Added thunder oauth & flow libraries

esignet-service/README.md

@@ -9,6 +9,7 @@ A production-grade Go HTTP service with PostgreSQL and Redis integration, struct
 - [Overview](#overview)
 - [Project Structure](#project-structure)
 - [Prerequisites](#prerequisites)
+- [Go modules: ThunderID dependency](#go-modules-thunderid-dependency)
 - [Quickstart](#quickstart)
 - [Configuration](#configuration)
 - [API Reference](#api-reference)
@@ -20,14 +21,16 @@ A production-grade Go HTTP service with PostgreSQL and Redis integration, struct
 
 ## Overview
 
-`esignet-service` is a Go HTTP service running on port **8088**. It provides:
+`esignet-service` is a Go HTTP service running on port **8088** (configurable via `PORT`). It provides:
 
 - Structured JSON logging via `log/slog`
 - PostgreSQL connection pool via `pgx/v5`
 - Redis client via `go-redis/v9`
-- Chi router with request-ID injection, access logging, panic recovery, and gzip compression
+- **Two HTTP modes**
+  - **Standalone** (default): Chi router with request-ID injection, access logging, panic recovery, gzip compression, and the routes below.
+  - **Thunder embed** (optional): If `THUNDER_HOME` is set, the process serves `/ping` and `/health` on a `net/http` mux and registers ThunderID OAuth and flow routes via [`embed.WireThunder`](https://github.com/anushasunkada/thunder/tree/public-package/backend/pkg/embed) from the pinned Thunder module (see [Go modules: ThunderID dependency](#go-modules-thunderid-dependency)).
 - A deep health endpoint that concurrently pings all backing services
-- Graceful shutdown on `SIGINT`/`SIGTERM`
+- Graceful shutdown on `SIGINT`/`SIGTERM` (cleanup runs on all exit paths; `main` delegates to `run()` which returns an exit code instead of calling `os.Exit` before defers)
 - Multi-stage Docker build with a minimal Alpine production image
 
 ---
@@ -38,28 +41,33 @@ A production-grade Go HTTP service with PostgreSQL and Redis integration, struct
 .
 ├── cmd/
 │   └── esignet/
-│       └── main.go              # Entrypoint — wires config, logger, DB, Redis, server
+│       └── main.go              # Entrypoint — config, logger, DB, Redis, std server or Thunder mux
 ├── internal/
+│   ├── authn/
+│   │   └── provider.go          # Authn provider passed to Thunder embed.WireThunder
 │   ├── config/
-│   │   └── config.go            # Env-var configuration (envconfig)
+│   │   └── config.go            # Env-var configuration (envconfig), incl. optional Thunder
 │   ├── db/
 │   │   └── postgres.go          # pgx/v5 connection pool + Ping
 │   ├── cache/
 │   │   └── redis.go             # go-redis/v9 client + Ping
 │   ├── middleware/
-│   │   └── middleware.go        # RequestID · Logger · Recoverer
+│   │   └── middleware.go        # RequestID · Logger · Recoverer (standalone stack)
 │   ├── handler/
 │   │   └── health.go            # GET /health — concurrent dependency checks
-│   └── server/
-│       └── server.go            # Chi router, route registration, graceful shutdown
+│   ├── server/
+│   │   └── server.go            # Chi router, route registration, graceful shutdown
+│   └── thunderembed/
+│       └── server.go            # Optional ThunderID mux + WireThunder when THUNDER_HOME is set
 ├── pkg/
 │   └── logger/
 │       └── logger.go            # slog JSON/text handler factory
 ├── Dockerfile                   # Multi-stage: dev → builder → production
 ├── compose.yaml                 # Full local stack: app + postgres + redis
 ├── Makefile                     # Developer targets
-├── go.mod
-└── .env.example                 # All supported environment variables with defaults
+├── go.mod                       # Pins ThunderID; see Thunder dependency section
+├── config.yaml.example          # Optional YAML template for local/docs (env vars are canonical)
+└── .env.example                 # Supported environment variables with defaults
 ```
 
 ---
@@ -68,12 +76,55 @@ A production-grade Go HTTP service with PostgreSQL and Redis integration, struct
 
 | Tool | Version | Purpose |
 |---|---|---|
-| Go | 1.23+ | Build and run the service |
+| Go | 1.26+ | Build and run the service (matches `go.mod`) |
 | Docker + Compose | v2 | Local backing services and container builds |
 | Make | any | Convenience targets |
 
 ---
 
+## Go modules: ThunderID dependency
+
+The service imports ThunderID as **`github.com/thunder-id/thunderid`** (for example `pkg/embed` in Thunder embed mode). Upstream development often tracks a **fork** that hosts the embed-friendly `backend/` tree on branch **`public-package`**:
+
+- Web UI (for context only — not pasted into `go.mod`): [github.com/anushasunkada/thunder/tree/public-package/backend/pkg](https://github.com/anushasunkada/thunder/tree/public-package/backend/pkg)
+
+### What goes in `go.mod`
+
+Go does **not** support raw `https://github.com/.../tree/...` URLs in `go.mod`. Use a **module path** and **version** (or `replace`):
+
+1. **`require`** — pin the logical module `github.com/thunder-id/thunderid` to a **pseudo-version** resolved from the fork (commit time + short hash).
+2. **`replace`** — map that module to the fork’s **`backend`** subdirectory module, which Go fetches as `github.com/anushasunkada/thunder/backend` (repository `thunder`, subdir `backend`, same `module github.com/thunder-id/thunderid` line in `backend/go.mod`).
+
+Example shape (exact versions change when you refresh the pin):
+
+```go
+require github.com/thunder-id/thunderid v0.0.0-20260514111244-7975af7f6646
+
+replace github.com/thunder-id/thunderid => github.com/anushasunkada/thunder/backend v0.0.0-20260514111244-7975af7f6646
+```
+
+### Move the pin to the latest `public-package` commit
+
+```bash
+cd esignet-service
+go get github.com/anushasunkada/thunder/backend@public-package
+go mod tidy
+```
+
+Commit the updated `go.mod` and `go.sum` when you intentionally upgrade Thunder.
+
+### Work against a local Thunder checkout
+
+Temporarily point `replace` at your machine (path must reach the directory that contains Thunder’s `go.mod`, usually `backend/`):
+
+```go
+replace github.com/thunder-id/thunderid => /absolute/or/relative/path/to/thunder/backend
+```
+
+Remove or swap the `replace` before pushing if CI should use the remote fork instead.
+
+---
+
 ## Quickstart
 
