101 lines
2.4 KiB
Text
101 lines
2.4 KiB
Text
|
# Email and OAuth configuration contracts
|
||
|
|
#
|
||
|
|
# SecretValue enforces that sensitive fields never contain plaintext:
|
||
|
|
# they must be empty, a '${VAR}' substitution token, or an '@blob' AES-GCM
|
||
|
|
# encrypted value. The Rust side resolves substitutions and decrypts blobs
|
||
|
|
# after loading — never write real secrets in version-controlled files.
|
||
|
|
|
||
|
|
let SecretValue
|
||
|
|
| doc "Sensitive value: must be empty, '${ENV_VAR}', or '@encrypted' — no plaintext"
|
||
|
|
= fun label value =>
|
||
|
|
if std.is_string value then
|
||
|
|
if value == ""
|
||
|
|
|| std.string.is_match "^\\$\\{[A-Za-z_][A-Za-z0-9_]*\\}$" value
|
||
|
|
|| std.string.is_match "^@" value
|
||
|
|
then value
|
||
|
|
else std.contract.blame_with_message
|
||
|
|
"Sensitive field must be empty, '${ENV_VAR}', or '@encrypted' — no plaintext"
|
||
|
|
label
|
||
|
|
else std.contract.blame_with_message "Expected a String" label
|
||
|
|
in
|
||
|
|
|
||
|
|
{
|
||
|
|
SecretValue = SecretValue,
|
||
|
|
|
||
|
|
EmailConfig = {
|
||
|
|
enabled
|
||
|
|
| Bool
|
||
|
|
| default = true,
|
||
|
|
|
||
|
|
provider
|
||
|
|
| String
|
||
|
|
| doc "Email backend: 'console', 'smtp', or 'sendgrid'"
|
||
|
|
| default = "console",
|
||
|
|
|
||
|
|
smtp_host
|
||
|
|
| String
|
||
|
|
| default = "smtp.gmail.com",
|
||
|
|
|
||
|
|
smtp_port
|
||
|
|
| Number
|
||
|
|
| default = 587,
|
||
|
|
|
||
|
|
smtp_username
|
||
|
|
| String
|
||
|
|
| doc "SMTP user — prefer '${SMTP_USERNAME}'"
|
||
|
|
| default = "",
|
||
|
|
|
||
|
|
smtp_password
|
||
|
|
| String
|
||
|
|
| doc "SMTP password — prefer '${SMTP_PASSWORD}' or '@encrypted'"
|
||
|
|
| default = "",
|
||
|
|
|
||
|
|
smtp_use_tls
|
||
|
|
| Bool
|
||
|
|
| default = false,
|
||
|
|
|
||
|
|
smtp_use_starttls
|
||
|
|
| Bool
|
||
|
|
| default = true,
|
||
|
|
|
||
|
|
sendgrid_api_key
|
||
|
|
| String
|
||
|
|
| doc "SendGrid API key — prefer '${SENDGRID_API_KEY}'"
|
||
|
|
| default = "",
|
||
|
|
|
||
|
|
sendgrid_endpoint
|
||
|
|
| String
|
||
|
|
| default = "https://api.sendgrid.com/v3/mail/send",
|
||
|
|
|
||
|
|
from_email
|
||
|
|
| String
|
||
|
|
| doc "Sender address — prefer '${EMAIL_FROM}'"
|
||
|
|
| default = "",
|
||
|
|
|
||
|
|
from_name
|
||
|
|
| String
|
||
|
|
| doc "Sender display name — prefer '${EMAIL_FROM_NAME}'"
|
||
|
|
| default = "",
|
||
|
|
|
||
|
|
template_dir
|
||
|
|
| String
|
||
|
|
| optional,
|
||
|
|
|
||
|
|
email_enabled
|
||
|
|
| Bool
|
||
|
|
| optional,
|
||
|
|
},
|
||
|
|
|
||
|
|
OAuthProvider = {
|
||
|
|
client_id | String | default = "",
|
||
|
|
client_secret | String | default = "",
|
||
|
|
redirect_uri | String | default = "",
|
||
|
|
},
|
||
|
|
|
||
|
|
OAuthConfig = {
|
||
|
|
enabled | Bool | default = false,
|
||
|
|
google | OAuthProvider | optional,
|
||
|
|
github | OAuthProvider | optional,
|
||
|
|
},
|
||
|
|
}
|