = (String, String)>,
    ) -> Result<Self, AuthError> {
        AuthConfigBuilder::new().build_from_sources(vars)
    }

    pub(crate) fn validate(&self) -> Result<(), AuthError> {
        let prefix = &self.env_prefix;
        if !self.google.callback_path.starts_with('/') {
            return Err(AuthError::Config(format!(
                "{prefix}_GOOGLE_CALLBACK_PATH must start with `/`, got `{}`",
                self.google.callback_path
            )));
        }

        if !self.resource_path.starts_with('/') {
            return Err(AuthError::Config(format!(
                "resource_path must start with `/`, got `{}`",
                self.resource_path
            )));
        }
        if !self.login_path.starts_with('/') {
            return Err(AuthError::Config(format!(
                "login_path must start with `/`, got `{}`",
                self.login_path
            )));
        }
        if self.session_cookie_name.is_empty() {
            return Err(AuthError::Config(
                "session_cookie_name must not be empty".to_string(),
            ));
        }
        if self.default_scope.is_empty() {
            return Err(AuthError::Config(
                "default_scope must not be empty".to_string(),
            ));
        }
        if self.scopes_supported.is_empty() {
            return Err(AuthError::Config(
                "scopes_supported must contain at least one scope".to_string(),
            ));
        }
        if !self.scopes_supported.contains(&self.default_scope) {
            return Err(AuthError::Config(format!(
                "default_scope `{}` must be listed in scopes_supported",
                self.default_scope
            )));
        }
        for client in &self.machine_clients {
            if client.client_id.trim().is_empty() {
                return Err(AuthError::Config(
                    "machine clients require client_id".to_string(),
                ));
            }
            if client.client_secret.is_some() == client.jwks.is_some() {
                return Err(AuthError::Config(
                    "machine clients require exactly one of client_secret or jwks".to_string(),
                ));
            }
            if client.resources.is_empty() {
                return Err(AuthError::Config(
                    "machine clients require at least one allowed resource".to_string(),
                ));
            }
        }
        for issuer in &self.enterprise_issuers {
            if issuer.issuer.trim().is_empty()
                || (issuer.jwks_uri.is_none() && issuer.jwks.is_none())
            {
                return Err(AuthError::Config(
                    "enterprise issuers require issuer and jwks_uri or jwks".to_string(),
                ));
            }
            if issuer
                .jwks_uri
                .as_ref()
                .is_some_and(|uri| uri.scheme() != "https")
            {
                return Err(AuthError::Config(
                    "enterprise issuer jwks_uri must use https".to_string(),
                ));
            }
        }

        if matches!(self.mode, AuthMode::OAuth) {
            if self.public_url.is_none() {
                return Err(AuthError::Config(format!(
                    "{prefix}_PUBLIC_URL is required when {prefix}_AUTH_MODE=oauth"
                )));
            }

            let google_configured = !self.google.client_id.is_empty();
            let authelia_configured = !self.authelia.client_id.is_empty();
            let github_configured = !self.github.client_id.is_empty();

            if google_configured && self.google.client_secret.is_empty() {
                return Err(AuthError::Config(format!(
                    "{prefix}_GOOGLE_CLIENT_SECRET is required when {prefix}_GOOGLE_CLIENT_ID is set"
                )));
            }
            if authelia_configured {
                if self.authelia.issuer_url.is_none() {
                    return Err(AuthError::Config(format!(
                        "{prefix}_AUTHELIA_ISSUER_URL is required when {prefix}_AUTHELIA_CLIENT_ID is set"
                    )));
                }
                if self.authelia.client_secret.is_empty() {
                    return Err(AuthError::Config(format!(
                        "{prefix}_AUTHELIA_CLIENT_SECRET is required when {prefix}_AUTHELIA_CLIENT_ID is set"
                    )));
                }
                // Google's authorize/token/JWKS endpoints are hardcoded `https://`
                // string constants — no config can downgrade them. Authelia's are
                // entirely operator-supplied, so unlike Google this crate must
                // enforce the scheme itself: a plaintext issuer would send
                // authorization codes, tokens, and `client_secret` (in the token
                // exchange POST body) over the wire unencrypted with no other
                // signal that anything is wrong.
                if let Some(issuer) = self.authelia.issuer_url.as_ref()
                    && issuer.scheme() != "https"
                {
                    return Err(AuthError::Config(format!(
                        "{prefix}_AUTHELIA_ISSUER_URL must use https, got `{}`",
                        issuer.scheme()
                    )));
                }
            }
            if github_configured && self.github.client_secret.is_empty() {
                return Err(AuthError::Config(format!(
                    "{prefix}_GITHUB_CLIENT_SECRET is required when {prefix}_GITHUB_CLIENT_ID is set"
                )));
            }
            // GitHubProvider::exchange_code's GET /user/emails call requires
            // this scope; GitHub returns it in a hard failure (not a graceful
            // `email: None`, unlike Google/Authelia's ID-token-derived email
            // claim), and tokio::try_join! propagates that as a total login
            // failure. Catch the misconfiguration here instead of at runtime.
            if github_configured && !self.github.scopes.iter().any(|scope| scope == "user:email") {
                return Err(AuthError::Config(format!(
                    "{prefix}_GITHUB_SCOPES must include `user:email` (got `{:?}`)",
                    self.github.scopes
                )));
            }
            // Two configured providers with the same (possibly operator-overridden)
            // callback_path would make routes.rs's per-provider route-mounting loop
            // (Task 10) hit axum's duplicate-route panic at startup instead of a
            // clean config-time error — check pairwise uniqueness among only the
            // providers that are actually configured.
            //
            // Compare the NORMALIZED path (leading `/` guaranteed), not the raw
            // config string: `build_provider_redirect_uri` (state.rs) strips any
            // leading `/` from `callback_path` and re-adds exactly one before
            // mounting the route, so an operator-supplied path without a leading
            // `/` (e.g. `authorize`) mounts as `/authorize` at startup even though
            // it wouldn't textually match `/authorize` in `FIXED_ROUTE_PATHS` or
            // another provider's raw `callback_path`. Normalizing here first keeps
            // this check honest about what actually gets mounted.
            {
                fn normalize_callback_path(path: &str) -> String {
                    format!("/{}", path.trim_start_matches('/'))
                }

