update admin und löschung

internal/web/auth.go

@@ -16,6 +16,8 @@ import (
 	"os"
 	"strings"
 	"time"
+
+	"go-htmx-chat/internal/store"
 )
 
 type AuthMode string
@@ -26,13 +28,15 @@ const (
 )
 
 type AuthConfig struct {
-	Mode          AuthMode
-	Issuer        string
-	ClientID      string
-	ClientSecret  string
-	RedirectURL   string
-	Scopes        []string
-	SessionSecret []byte
+	Mode             AuthMode
+	Issuer           string
+	ClientID         string
+	ClientSecret     string
+	RedirectURL      string
+	Scopes           []string
+	SessionSecret    []byte
+	AdminMatchers    []string
+	RoomCreatorRoles []store.Role
 }
 
 type oidcDiscovery struct {
@@ -90,13 +94,15 @@ func AuthConfigFromEnv(logger *slog.Logger) (AuthConfig, error) {
 	}
 
 	cfg := AuthConfig{
-		Mode:          mode,
-		Issuer:        strings.TrimRight(strings.TrimSpace(os.Getenv("OIDC_ISSUER")), "/"),
-		ClientID:      strings.TrimSpace(os.Getenv("OIDC_CLIENT_ID")),
-		ClientSecret:  strings.TrimSpace(os.Getenv("OIDC_CLIENT_SECRET")),
-		RedirectURL:   strings.TrimSpace(os.Getenv("OIDC_REDIRECT_URL")),
-		Scopes:        splitScopes(getenv("OIDC_SCOPES", "openid profile email")),
-		SessionSecret: secretBytes,
+		Mode:             mode,
+		Issuer:           strings.TrimRight(strings.TrimSpace(os.Getenv("OIDC_ISSUER")), "/"),
+		ClientID:         strings.TrimSpace(os.Getenv("OIDC_CLIENT_ID")),
+		ClientSecret:     strings.TrimSpace(os.Getenv("OIDC_CLIENT_SECRET")),
+		RedirectURL:      strings.TrimSpace(os.Getenv("OIDC_REDIRECT_URL")),
+		Scopes:           splitScopes(getenv("OIDC_SCOPES", "openid profile email")),
+		SessionSecret:    secretBytes,
+		AdminMatchers:    splitCSV(os.Getenv("CHAT_ADMINS")),
+		RoomCreatorRoles: parseRoles(getenv("ROOM_CREATE_ROLES", "admin,moderator")),
 	}
 	if cfg.Mode == AuthModeOIDC {
 		if cfg.Issuer == "" || cfg.ClientID == "" || cfg.ClientSecret == "" || cfg.RedirectURL == "" {
@@ -356,3 +362,34 @@ func clearCookie(w http.ResponseWriter, name, path string) {
 func isSecure(r *http.Request) bool {
 	return r.TLS != nil || strings.EqualFold(r.Header.Get("X-Forwarded-Proto"), "https")
 }
+
+func splitCSV(s string) []string {
+	parts := strings.Split(s, ",")
+	out := make([]string, 0, len(parts))
+	for _, p := range parts {
+		p = strings.TrimSpace(p)
+		if p != "" {
+			out = append(out, p)
+		}
+	}
+	return out
+}
+
+func parseRoles(s string) []store.Role {
+	parts := strings.Split(s, ",")
+	out := make([]store.Role, 0, len(parts))
+	for _, p := range parts {
+		switch store.Role(strings.ToLower(strings.TrimSpace(p))) {
+		case store.RoleAdmin:
+			out = append(out, store.RoleAdmin)
+		case store.RoleModerator:
+			out = append(out, store.RoleModerator)
+		case store.RoleUser:
+			out = append(out, store.RoleUser)
+		}
+	}
+	if len(out) == 0 {
+		return []store.Role{store.RoleAdmin}
+	}
+	return out
+}