irdb/ui/src/App/Config.php

<?php

declare(strict_types=1);

namespace App\App;

/**
 * Startup-time configuration validation.
 *
 * SPEC §M08.9: log a clear error and exit non-zero if mandatory env vars
 * are missing, or if both auth methods are disabled. Done at boot rather
 * than first request so misconfigurations crash on `docker compose up`,
 * not on the first user click.
 */
final class Config
{
    /**
     * @param array<string, mixed> $settings
     */
    public static function validateOrExit(array $settings): void
    {
        $errors = [];

        if (($settings['ui_service_token'] ?? '') === '') {
            $errors[] = 'UI_SERVICE_TOKEN is empty (required to call the api)';
        }
        if (($settings['api_base_url'] ?? '') === '') {
            $errors[] = 'API_BASE_URL is empty (e.g. http://api:8081)';
        }

        $oidcEnabled = (bool) ($settings['oidc_enabled'] ?? false);
        $localEnabled = (bool) ($settings['local_admin_enabled'] ?? false);
        if (!$oidcEnabled && !$localEnabled) {
            $errors[] = 'no auth method enabled — set OIDC_ENABLED=true or LOCAL_ADMIN_ENABLED=true';
        }

        if ($localEnabled) {
            if (($settings['local_admin_username'] ?? '') === '') {
                $errors[] = 'LOCAL_ADMIN_USERNAME is empty but LOCAL_ADMIN_ENABLED=true';
            }
            if (($settings['local_admin_password_hash'] ?? '') === '') {
                $errors[] = 'LOCAL_ADMIN_PASSWORD_HASH is empty but LOCAL_ADMIN_ENABLED=true';
            }
        }
        if ($oidcEnabled) {
            foreach (['oidc_issuer', 'oidc_client_id', 'oidc_client_secret', 'oidc_redirect_uri'] as $key) {
                if (($settings[$key] ?? '') === '') {
                    $errors[] = sprintf('%s is empty but OIDC_ENABLED=true', strtoupper($key));
                }
            }
        }

        if ($errors === []) {
            return;
        }

        fwrite(STDERR, "[ui] startup configuration error(s):\n");
        foreach ($errors as $err) {
            fwrite(STDERR, "  - {$err}\n");
        }
        exit(1);
    }
}