                let mut configured_paths: Vec<(&str, String)> = Vec::new();
                if google_configured {
                    configured_paths.push((
                        "google",
                        normalize_callback_path(&self.google.callback_path),
                    ));
                }
                if authelia_configured {
                    configured_paths.push((
                        "authelia",
                        normalize_callback_path(&self.authelia.callback_path),
                    ));
                }
                if github_configured {
                    configured_paths.push((
                        "github",
                        normalize_callback_path(&self.github.callback_path),
                    ));
                }
                for i in 0..configured_paths.len() {
                    for j in (i + 1)..configured_paths.len() {
                        if configured_paths[i].1 == configured_paths[j].1 {
                            return Err(AuthError::Config(format!(
                                "{prefix}_{a}_CALLBACK_PATH and {prefix}_{b}_CALLBACK_PATH must not both resolve to `{path}`",
                                a = configured_paths[i].0.to_ascii_uppercase(),
                                b = configured_paths[j].0.to_ascii_uppercase(),
                                path = configured_paths[i].1,
                            )));
                        }
                    }
                }
                // Same failure mode as above, but against this crate's own
                // fixed routes rather than another provider's callback_path.
                for (provider, path) in &configured_paths {
                    if FIXED_ROUTE_PATHS.contains(&path.as_str())
                        || path.starts_with(WELL_KNOWN_PREFIX)
                    {
                        return Err(AuthError::Config(format!(
                            "{prefix}_{provider_upper}_CALLBACK_PATH must not resolve to `{path}` — \
                             that path is reserved for this crate's own `{path}` route",
                            provider_upper = provider.to_ascii_uppercase(),
                        )));
                    }
                }
            }
            if !google_configured && !authelia_configured && !github_configured {
                return Err(AuthError::Config(format!(
                    "at least one OAuth provider must be configured when {prefix}_AUTH_MODE=oauth — \
                     set {prefix}_GOOGLE_CLIENT_ID, {prefix}_AUTHELIA_CLIENT_ID (+ {prefix}_AUTHELIA_ISSUER_URL), \
                     or {prefix}_GITHUB_CLIENT_ID (each paired with its matching _CLIENT_SECRET)"
                )));
            }
            match self.default_provider.as_str() {
                "google" if !google_configured => {
                    return Err(AuthError::Config(format!(
                        "{prefix}_AUTH_DEFAULT_PROVIDER=google but {prefix}_GOOGLE_CLIENT_ID is not set"
                    )));
                }
                "authelia" if !authelia_configured => {
                    return Err(AuthError::Config(format!(
                        "{prefix}_AUTH_DEFAULT_PROVIDER=authelia but {prefix}_AUTHELIA_CLIENT_ID is not set"
                    )));
                }
                "github" if !github_configured => {
                    return Err(AuthError::Config(format!(
                        "{prefix}_AUTH_DEFAULT_PROVIDER=github but {prefix}_GITHUB_CLIENT_ID is not set"
                    )));
                }
                "google" | "authelia" | "github" => {}
                other => {
                    return Err(AuthError::Config(format!(
                        "{prefix}_AUTH_DEFAULT_PROVIDER must be `google`, `authelia`, or `github`, got `{other}`"
                    )));
                }
            }
            if self.admin_email.is_empty() {
                return Err(AuthError::Config(format!(
                    "{prefix}_AUTH_ADMIN_EMAIL is required when {prefix}_AUTH_MODE=oauth — \
                     set the admin's email so no account can log in unless explicitly permitted"
                )));
            }
        }

        Ok(())
    }
}

/// Consuming builder for [`AuthConfig`]. The `env_prefix` MUST be set BEFORE
/// any env-driven `build_*` call; builder methods themselves do not read env.
///
/// ```ignore
/// let cfg = AuthConfigBuilder::new()
///     .env_prefix("SYSLOG_MCP")
///     .session_cookie_name("syslog_session")
///     .scopes_supported(vec!["syslog:read".to_string(), "syslog:admin".to_string()])
///     .resource_path("/mcp")
///     .default_scope("syslog:read")
///     .static_token_scopes(vec!["syslog:read".to_string(), "syslog:admin".to_string()])
///     .disable_static_token_with_oauth(true)
///     .build_from_sources(std::env::vars())?;
/// ```
#[derive(Clone, Debug)]
pub struct AuthConfigBuilder {
    env_prefix: String,
    default_data_dir: Option<PathBuf>,
    session_cookie_name: String,
    scopes_supported: Vec<String>,
    resource_path: String,
    default_scope: String,
    static_token_scopes: Vec<String>,
    login_path: String,
    enable_dynamic_registration: bool,
    disable_static_token_with_oauth: bool,
}

impl Default for AuthConfigBuilder {
    fn default() -> Self {
        Self::new()
    }
}

impl AuthConfigBuilder {
    pub fn new() -> Self {
        Self {
            env_prefix: DEFAULT_ENV_PREFIX.to_string(),
            default_data_dir: None,
            session_cookie_name: DEFAULT_SESSION_COOKIE_NAME.to_string(),
            scopes_supported: vec![DEFAULT_SCOPE.to_string(), format!("{DEFAULT_SCOPE}:admin")],
            resource_path: DEFAULT_RESOURCE_PATH.to_string(),
            default_scope: DEFAULT_SCOPE.to_string(),
            static_token_scopes: vec!["lab:read".to_string(), "lab:admin".to_string()],
            login_path: DEFAULT_LOGIN_PATH.to_string(),
            enable_dynamic_registration: false,
            disable_static_token_with_oauth: false,
        }
    }

