v0.12.0 migrate sqlite3 to psql18, updated auth, deploy docs, account and replay updates

cmd/chess-server/secret.go

@@ -0,0 +1,49 @@
+package main
+
+import (
+	"bytes"
+	"fmt"
+	"io"
+	"os"
+)
+
+const (
+	minJWTSecretLen = 32
+	maxJWTSecretLen = 4096
+)
+
+// loadJWTSecret reads a signing key file. The file must be a regular file
+// readable only by its owner, like an SSH private key; trailing line endings
+// are ignored so `openssl rand -base64 48 > file` works as-is.
+func loadJWTSecret(path string) ([]byte, error) {
+	file, err := os.Open(path)
+	if err != nil {
+		return nil, fmt.Errorf("open JWT secret file: %w", err)
+	}
+	defer file.Close()
+
+	info, err := file.Stat()
+	if err != nil {
+		return nil, fmt.Errorf("stat JWT secret file: %w", err)
+	}
+	if !info.Mode().IsRegular() {
+		return nil, fmt.Errorf("JWT secret file %s is not a regular file", path)
+	}
+	if perm := info.Mode().Perm(); perm&0o077 != 0 {
+		return nil, fmt.Errorf("JWT secret file %s has mode %04o; it must not be accessible by group or others (chmod 600)",
+			path, perm)
+	}
+
+	data, err := io.ReadAll(io.LimitReader(file, maxJWTSecretLen+1))
+	if err != nil {
+		return nil, fmt.Errorf("read JWT secret file: %w", err)
+	}
+	if len(data) > maxJWTSecretLen {
+		return nil, fmt.Errorf("JWT secret file %s exceeds %d bytes", path, maxJWTSecretLen)
+	}
+	secret := bytes.TrimRight(data, "\r\n")
+	if len(secret) < minJWTSecretLen {
+		return nil, fmt.Errorf("JWT secret file %s must contain at least %d bytes", path, minJWTSecretLen)
+	}
+	return secret, nil
+}