add configuration loading

Connection identity and credentials resolve from env only (GERRIT_URL,
GERRIT_USERNAME, GERRIT_TOKEN); behavior resolves from flags with
GERRIT_MCP_* env mirrors, flag winning over mirror, mirror over
default. Zero behavior config yields the read group. All configuration
errors are aggregated into a single report; unknown group names and
empty group lists fail startup.

The behaviorFlag table is the extension point for upcoming options:
tool filters, project scoping, own-changes restriction.

Refs: #3

Author: xobotyi

internal/config/config.go

@@ -0,0 +1,191 @@
+// Package config resolves the server configuration from CLI flags and
+// environment variables. Connection identity and credentials come from
+// environment only (GERRIT_URL, GERRIT_USERNAME, GERRIT_TOKEN); behavior
+// comes from flags, each mirrored by a GERRIT_MCP_* variable with the flag
+// winning when both are set. Zero behavior configuration yields the read
+// capability group only.
+package config
+
+import (
+	"errors"
+	"flag"
+	"fmt"
+	"io"
+	"strings"
+)
+
+// Group is a capability group name: an independent, self-sufficient unit of
+// server capability selected via --groups.
+type Group string
+
+// Capability groups. Each write-capable group bundles the minimal change-read
+// subset it needs to function on its own; enabled groups union.
+const (
+	GroupRead       Group = "read"
+	GroupComment    Group = "comment"
+	GroupTransition Group = "transition"
+)
+
+const defaultGroups = "read"
+
+// Env variable names for connection identity and credentials.
+const (
+	EnvURL      = "GERRIT_URL"
+	EnvUsername = "GERRIT_USERNAME"
+	EnvToken    = "GERRIT_TOKEN"
+)
+
+var (
+	errEnvMissing    = errors.New("required environment variable is not set")
+	errUnknownGroups = errors.New("unknown capability groups")
+	errNoGroups      = errors.New("no capability groups enabled")
+)
+
+// Config is the resolved server configuration.
+type Config struct {
+	// GerritURL is the base URL of the Gerrit instance.
+	GerritURL string
+	// Username authenticates HTTP Basic requests.
+	Username string
+	// Token is the HTTP credential paired with Username.
+	Token string
+	// Groups are the enabled capability groups, deduplicated, in input order.
+	Groups []Group
+}
+
+// behaviorFlag is one CLI flag with its GERRIT_MCP_* env mirror. The flag
+// value wins over the mirror; the mirror wins over the default. New behavior
+// options (tool filters, project scoping, own-changes) register here.
+type behaviorFlag struct {
+	name     string
+	mirror   string
+	usage    string
+	fallback string
+
+	value string `exhaustruct:"optional"`
+}
+
+// Load resolves configuration from CLI arguments and the environment.
+// It reports every configuration error at once.
+func Load(args []string, getenv func(string) string) (*Config, error) {
+	groups := behaviorFlag{
+		name:     "groups",
+		mirror:   "GERRIT_MCP_GROUPS",
+		usage:    "comma-separated capability groups to enable: read, comment, transition",
+		fallback: defaultGroups,
+	}
+
+	if err := resolveFlags(args, getenv, []*behaviorFlag{&groups}); err != nil {
+		return nil, err
+	}
+
+	cfg := &Config{
+		GerritURL: getenv(EnvURL),
+		Username:  getenv(EnvUsername),
+		Token:     getenv(EnvToken),
+		Groups:    nil,
+	}
+
+	errs := missingEnv(cfg)
+
+	parsed, err := parseGroups(groups.value)
+	if err != nil {
+		errs = append(errs, err)
+	}
+
+	cfg.Groups = parsed
+
+	if len(errs) > 0 {
+		return nil, errors.Join(errs...)
+	}
+
+	return cfg, nil
+}
+
+// resolveFlags parses args into the given flags, then fills every flag that
+// was not set explicitly from its env mirror, falling back to its default.
+func resolveFlags(args []string, getenv func(string) string, flags []*behaviorFlag) error {
+	fs := flag.NewFlagSet("go-gerrit-mcp", flag.ContinueOnError)
+	fs.SetOutput(io.Discard)
+
+	for _, bf := range flags {
+		fs.StringVar(&bf.value, bf.name, "", bf.usage)
+	}
+
+	if err := fs.Parse(args); err != nil {
+		return fmt.Errorf("parse flags: %w", err)
+	}
+
+	explicit := make(map[string]bool, len(flags))
+	fs.Visit(func(f *flag.Flag) { explicit[f.Name] = true })
+
+	for _, bf := range flags {
+		if explicit[bf.name] {
+			continue
+		}
+
+		bf.value = bf.fallback
+
+		if v := getenv(bf.mirror); v != "" {
+			bf.value = v
+		}
+	}
+
+	return nil
+}
+
+func missingEnv(cfg *Config) []error {
+	var errs []error
+
+	for _, v := range []struct{ name, value string }{
+		{EnvURL, cfg.GerritURL},
+		{EnvUsername, cfg.Username},
+		{EnvToken, cfg.Token},
+	} {
+		if v.value == "" {
+			errs = append(errs, fmt.Errorf("%w: %s", errEnvMissing, v.name))
+		}
+	}
+
+	return errs
+}
+
+func parseGroups(s string) ([]Group, error) {
+	known := map[Group]bool{GroupRead: true, GroupComment: true, GroupTransition: true}
+
+	var (
+		groups  []Group
+		unknown []string
+		seen    = make(map[Group]bool, len(known))
+	)
+
+	for part := range strings.SplitSeq(s, ",") {
+		name := Group(strings.TrimSpace(part))
+		if name == "" {
+			continue
+		}
+
+		if !known[name] {
+			unknown = append(unknown, string(name))
+
+			continue
+		}
+
+		if !seen[name] {
+			seen[name] = true
+
+			groups = append(groups, name)
+		}
+	}
+
+	if len(unknown) > 0 {
+		return nil, fmt.Errorf("%w: %s (known: read, comment, transition)",
+			errUnknownGroups, strings.Join(unknown, ", "))
+	}
+
+	if len(groups) == 0 {
+		return nil, errNoGroups
+	}
+
+	return groups, nil
+}