    #[must_use]
    pub fn env_prefix(mut self, prefix: impl Into<String>) -> Self {
        self.env_prefix = prefix.into();
        self
    }

    #[must_use]
    pub fn default_data_dir(mut self, dir: impl Into<PathBuf>) -> Self {
        self.default_data_dir = Some(dir.into());
        self
    }

    #[must_use]
    pub fn session_cookie_name(mut self, name: impl Into<String>) -> Self {
        self.session_cookie_name = name.into();
        self
    }

    #[must_use]
    pub fn scopes_supported(mut self, scopes: Vec<String>) -> Self {
        self.scopes_supported = scopes;
        self
    }

    #[must_use]
    pub fn resource_path(mut self, path: impl Into<String>) -> Self {
        self.resource_path = path.into();
        self
    }

    #[must_use]
    pub fn default_scope(mut self, scope: impl Into<String>) -> Self {
        self.default_scope = scope.into();
        self
    }

    #[must_use]
    pub fn static_token_scopes(mut self, scopes: Vec<String>) -> Self {
        self.static_token_scopes = scopes;
        self
    }

    #[must_use]
    pub fn login_path(mut self, path: impl Into<String>) -> Self {
        self.login_path = path.into();
        self
    }

    #[must_use]
    pub const fn enable_dynamic_registration(mut self, enabled: bool) -> Self {
        self.enable_dynamic_registration = enabled;
        self
    }

    #[must_use]
    pub const fn disable_static_token_with_oauth(mut self, disabled: bool) -> Self {
        self.disable_static_token_with_oauth = disabled;
        self
    }

    /// Read configuration from the supplied env-style key/value pairs using
    /// the configured `env_prefix`, then validate and return [`AuthConfig`].
    pub fn build_from_sources(
        self,
        vars: impl IntoIterator<Item = (String, String)>,
    ) -> Result<AuthConfig, AuthError> {
        let vars = normalize(vars);
        let prefix = self.env_prefix.clone();
        let key_mode = env_key(&prefix, "AUTH_MODE");
        let key_admin = env_key(&prefix, "AUTH_ADMIN_EMAIL");
        let key_public_url = env_key(&prefix, "PUBLIC_URL");
        let key_db = env_key(&prefix, "AUTH_SQLITE_PATH");
        let key_keypath = env_key(&prefix, "AUTH_KEY_PATH");
        let key_secret = env_key(&prefix, "AUTH_BOOTSTRAP_SECRET");
        let key_redirects = env_key(&prefix, "AUTH_ALLOWED_REDIRECT_URIS");
        let key_g_id = env_key(&prefix, "GOOGLE_CLIENT_ID");
        let key_g_secret = env_key(&prefix, "GOOGLE_CLIENT_SECRET");
        let key_g_callback = env_key(&prefix, "GOOGLE_CALLBACK_PATH");
        let key_g_scopes = env_key(&prefix, "GOOGLE_SCOPES");
        let key_a_issuer = env_key(&prefix, "AUTHELIA_ISSUER_URL");
        let key_a_id = env_key(&prefix, "AUTHELIA_CLIENT_ID");
        let key_a_secret = env_key(&prefix, "AUTHELIA_CLIENT_SECRET");
        let key_a_callback = env_key(&prefix, "AUTHELIA_CALLBACK_PATH");
        let key_a_scopes = env_key(&prefix, "AUTHELIA_SCOPES");
        let key_gh_id = env_key(&prefix, "GITHUB_CLIENT_ID");
        let key_gh_secret = env_key(&prefix, "GITHUB_CLIENT_SECRET");
        let key_gh_callback = env_key(&prefix, "GITHUB_CALLBACK_PATH");
        let key_gh_scopes = env_key(&prefix, "GITHUB_SCOPES");
        let key_default_provider = env_key(&prefix, "AUTH_DEFAULT_PROVIDER");
        let key_at_ttl = env_key(&prefix, "AUTH_ACCESS_TOKEN_TTL_SECS");
        let key_rt_ttl = env_key(&prefix, "AUTH_REFRESH_TOKEN_TTL_SECS");
        let key_code_ttl = env_key(&prefix, "AUTH_CODE_TTL_SECS");
        let key_reg_rpm = env_key(&prefix, "AUTH_REGISTER_REQUESTS_PER_MINUTE");
        let key_az_rpm = env_key(&prefix, "AUTH_AUTHORIZE_REQUESTS_PER_MINUTE");
        let key_token_rpm = env_key(&prefix, "AUTH_TOKEN_REQUESTS_PER_MINUTE");
        let key_max_pending = env_key(&prefix, "AUTH_MAX_PENDING_OAUTH_STATES");
        let key_enc_key = env_key(&prefix, "TOKEN_ENCRYPTION_KEY");
        let key_machine_clients = env_key(&prefix, "AUTH_MACHINE_CLIENTS_JSON");
        let key_enterprise_issuers = env_key(&prefix, "AUTH_ENTERPRISE_ISSUERS_JSON");