 ```bash
@@ -84,13 +135,15 @@ cd esignet-service
 # 2. Copy the example env file
 cp .env.example .env
 
-# 3. Pull Go dependencies
+# 3. Pull Go dependencies (downloads the pinned Thunder fork; see [Go modules: ThunderID dependency](#go-modules-thunderid-dependency))
 go mod tidy
 
-# 4a. Start everything with Docker Compose (app + postgres + redis)
+# 4. Optional: Thunder embed — set THUNDER_HOME in .env to a Thunder deployment directory (see Configuration)
+
+# 5a. Start everything with Docker Compose (app + postgres + redis)
 make up
 
-# 4b. OR start only the backing services and run the server locally
+# 5b. OR start only the backing services and run the server locally
 make db redis   # starts postgres + redis in Docker
 make dev        # go run ./cmd/esignet
 ```
@@ -144,10 +197,20 @@ All configuration is supplied through environment variables. Copy `.env.example`
 | `LOG_LEVEL` | `info` | `debug` · `info` · `warn` · `error` |
 | `LOG_FORMAT` | `json` | `json` · `text` |
 
+### Thunder embed (optional)
+
+When **`THUNDER_HOME`** is non-empty after trimming whitespace, the binary uses **`internal/thunderembed`**: a `net/http.ServeMux` with the same `/ping` and `/health` handlers as standalone mode, plus Thunder routes from **`embed.WireThunder`**. Point `THUNDER_HOME` at a Thunder **deployment directory** on disk (the layout Thunder expects for config and assets — see ThunderID / fork docs under `pkg/embed`).
+
+| Variable | Default | Description |
+|---|---|---|
+| `THUNDER_HOME` | *(empty)* | If set, enables Thunder embed mode; if empty, the standalone Chi stack is used |
+
 ---
 
 ## API Reference
 
+In **standalone** mode, the routes below are the primary application surface. In **Thunder embed** mode, **`GET /ping`** and **`GET /health`** behave the same; additional OAuth, flow, and related paths are registered by Thunder (`embed.WireThunder`). Consult the ThunderID `pkg/` README on your pinned fork for those surfaces.
+
 ### `GET /ping`
 
 Lightweight liveness probe. No database or cache calls are made. Use this for high-frequency load-balancer checks.
@@ -187,9 +250,7 @@ Deep readiness probe. Pings PostgreSQL and Redis concurrently within a 5-second
 }
 ```
 
-Every response includes `X-Request-ID` in the response headers.
-
----
+In **standalone** mode, responses from the Chi stack include `X-Request-ID` (middleware). In **Thunder embed** mode, `/ping` and `/health` do not go through that Chi middleware; Thunder-registered routes follow Thunder’s own HTTP behavior.
 