internal/config/config_test.go

@@ -0,0 +1,165 @@
+package config_test
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"dev.gaijin.team/go/go-gerrit-mcp/internal/config"
+)
+
+func env(m map[string]string) func(string) string {
+	return func(k string) string { return m[k] }
+}
+
+func secrets() map[string]string {
+	return map[string]string{
+		"GERRIT_URL":      "https://gerrit.example.com",
+		"GERRIT_USERNAME": "bot",
+		"GERRIT_TOKEN":    "s3cret",
+	}
+}
+
+func Test_Load_Groups(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name     string
+		giveArgs []string
+		giveEnv  map[string]string
+		want     []config.Group
+	}{
+		{
+			name:     "zero config defaults to read",
+			giveArgs: nil,
+			giveEnv:  secrets(),
+			want:     []config.Group{config.GroupRead},
+		},
+		{
+			name:     "env mirror applies when flag absent",
+			giveArgs: nil,
+			giveEnv: func() map[string]string {
+				m := secrets()
+
+				m["GERRIT_MCP_GROUPS"] = "comment"
+
+				return m
+			}(),
+			want: []config.Group{config.GroupComment},
+		},
+		{
+			name:     "flag wins over env mirror",
+			giveArgs: []string{"--groups", "transition"},
+			giveEnv: func() map[string]string {
+				m := secrets()
+
+				m["GERRIT_MCP_GROUPS"] = "comment"
+
+				return m
+			}(),
+			want: []config.Group{config.GroupTransition},
+		},
+		{
+			name:     "multiple groups preserve order",
+			giveArgs: []string{"--groups", "comment,read"},
+			giveEnv:  secrets(),
+			want:     []config.Group{config.GroupComment, config.GroupRead},
+		},
+		{
+			name:     "duplicates collapse",
+			giveArgs: []string{"--groups", "read,read,comment"},
+			giveEnv:  secrets(),
+			want:     []config.Group{config.GroupRead, config.GroupComment},
+		},
+		{
+			name:     "whitespace tolerated",
+			giveArgs: []string{"--groups", " read , transition "},
+			giveEnv:  secrets(),
+			want:     []config.Group{config.GroupRead, config.GroupTransition},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			cfg, err := config.Load(tt.giveArgs, env(tt.giveEnv))
+			require.NoError(t, err)
+			assert.Equal(t, tt.want, cfg.Groups)
+		})
+	}
+}
+
+func Test_Load_Errors(t *testing.T) {
+	t.Parallel()
+
+	t.Run("missing secrets aggregated", func(t *testing.T) {
+		t.Parallel()
+
+		_, err := config.Load(nil, env(map[string]string{}))
+		require.Error(t, err)
+		assert.ErrorContains(t, err, "GERRIT_URL")
+		assert.ErrorContains(t, err, "GERRIT_USERNAME")
+		assert.ErrorContains(t, err, "GERRIT_TOKEN")
+	})
+
+	t.Run("single missing secret named alone", func(t *testing.T) {
+		t.Parallel()
+
+		m := secrets()
+		delete(m, "GERRIT_TOKEN")
+
+		_, err := config.Load(nil, env(m))
+		require.Error(t, err)
+		assert.ErrorContains(t, err, "GERRIT_TOKEN")
+		assert.NotContains(t, err.Error(), "GERRIT_URL")
+	})
+
+	t.Run("unknown group named in error", func(t *testing.T) {
+		t.Parallel()
+
+		_, err := config.Load([]string{"--groups", "read,write"}, env(secrets()))
+		require.Error(t, err)
+		assert.ErrorContains(t, err, "unknown capability groups: write")
+	})
+
+	t.Run("empty groups value rejected", func(t *testing.T) {
+		t.Parallel()
+
+		_, err := config.Load([]string{"--groups", ""}, env(secrets()))
+		require.Error(t, err)
+		assert.ErrorContains(t, err, "no capability groups enabled")
+	})
+
+	t.Run("group error and secret error reported together", func(t *testing.T) {
+		t.Parallel()
+
+		m := secrets()
+		delete(m, "GERRIT_URL")
+
+		_, err := config.Load([]string{"--groups", "bogus"}, env(m))
+		require.Error(t, err)
+		assert.ErrorContains(t, err, "GERRIT_URL")
+		assert.ErrorContains(t, err, "unknown capability groups: bogus")
+	})
+
+	t.Run("unknown flag rejected", func(t *testing.T) {
+		t.Parallel()
+
+		_, err := config.Load([]string{"--bogus"}, env(secrets()))
+		require.Error(t, err)
+		assert.ErrorContains(t, err, "parse flags")
+	})
+}
+
+func Test_Load_Connection(t *testing.T) {
+	t.Parallel()
+
+	cfg, err := config.Load(nil, env(secrets()))
+	require.NoError(t, err)
+
+	assert.Equal(t, "https://gerrit.example.com", cfg.GerritURL)
+	assert.Equal(t, "bot", cfg.Username)
+	assert.Equal(t, "s3cret", cfg.Token)
+}