        let mode = AuthMode::parse(vars.get(&key_mode).map(String::as_str), &key_mode)?;
        let admin_email = read_string(&vars, &key_admin)
            .map(|raw| raw.trim().to_ascii_lowercase())
            .unwrap_or_default();
        let base_dir = self
            .default_data_dir
            .clone()
            .unwrap_or_else(default_auth_dir);
        let google_client_id = read_string(&vars, &key_g_id).unwrap_or_default();
        let authelia_client_id = read_string(&vars, &key_a_id).unwrap_or_default();
        let github_client_id = read_string(&vars, &key_gh_id).unwrap_or_default();
        let default_provider = read_string(&vars, &key_default_provider)
            .map(|raw| raw.trim().to_ascii_lowercase())
            .filter(|value| !value.is_empty())
            .unwrap_or_else(|| {
                if !google_client_id.is_empty() {
                    "google".to_string()
                } else if !authelia_client_id.is_empty() {
                    "authelia".to_string()
                } else if !github_client_id.is_empty() {
                    "github".to_string()
                } else {
                    "google".to_string()
                }
            });
        let config = AuthConfig {
            mode,
            public_url: read_url(&vars, &key_public_url)?,
            sqlite_path: read_path(&vars, &key_db)
                .unwrap_or_else(|| base_dir.join(DEFAULT_AUTH_DB_NAME)),
            key_path: read_path(&vars, &key_keypath)
                .unwrap_or_else(|| base_dir.join(DEFAULT_KEY_NAME)),
            bootstrap_secret: read_string(&vars, &key_secret),
            allowed_client_redirect_uris: read_csv(&vars, &key_redirects).unwrap_or_default(),
            admin_email,
            google: GoogleConfig {
                client_id: google_client_id.clone(),
                client_secret: read_string(&vars, &key_g_secret).unwrap_or_default(),
                callback_path: read_string(&vars, &key_g_callback)
                    .unwrap_or_else(|| DEFAULT_CALLBACK_PATH.to_string()),
                scopes: read_csv(&vars, &key_g_scopes).unwrap_or_else(default_google_scopes),
            },
            authelia: AutheliaConfig {
                issuer_url: read_url(&vars, &key_a_issuer)?,
                client_id: read_string(&vars, &key_a_id).unwrap_or_default(),
                client_secret: read_string(&vars, &key_a_secret).unwrap_or_default(),
                callback_path: read_string(&vars, &key_a_callback)
                    .unwrap_or_else(default_authelia_callback_path),
                scopes: read_csv(&vars, &key_a_scopes).unwrap_or_else(default_authelia_scopes),
            },
            github: GitHubConfig {
                client_id: read_string(&vars, &key_gh_id).unwrap_or_default(),
                client_secret: read_string(&vars, &key_gh_secret).unwrap_or_default(),
                callback_path: read_string(&vars, &key_gh_callback)
                    .unwrap_or_else(default_github_callback_path),
                scopes: read_csv(&vars, &key_gh_scopes).unwrap_or_else(default_github_scopes),
            },
            default_provider,
            access_token_ttl: Duration::from_secs(
                read_u64(&vars, &key_at_ttl)?.unwrap_or(DEFAULT_ACCESS_TOKEN_TTL_SECS),
            ),
            refresh_token_ttl: Duration::from_secs(
                read_u64(&vars, &key_rt_ttl)?.unwrap_or(DEFAULT_REFRESH_TOKEN_TTL_SECS),
            ),
            auth_code_ttl: Duration::from_secs(
                read_u64(&vars, &key_code_ttl)?.unwrap_or(DEFAULT_AUTH_CODE_TTL_SECS),
            ),
            register_requests_per_minute: read_u32(&vars, &key_reg_rpm)?
                .unwrap_or(DEFAULT_REGISTER_REQUESTS_PER_MINUTE),
            authorize_requests_per_minute: read_u32(&vars, &key_az_rpm)?
                .unwrap_or(DEFAULT_AUTHORIZE_REQUESTS_PER_MINUTE),
            token_requests_per_minute: read_u32(&vars, &key_token_rpm)?
                .unwrap_or(DEFAULT_TOKEN_REQUESTS_PER_MINUTE),
            max_pending_oauth_states: read_usize(&vars, &key_max_pending)?
                .unwrap_or(DEFAULT_MAX_PENDING_OAUTH_STATES),
            env_prefix: prefix,
            default_data_dir: base_dir,
            session_cookie_name: self.session_cookie_name,
            scopes_supported: self.scopes_supported,
            resource_path: self.resource_path,
            default_scope: self.default_scope,
            static_token_scopes: self.static_token_scopes,
            login_path: self.login_path,
            enable_dynamic_registration: self.enable_dynamic_registration,
            disable_static_token_with_oauth: self.disable_static_token_with_oauth,
            token_encryption_key: read_string(&vars, &key_enc_key)
                .map(|raw| {
                    TokenEncryptionKey::from_encoded(&raw)
                        .map_err(|e| AuthError::Config(format!("invalid {key_enc_key}: {e}")))
                })
                .transpose()?,
            machine_clients: read_json(&vars, &key_machine_clients)?.unwrap_or_default(),
            enterprise_issuers: read_json(&vars, &key_enterprise_issuers)?.unwrap_or_default(),
        };

        config.validate()?;
        Ok(config)
    }
}

fn env_key(prefix: &str, suffix: &str) -> String {
    let trimmed = prefix.trim_end_matches('_');
    if trimmed.is_empty() {
        suffix.to_string()
    } else {
        format!("{trimmed}_{suffix}")
    }
}

