Merge pull request #42 from rhysmcneill/feature/hmrc-compliance

Feature/hmrc compliance

Author: rhysmcneill

.dockerignore

@@ -18,7 +18,7 @@ node_modules/
 vendor/
 
 # Docker secrets
-docker/secrets/*.txt
+docker/secrets/*
 
 # CSS output (generated file)
 web/static/css/output.css

.gitattributes

@@ -0,0 +1 @@
+docker/secrets/** filter=git-crypt diff=git-crypt

.gitignore

@@ -25,7 +25,7 @@ tmp/
 .air.toml
 
 # Docker secrets
-docker/secrets/*.txt
+docker/secrets/
 
 # HMRC files
 docs/*.json

.gitleaks.toml

@@ -0,0 +1,15 @@
+title = "Dividr Gitleaks Config"
+
+[extend]
+useDefault = true
+
+# Block specific paths - these should NEVER contain secrets
+[[rules]]
+id = "block-secrets-folder"
+description = "Prevent committing docker/secrets/ directory"
+path = '''docker/secrets/'''
+
+[[rules]]
+id = "block-test-data"
+description = "Prevent committing test data with credentials"
+path = '''docs/.*\.json$'''

.pre-commit-config.yaml

@@ -29,6 +29,20 @@ repos:
         pass_filenames: false
         files: \.go$
 
+      - id: block-secrets-folder
+        name: Block docker/secrets/ directory
+        entry: bash -c 'if git diff --cached --name-only | grep -q "^docker/secrets/"; then echo "ERROR - Files in docker/secrets/ should never be committed!"; exit 1; fi'
+        language: system
+        pass_filenames: false
+        always_run: true
+
+      - id: block-test-data
+        name: Block test data files
+        entry: bash -c 'if git diff --cached --name-only | grep -qE "^docs/.*\.json$"; then echo "ERROR - Test data files in docs/ should never be committed!"; exit 1; fi'
+        language: system
+        pass_filenames: false
+        always_run: true
+
   # General file quality
   - repo: https://github.com/pre-commit/pre-commit-hooks
     rev: v2.3.0

internal/config/config.go

@@ -12,39 +12,41 @@ import (
 )
 
 type Config struct {
-	AppEnv           string
-	Port             string
-	DatabaseURL      string
-	LogLevel         string
-	DBMaxConns       int           // Default: 10
-	DBMinConns       int           // Default: 2
-	DBMaxConnIdle    time.Duration // Default: 30 minutes
-	HMRCRedirectURL  string
-	HMRCClientID     string
-	HMRCClientSecret string
+	AppEnv             string
+	Port               string
+	DatabaseURL        string
+	LogLevel           string
+	DBMaxConns         int           // Default: 10
+	DBMinConns         int           // Default: 2
+	DBMaxConnIdle      time.Duration // Default: 30 minutes
+	HMRCRedirectURL    string
+	HMRCClientID       string
+	HMRCClientSecret   string
+	TokenEncryptionKey string
 }
 
 func Load() *Config {
 	// Load .env file if it exists (silently fails if not found)
 	_ = godotenv.Load()
 
 	return &Config{
-		AppEnv:           getEnv("APP_ENV", "dev"),
-		Port:             getEnv("PORT", "8080"),
-		DatabaseURL:      buildDatabaseURL(),
-		LogLevel:         getEnv("LOG_LEVEL", "DEBUG"),
-		DBMaxConns:       getEnvInt("DB_MAX_CONNS", 10),
-		DBMinConns:       getEnvInt("DB_MIN_CONNS", 2),
-		DBMaxConnIdle:    getEnvDuration("DB_MAX_CONN_IDLE", 30*time.Minute),
-		HMRCRedirectURL:  getEnv("HMRC_REDIRECT_URL", "http://localhost:8080/auth/hmrc/callback"),
-		HMRCClientID:     getEnv("HMRC_CLIENT_ID", ""),
-		HMRCClientSecret: getHMRCCLientSecret(),
+		AppEnv:             getEnv("APP_ENV", "dev"),
+		Port:               getEnv("PORT", "8080"),
+		DatabaseURL:        buildDatabaseURL(),
+		LogLevel:           getEnv("LOG_LEVEL", "DEBUG"),
+		DBMaxConns:         getEnvInt("DB_MAX_CONNS", 10),
+		DBMinConns:         getEnvInt("DB_MIN_CONNS", 2),
+		DBMaxConnIdle:      getEnvDuration("DB_MAX_CONN_IDLE", 30*time.Minute),
+		HMRCRedirectURL:    getEnv("HMRC_REDIRECT_URL", "http://localhost:8080/auth/hmrc/callback"),
+		HMRCClientID:       getEnv("HMRC_CLIENT_ID", ""),
+		HMRCClientSecret:   getHMRCCLientSecret(),
+		TokenEncryptionKey: getCryptoKey(),
 	}
 }
 
 func getEnv(key, defaultValue string) string {
 	if value, exists := os.LookupEnv(key); exists {
-		return value
+		return strings.TrimSpace(value)
 	}
 	return defaultValue
 }
@@ -112,6 +114,27 @@ func getHMRCCLientSecret() string {
 	return getEnv("HMRC_CLIENT_SECRET", "")
 }
 
+func getCryptoKey() string {
+	// Try Docker secret first
+	secretPath := "/run/secrets/crypto_key"
+	if data, err := os.ReadFile(secretPath); err == nil {
+		return strings.TrimSpace(string(data))
+	}
+
+	// Try local file for development convenience
+	localSecretPath := "docker/secrets/.crypto_key"
+	if data, err := os.ReadFile(localSecretPath); err == nil {
+		return strings.TrimSpace(string(data))
+	}
+	cwd, _ := os.Getwd()
+	slog.Info("debug: attempting to load secret",
+		"current_dir", cwd,
+		"target_path", localSecretPath,
+	)
+	// Fallback to env var
+	return getEnv("TOKEN_ENCRYPTION_KEY", "")
+}
+
 // getEnvInt reads an integer from env or returns default
 func getEnvInt(key string, defaultVal int) int {
 	if v, exists := os.LookupEnv(key); exists {

internal/database/audit.sql.go

@@ -28,6 +28,10 @@ func Connect(cfg *config.Config) (*Service, error) {
 		return nil, fmt.Errorf("unable to connect to database: %w", err)
 	}
 
+	pool.Config().MaxConns = int32(cfg.DBMaxConns)
+	pool.Config().MinConns = int32(cfg.DBMinConns)
+	pool.Config().MaxConnIdleTime = cfg.DBMaxConnIdle
+
 	// 2. Fast Ping to verify
 	ctx, cancel := context.WithTimeout(context.Background(), 3*time.Second)
 	defer cancel()

internal/database/database.go

@@ -0,0 +1,9 @@
+-- name: CreateAuditEvent :one
+INSERT INTO audit_events (
+    user_id,
+    event_type,
+    ip_address,
+    details
+) VALUES (
+    $1, $2, $3, $4
+) RETURNING id, created_at;