v0.20.0 mtls hardening, fail-closed config, startup warnings, sink fixes

internal/source/console/console.go

@@ -13,7 +13,6 @@ import (
 	"logwisp/internal/session"
 	"logwisp/internal/source"
 
-	lconfig "github.com/lixenwraith/config"
 	"github.com/lixenwraith/log"
 )
 
@@ -70,7 +69,7 @@ func NewConsoleSourcePlugin(
 	opts := &config.ConsoleSourceOptions{}
 
 	// Scan config map
-	if err := lconfig.ScanMap(configMap, opts); err != nil {
+	if err := config.Scan(configMap, opts); err != nil {
 		return nil, fmt.Errorf("failed to parse config: %w", err)
 	}
 
@@ -221,4 +220,4 @@ func (s *ConsoleSource) publish(entry core.LogEntry) {
 				"component", "console_source")
 		}
 	}
-}
+}

internal/source/file/file.go

@@ -75,7 +75,7 @@ func NewFileSourcePlugin(
 	opts := &config.FileSourceOptions{}
 
 	// Use lconfig to scan map into struct (overriding defaults)
-	if err := lconfig.ScanMap(configMap, opts); err != nil {
+	if err := config.Scan(configMap, opts); err != nil {
 		return nil, fmt.Errorf("failed to parse config: %w", err)
 	}
 

internal/source/httpchain/httpchain.go

@@ -85,7 +85,7 @@ func NewHTTPChainSourcePlugin(
 		Host:      "0.0.0.0",
 		TrustNode: true,
 	}
-	if err := lconfig.ScanMap(configMap, opts); err != nil {
+	if err := config.Scan(configMap, opts); err != nil {
 		return nil, fmt.Errorf("failed to parse config: %w", err)
 	}
 	if err := lconfig.Port(opts.Port); err != nil {
@@ -135,19 +135,8 @@ func NewHTTPChainSourcePlugin(
 		"tls", tlsCfg != nil,
 		"mtls", tlsCfg != nil && tlsCfg.ClientAuth == tls.RequireAndVerifyClientCert,
 		"auth", authPolicy.Describe())
-	if authPolicy.Unrestricted() {
-		logger.Warn("msg", "Auth policy admits any identity the configured CA vouches for",
-			"component", "http_chain_source",
-			"instance_id", id,
-			"hint", "set auth.allow or auth.allow_patterns to authorize named peers")
-	}
-	if authPolicy.BindsNode() {
-		logger.Info("msg", "Node labels bound to peer identity; trust_node is ignored",
-			"component", "http_chain_source",
-			"instance_id", id,
-			"node_binding", authPolicy.NodeBinding(),
-			"trust_node", opts.TrustNode)
-	}
+	tlsx.LogWarnings(logger, "http_chain_source", id, opts.TLS, true)
+	authPolicy.LogStartup(logger, "http_chain_source", id, opts.TrustNode)
 	return s, nil
 }
 

internal/source/null/null.go

@@ -5,6 +5,7 @@ import (
 	"sync/atomic"
 	"time"
 
+	"logwisp/internal/config"
 	"logwisp/internal/core"
 	"logwisp/internal/plugin"
 	"logwisp/internal/session"
@@ -47,6 +48,9 @@ func NewNullSourcePlugin(
 	logger *log.Logger,
 	proxy *session.Proxy,
 ) (source.Source, error) {
+	if err := config.Scan(configMap, &config.NullSourceOptions{}); err != nil {
+		return nil, fmt.Errorf("failed to parse config: %w", err)
+	}
 	ns := &NullSource{
 		id:          id,
 		proxy:       proxy,
@@ -122,4 +126,4 @@ func (ns *NullSource) GetStats() source.SourceStats {
 		LastEntryTime: lastEntry,
 		Details:       map[string]any{},
 	}
-}
+}

internal/source/random/random.go

@@ -76,7 +76,7 @@ func NewRandomSourcePlugin(
 	}
 
 	// Scan config map
-	if err := lconfig.ScanMap(configMap, opts); err != nil {
+	if err := config.Scan(configMap, opts); err != nil {
 		return nil, fmt.Errorf("failed to parse config: %w", err)
 	}
 
@@ -355,4 +355,4 @@ func (rs *RandomSource) publish(entry core.LogEntry) {
 			rs.droppedEntries.Add(1)
 		}
 	}
-}
+}

internal/source/tcpchain/tcpchain.go

@@ -80,7 +80,7 @@ func NewTCPChainSourcePlugin(
 		Host:      "0.0.0.0",
 		TrustNode: true,
 	}
-	if err := lconfig.ScanMap(configMap, opts); err != nil {
+	if err := config.Scan(configMap, opts); err != nil {
 		return nil, fmt.Errorf("failed to parse config: %w", err)
 	}
 	if err := lconfig.Port(opts.Port); err != nil {
@@ -121,19 +121,8 @@ func NewTCPChainSourcePlugin(
 		"tls", tlsCfg != nil,
 		"mtls", tlsCfg != nil && tlsCfg.ClientAuth == tls.RequireAndVerifyClientCert,
 		"auth", authPolicy.Describe())
-	if authPolicy.Unrestricted() {
-		logger.Warn("msg", "Auth policy admits any identity the configured CA vouches for",
-			"component", "tcp_chain_source",
-			"instance_id", id,
-			"hint", "set auth.allow or auth.allow_patterns to authorize named peers")
-	}
-	if authPolicy.BindsNode() {
-		logger.Info("msg", "Node labels bound to peer identity; trust_node is ignored",
-			"component", "tcp_chain_source",
-			"instance_id", id,
-			"node_binding", authPolicy.NodeBinding(),
-			"trust_node", opts.TrustNode)
-	}
+	tlsx.LogWarnings(logger, "tcp_chain_source", id, opts.TLS, true)
+	authPolicy.LogStartup(logger, "tcp_chain_source", id, opts.TrustNode)
 	return s, nil
 }