fn normalize(vars: impl IntoIterator<Item = (String, String)>) -> HashMap<String, String> {
    vars.into_iter()
        .filter_map(|(key, value)| {
            let trimmed = value.trim();
            if trimmed.is_empty() {
                None
            } else {
                Some((key, trimmed.to_string()))
            }
        })
        .collect()
}

fn default_auth_dir() -> PathBuf {
    home_dir().map_or_else(|| PathBuf::from(".soma"), |home| home.join(".soma"))
}

fn home_dir() -> Option<PathBuf> {
    std::env::var_os("HOME")
        .or_else(|| std::env::var_os("USERPROFILE"))
        .map(PathBuf::from)
}

fn read_string(vars: &HashMap<String, String>, key: &str) -> Option<String> {
    vars.get(key).cloned()
}

fn read_path(vars: &HashMap<String, String>, key: &str) -> Option<PathBuf> {
    read_string(vars, key).map(PathBuf::from)
}

fn read_csv(vars: &HashMap<String, String>, key: &str) -> Option<Vec<String>> {
    read_string(vars, key).map(|value| {
        value
            .split(',')
            .map(str::trim)
            .filter(|entry| !entry.is_empty())
            .map(ToOwned::to_owned)
            .collect()
    })
}

fn read_json<T: serde::de::DeserializeOwned>(
    vars: &HashMap<String, String>,
    key: &str,
) -> Result<Option<T>, AuthError> {
    read_string(vars, key)
        .map(|value| {
            serde_json::from_str(&value)
                .map_err(|error| AuthError::Config(format!("{key} must be valid JSON: {error}")))
        })
        .transpose()
}

fn read_url(vars: &HashMap<String, String>, key: &str) -> Result<Option<Url>, AuthError> {
    read_string(vars, key)
        .map(|value| {
            Url::parse(&value)
                .map_err(|error| AuthError::Config(format!("{key} must be a valid URL: {error}")))
        })
        .transpose()
}

fn read_u64(vars: &HashMap<String, String>, key: &str) -> Result<Option<u64>, AuthError> {
    read_string(vars, key)
        .map(|value| {
            value.parse::<u64>().map_err(|error| {
                AuthError::Config(format!(
                    "{key} must be an integer number of seconds: {error}"
                ))
            })
        })
        .transpose()
}

fn read_u32(vars: &HashMap<String, String>, key: &str) -> Result<Option<u32>, AuthError> {
    read_string(vars, key)
        .map(|value| {
            value.parse::<u32>().map_err(|error| {
                AuthError::Config(format!(
                    "{key} must be an integer number of requests per minute: {error}"
                ))
            })
        })
        .transpose()
}

fn read_usize(vars: &HashMap<String, String>, key: &str) -> Result<Option<usize>, AuthError> {
    read_string(vars, key)
        .map(|value| {
            value.parse::<usize>().map_err(|error| {
                AuthError::Config(format!("{key} must be a positive integer: {error}"))
            })
        })
        .transpose()
}

#[cfg(test)]
mod tests {
    use super::{AuthConfig, AuthConfigBuilder, AuthMode, AuthModeConfig, AutheliaConfig};

    /// Guards against a regression where `GoogleConfig`/`AutheliaConfig`/
    /// `GitHubConfig` derived `Default` (giving `callback_path: String::new()`
    /// instead of the `#[serde(default = "fn")]` value) made `validate()`'s
    /// unconditional Google callback-path check reject ANY struct-literal
    /// `AuthConfig` that configures only Authelia/GitHub and relies on
    /// `..AuthConfig::default()` for the unused `google` field — a shape that
    /// bypasses `AuthConfigBuilder` entirely (test fixtures, or a downstream
    /// consumer constructing `AuthConfig` directly).
    #[test]
    fn validate_accepts_a_struct_literal_config_configuring_only_authelia() {
        let cfg = AuthConfig {
            mode: AuthMode::OAuth,
            public_url: Some(url::Url::parse("https://lab.example.com").unwrap()),
            admin_email: "admin@example.com".to_string(),
            authelia: AutheliaConfig {
                issuer_url: Some(url::Url::parse("https://auth.example.com").unwrap()),
                client_id: "id".to_string(),
                client_secret: "secret".to_string(),
                ..AutheliaConfig::default()
            },
            default_provider: "authelia".to_string(),
            ..AuthConfig::default()
        };
        cfg.validate().expect(
            "google's untouched defaults must not block validation of an authelia-only config",
        );
    }

    #[test]
    fn bearer_mode_preserves_existing_http_token_behavior() {
        let cfg = AuthModeConfig::from_sources(fake_env_with("LAB_AUTH_MODE", "bearer")).unwrap();
        assert!(matches!(cfg.mode, AuthMode::Bearer));
    }

    #[test]
    fn oauth_mode_requires_public_url_and_google_credentials() {
        let err = AuthConfig::from_sources(fake_env_with_many([
            ("LAB_AUTH_MODE", "oauth"),
            ("LAB_GOOGLE_CLIENT_ID", "id"),
        ]))
        .unwrap_err();
        assert!(err.to_string().contains("LAB_PUBLIC_URL"));
    }

    #[test]
    fn oauth_mode_requires_at_least_one_configured_provider() {
        let err = AuthConfig::from_sources(fake_env_with_many([
            ("LAB_AUTH_MODE", "oauth"),
            ("LAB_PUBLIC_URL", "https://lab.example.com"),
            ("LAB_AUTH_ADMIN_EMAIL", "admin@example.com"),
        ]))
        .unwrap_err();
        assert!(err.to_string().contains("at least one OAuth provider"));
    }

    #[test]
    fn oauth_mode_accepts_authelia_only_configuration() {
        let cfg = AuthConfig::from_sources(fake_env_with_many([
            ("LAB_AUTH_MODE", "oauth"),
            ("LAB_PUBLIC_URL", "https://lab.example.com"),
            ("LAB_AUTHELIA_ISSUER_URL", "https://auth.example.com"),
            ("LAB_AUTHELIA_CLIENT_ID", "id"),
            ("LAB_AUTHELIA_CLIENT_SECRET", "secret"),
            ("LAB_AUTH_ADMIN_EMAIL", "admin@example.com"),
        ]))
        .unwrap();
        assert_eq!(cfg.default_provider, "authelia");
    }

    #[test]
    fn oauth_mode_accepts_github_only_configuration() {
        let cfg = AuthConfig::from_sources(fake_env_with_many([
            ("LAB_AUTH_MODE", "oauth"),
            ("LAB_PUBLIC_URL", "https://lab.example.com"),
            ("LAB_GITHUB_CLIENT_ID", "id"),
            ("LAB_GITHUB_CLIENT_SECRET", "secret"),
            ("LAB_AUTH_ADMIN_EMAIL", "admin@example.com"),
        ]))
        .unwrap();
        assert_eq!(cfg.default_provider, "github");
    }

    #[test]
    fn oauth_mode_rejects_github_scopes_missing_user_email() {
        let err = AuthConfig::from_sources(fake_env_with_many([
            ("LAB_AUTH_MODE", "oauth"),
            ("LAB_PUBLIC_URL", "https://lab.example.com"),
            ("LAB_GITHUB_CLIENT_ID", "id"),
            ("LAB_GITHUB_CLIENT_SECRET", "secret"),
            ("LAB_GITHUB_SCOPES", "read:user"),
            ("LAB_AUTH_ADMIN_EMAIL", "admin@example.com"),
        ]))
        .unwrap_err();
        assert!(err.to_string().contains("user:email"));
    }

    #[test]
    fn oauth_mode_default_provider_prefers_google_when_multiple_are_configured() {
        let cfg = AuthConfig::from_sources(fake_env_with_many([
            ("LAB_AUTH_MODE", "oauth"),
            ("LAB_PUBLIC_URL", "https://lab.example.com"),
            ("LAB_GOOGLE_CLIENT_ID", "id"),
            ("LAB_GOOGLE_CLIENT_SECRET", "secret"),
            ("LAB_GITHUB_CLIENT_ID", "gh-id"),
            ("LAB_GITHUB_CLIENT_SECRET", "gh-secret"),
            ("LAB_AUTH_ADMIN_EMAIL", "admin@example.com"),
        ]))
        .unwrap();
        assert_eq!(cfg.default_provider, "google");
    }

    #[test]
    fn oauth_mode_rejects_default_provider_naming_an_unconfigured_provider() {
        let err = AuthConfig::from_sources(fake_env_with_many([
            ("LAB_AUTH_MODE", "oauth"),
            ("LAB_PUBLIC_URL", "https://lab.example.com"),
            ("LAB_GOOGLE_CLIENT_ID", "id"),
            ("LAB_GOOGLE_CLIENT_SECRET", "secret"),
            ("LAB_AUTH_ADMIN_EMAIL", "admin@example.com"),
            ("LAB_AUTH_DEFAULT_PROVIDER", "github"),
        ]))
        .unwrap_err();
        assert!(err.to_string().contains("LAB_AUTH_DEFAULT_PROVIDER=github"));
    }

    #[test]
    fn oauth_mode_rejects_a_non_https_authelia_issuer_url() {
        let err = AuthConfig::from_sources(fake_env_with_many([
            ("LAB_AUTH_MODE", "oauth"),
            ("LAB_PUBLIC_URL", "https://lab.example.com"),
            ("LAB_AUTHELIA_ISSUER_URL", "http://auth.internal"),
            ("LAB_AUTHELIA_CLIENT_ID", "id"),
            ("LAB_AUTHELIA_CLIENT_SECRET", "secret"),
            ("LAB_AUTH_ADMIN_EMAIL", "admin@example.com"),
        ]))
        .unwrap_err();
        assert!(
            err.to_string()
                .contains("LAB_AUTHELIA_ISSUER_URL must use https")
        );
    }

    #[test]
    fn oauth_mode_rejects_two_configured_providers_sharing_a_callback_path() {
        let err = AuthConfig::from_sources(fake_env_with_many([
            ("LAB_AUTH_MODE", "oauth"),
            ("LAB_PUBLIC_URL", "https://lab.example.com"),
            ("LAB_GOOGLE_CLIENT_ID", "id"),
            ("LAB_GOOGLE_CLIENT_SECRET", "secret"),
            ("LAB_GITHUB_CLIENT_ID", "gh-id"),
            ("LAB_GITHUB_CLIENT_SECRET", "gh-secret"),
            ("LAB_GITHUB_CALLBACK_PATH", "/auth/google/callback"),
            ("LAB_AUTH_ADMIN_EMAIL", "admin@example.com"),
        ]))
        .unwrap_err();
        assert!(
            err.to_string()
                .contains("must not both resolve to `/auth/google/callback`")
        );
    }

    #[test]
    fn oauth_mode_rejects_two_configured_providers_sharing_a_callback_path_missing_a_leading_slash()
    {
        // A `callback_path` without a leading `/` still mounts at the same
        // normalized route as one that has it (build_provider_redirect_uri
        // in state.rs prepends the missing `/`), so the collision check must
        // catch this even though the raw strings don't textually match.
        let err = AuthConfig::from_sources(fake_env_with_many([
            ("LAB_AUTH_MODE", "oauth"),
            ("LAB_PUBLIC_URL", "https://lab.example.com"),
            ("LAB_GOOGLE_CLIENT_ID", "id"),
            ("LAB_GOOGLE_CLIENT_SECRET", "secret"),
            ("LAB_GITHUB_CLIENT_ID", "gh-id"),
            ("LAB_GITHUB_CLIENT_SECRET", "gh-secret"),
            ("LAB_GITHUB_CALLBACK_PATH", "auth/google/callback"),
            ("LAB_AUTH_ADMIN_EMAIL", "admin@example.com"),
        ]))
        .unwrap_err();
        assert!(
            err.to_string()
                .contains("must not both resolve to `/auth/google/callback`"),
            "unexpected error: {err}"
        );
    }

    #[test]
    fn oauth_mode_rejects_a_callback_path_colliding_with_a_fixed_crate_route() {
        let err = AuthConfig::from_sources(fake_env_with_many([
            ("LAB_AUTH_MODE", "oauth"),
            ("LAB_PUBLIC_URL", "https://lab.example.com"),
            ("LAB_GOOGLE_CLIENT_ID", "id"),
            ("LAB_GOOGLE_CLIENT_SECRET", "secret"),
            ("LAB_GOOGLE_CALLBACK_PATH", "/authorize"),
            ("LAB_AUTH_ADMIN_EMAIL", "admin@example.com"),
        ]))
        .unwrap_err();
        assert!(
            err.to_string().contains("must not resolve to `/authorize`"),
            "unexpected error: {err}"
        );
    }

    #[test]
    fn oauth_mode_rejects_a_callback_path_colliding_with_a_fixed_crate_route_missing_a_leading_slash()
     {
        // Same as above but without the leading `/` on the operator-supplied
        // value. Uses GitHub, not Google: Google's callback_path has its own
        // unconditional "must start with `/`" check earlier in validate()
        // (a different guard than the one under test here), so a Google
        // fixture would never reach the collision-check normalization this
        // test exists to cover. GitHub/Authelia have no such standalone
        // check, so this is the only path that exercises it — the value
        // still mounts at `/authorize` once state.rs builds the redirect URI.
        let err = AuthConfig::from_sources(fake_env_with_many([
            ("LAB_AUTH_MODE", "oauth"),
            ("LAB_PUBLIC_URL", "https://lab.example.com"),
            ("LAB_GITHUB_CLIENT_ID", "id"),
            ("LAB_GITHUB_CLIENT_SECRET", "secret"),
            ("LAB_GITHUB_CALLBACK_PATH", "authorize"),
            ("LAB_AUTH_ADMIN_EMAIL", "admin@example.com"),
        ]))
        .unwrap_err();
        assert!(
            err.to_string().contains("must not resolve to `/authorize`"),
            "unexpected error: {err}"
        );
    }

    #[test]
    fn oauth_mode_rejects_a_callback_path_under_the_well_known_prefix() {
        let err = AuthConfig::from_sources(fake_env_with_many([
            ("LAB_AUTH_MODE", "oauth"),
            ("LAB_PUBLIC_URL", "https://lab.example.com"),
            ("LAB_GOOGLE_CLIENT_ID", "id"),
            ("LAB_GOOGLE_CLIENT_SECRET", "secret"),
            (
                "LAB_GOOGLE_CALLBACK_PATH",
                "/.well-known/oauth-authorization-server",
            ),
            ("LAB_AUTH_ADMIN_EMAIL", "admin@example.com"),
        ]))
        .unwrap_err();
        assert!(
            err.to_string()
                .contains("must not resolve to `/.well-known/oauth-authorization-server`"),
            "unexpected error: {err}"
        );
    }

    #[test]
    fn oauth_mode_defaults_paths_and_callback() {
        let cfg = AuthConfig::from_sources(fake_env_with_many([
            ("LAB_AUTH_MODE", "oauth"),
            ("LAB_PUBLIC_URL", "https://lab.example.com"),
            ("LAB_GOOGLE_CLIENT_ID", "id"),
            ("LAB_GOOGLE_CLIENT_SECRET", "secret"),
            ("LAB_AUTH_ADMIN_EMAIL", "admin@example.com"),
        ]))
        .unwrap();
        assert_eq!(cfg.sqlite_path.file_name().unwrap(), "auth.db");
        assert_eq!(cfg.key_path.file_name().unwrap(), "auth-jwt.pem");
        assert_eq!(cfg.google.callback_path, "/auth/google/callback");
    }

    #[test]
    fn oauth_mode_requires_admin_email() {
        let err = AuthConfig::from_sources(fake_env_with_many([
            ("LAB_AUTH_MODE", "oauth"),
            ("LAB_PUBLIC_URL", "https://lab.example.com"),
            ("LAB_GOOGLE_CLIENT_ID", "id"),
            ("LAB_GOOGLE_CLIENT_SECRET", "secret"),
        ]))
        .unwrap_err();
        assert!(err.to_string().contains("LAB_AUTH_ADMIN_EMAIL"));
    }

    #[test]
    fn admin_email_normalizes_case_and_trims_whitespace() {
        let cfg = AuthConfig::from_sources(fake_env_with_many([
            ("LAB_AUTH_MODE", "oauth"),
            ("LAB_PUBLIC_URL", "https://lab.example.com"),
            ("LAB_GOOGLE_CLIENT_ID", "id"),
            ("LAB_GOOGLE_CLIENT_SECRET", "secret"),
            ("LAB_AUTH_ADMIN_EMAIL", "  Admin@Example.COM  "),
        ]))
        .unwrap();
        assert_eq!(cfg.admin_email, "admin@example.com");
    }

    #[test]
    fn oauth_mode_parses_allowed_client_redirect_uris() {
        let cfg = AuthConfig::from_sources(fake_env_with_many([
            ("LAB_AUTH_MODE", "oauth"),
            ("LAB_PUBLIC_URL", "https://lab.example.com"),
            ("LAB_GOOGLE_CLIENT_ID", "id"),
            ("LAB_GOOGLE_CLIENT_SECRET", "secret"),
            ("LAB_AUTH_ADMIN_EMAIL", "admin@example.com"),
            (
                "LAB_AUTH_ALLOWED_REDIRECT_URIS",
                "https://callback.example.internal/callback/*,https://claude.ai/api/mcp/auth_callback",
            ),
        ]))
        .unwrap();
        assert_eq!(
            cfg.allowed_client_redirect_uris,
            vec![
                "https://callback.example.internal/callback/*".to_string(),
                "https://claude.ai/api/mcp/auth_callback".to_string()
            ]
        );
    }

    #[test]
    fn default_config_preserves_lab_brand_for_backward_compat() {
        let cfg = AuthConfig::default();
        assert_eq!(cfg.env_prefix, "LAB");
        assert_eq!(cfg.session_cookie_name, "lab_session");
        assert_eq!(
            cfg.scopes_supported,
            vec!["lab".to_string(), "lab:admin".to_string()]
        );
        assert_eq!(cfg.resource_path, "/mcp");
        assert_eq!(cfg.default_scope, "lab");
        assert_eq!(
            cfg.static_token_scopes,
            vec!["lab:read".to_string(), "lab:admin".to_string()]
        );
        assert_eq!(cfg.login_path, "/auth/login");
        assert!(!cfg.enable_dynamic_registration);
        assert!(!cfg.disable_static_token_with_oauth);
    }

    #[test]
    fn builder_env_prefix_resolves_consumer_env_vars() {
        let cfg = AuthConfigBuilder::new()
            .env_prefix("SYSLOG_MCP")
            .session_cookie_name("syslog_session")
            .scopes_supported(vec!["syslog:read".to_string(), "syslog:admin".to_string()])
            .default_scope("syslog:read")
            .static_token_scopes(vec!["syslog:read".to_string(), "syslog:admin".to_string()])
            .disable_static_token_with_oauth(true)
            .build_from_sources(fake_env_with_many([
                ("SYSLOG_MCP_AUTH_MODE", "oauth"),
                ("SYSLOG_MCP_PUBLIC_URL", "https://syslog.example.com"),
                ("SYSLOG_MCP_GOOGLE_CLIENT_ID", "id"),
                ("SYSLOG_MCP_GOOGLE_CLIENT_SECRET", "secret"),
                ("SYSLOG_MCP_AUTH_ADMIN_EMAIL", "admin@example.com"),
            ]))
            .unwrap();
        assert!(matches!(cfg.mode, AuthMode::OAuth));
        assert_eq!(cfg.env_prefix, "SYSLOG_MCP");
        assert_eq!(cfg.session_cookie_name, "syslog_session");
        assert_eq!(cfg.default_scope, "syslog:read");
        assert!(cfg.disable_static_token_with_oauth);
        assert_eq!(
            cfg.scopes_supported,
            vec!["syslog:read".to_string(), "syslog:admin".to_string()]
        );
    }

    #[test]
    fn builder_lab_env_vars_ignored_when_prefix_is_overridden() {
        // Vars use LAB_*; builder is set to SYSLOG_MCP — so AUTH_MODE goes
        // unread, defaults to bearer, and PUBLIC_URL stays None.
        let cfg = AuthConfigBuilder::new()
            .env_prefix("SYSLOG_MCP")
            .build_from_sources(fake_env_with_many([
                ("LAB_AUTH_MODE", "oauth"),
                ("LAB_PUBLIC_URL", "https://lab.example.com"),
                ("LAB_GOOGLE_CLIENT_ID", "id"),
                ("LAB_GOOGLE_CLIENT_SECRET", "secret"),
                ("LAB_AUTH_ADMIN_EMAIL", "admin@example.com"),
            ]))
            .unwrap();
        assert!(matches!(cfg.mode, AuthMode::Bearer));
        assert!(cfg.public_url.is_none());
    }

    #[test]
    fn builder_validates_resource_path_starts_with_slash() {
        let err = AuthConfigBuilder::new()
            .resource_path("mcp")
            .build_from_sources(Vec::<(String, String)>::new())
            .unwrap_err();
        assert!(err.to_string().contains("resource_path"));
    }

    #[test]
    fn builder_validates_login_path_starts_with_slash() {
        let err = AuthConfigBuilder::new()
            .login_path("auth/login")
            .build_from_sources(Vec::<(String, String)>::new())
            .unwrap_err();
        assert!(err.to_string().contains("login_path"));
    }

    fn fake_env_with(key: &'static str, value: &'static str) -> Vec<(String, String)> {
        vec![(key.to_string(), value.to_string())]
    }

    fn fake_env_with_many<const N: usize>(
        pairs: [(&'static str, &'static str); N],
    ) -> Vec<(String, String)> {
        pairs
            .into_iter()
            .map(|(key, value)| (key.to_string(), value.to_string()))
            .collect()
    }
}