 ## Development
 
@@ -200,7 +261,7 @@ make dev          # go run ./cmd/esignet  (fastest inner loop)
 make build        # compile → bin/esignet
 make run          # build + run the binary
 make test         # go test -race -cover ./...
-make lint         # golangci-lint run
+make lint         # golangci-lint (via `go run …`; needs network on first run)
 make format       # go fmt ./...
 make tidy         # go mod tidy
 make clean        # remove bin/

esignet-service/cmd/esignet/main.go

@@ -1,3 +1,4 @@
+// Command esignet is the esignet HTTP service entrypoint.
 package main
 
 import (
@@ -6,22 +7,29 @@ import (
 	"log/slog"
 	"os"
 	"os/signal"
+	"strings"
 	"syscall"
 
 	"github.com/mosip/esignet/internal/cache"
 	"github.com/mosip/esignet/internal/config"
 	"github.com/mosip/esignet/internal/db"
+	"github.com/mosip/esignet/internal/handler"
 	"github.com/mosip/esignet/internal/server"
+	"github.com/mosip/esignet/internal/thunderembed"
 	"github.com/mosip/esignet/pkg/logger"
 )
 
 func main() {
+	os.Exit(run())
+}
+
+func run() int {
 	// ── 1. Configuration ─────────────────────────────────────────────────────
 	cfg, err := config.Load()
 	if err != nil {
 		// slog default is not yet initialised; fall back to stdlib.
 		slog.Error("failed to load config", slog.String("error", err.Error()))
-		os.Exit(1)
+		return 1
 	}
 
 	// ── 2. Logger ────────────────────────────────────────────────────────────
@@ -41,51 +49,80 @@ func main() {
 	postgres, err := db.NewPostgres(ctx, cfg.Postgres, log)
 	if err != nil {
 		log.Error("postgres init failed", slog.String("error", err.Error()))
-		os.Exit(1)
+		return 1
 	}
 	defer postgres.Close()
 
 	// ── 5. Redis ─────────────────────────────────────────────────────────────
 	redisClient, err := cache.NewRedis(ctx, cfg.Redis, log)
 	if err != nil {
 		log.Error("redis init failed", slog.String("error", err.Error()))
-		os.Exit(1)
+		return 1
 	}
 	defer func() {
 		if err := redisClient.Close(); err != nil {
 			log.Warn("redis close error", slog.String("error", err.Error()))
 		}
 	}()
 
+	pingers := map[string]handler.Pinger{
+		"postgres": postgres,
+		"redis":    redisClient,
+	}
+
 	// ── 6. HTTP Server ───────────────────────────────────────────────────────
-	srv := server.New(cfg.Server, server.Dependencies{
-		DB:    postgres,
-		Cache: redisClient,
-	}, log)
+	thunderHome := strings.TrimSpace(cfg.Thunder.Home)
+	var (
+		srvStd *server.Server
+		srvEmb *thunderembed.Server
+	)
+	if thunderHome != "" {
+		srvEmb, err = thunderembed.NewServer(cfg, log, pingers)
+		if err != nil {
+			log.Error("thunder embed init failed", slog.String("error", err.Error()))
+			return 1
+		}
+	} else {
+		srvStd = server.New(cfg.Server, server.Dependencies{
+			DB:    postgres,
+			Cache: redisClient,
+		}, log)
+	}
 
-	// Start server in a goroutine so we can listen for shutdown signals below.
 	srvErr := make(chan error, 1)
 	go func() {
-		srvErr <- srv.Start()
+		if srvEmb != nil {
+			srvErr <- srvEmb.Start()
+			return
+		}
+		srvErr <- srvStd.Start()
 	}()
 
 	// ── 7. Block until signal or server error ────────────────────────────────
 	select {
 	case err := <-srvErr:
 		if err != nil && !errors.Is(err, context.Canceled) {
 			log.Error("server exited with error", slog.String("error", err.Error()))
-			os.Exit(1)
+			return 1
 		}
 	case <-ctx.Done():
 		log.Info("shutdown signal received", slog.String("signal", ctx.Err().Error()))
 	}
 
 	// ── 8. Graceful shutdown ─────────────────────────────────────────────────
-	// Use a fresh background context – the parent ctx is already cancelled.
-	if err := srv.Shutdown(context.Background()); err != nil {
-		log.Error("graceful shutdown failed", slog.String("error", err.Error()))
-		os.Exit(1)
+	shutCtx := context.Background()
+	if srvEmb != nil {
+		if err := srvEmb.Shutdown(shutCtx); err != nil {
+			log.Error("graceful shutdown failed", slog.String("error", err.Error()))
+			return 1
+		}
+	} else {
+		if err := srvStd.Shutdown(shutCtx); err != nil {
+			log.Error("graceful shutdown failed", slog.String("error", err.Error()))
+			return 1
+		}
 	}
 
 	log.Info("esignet service stopped cleanly")
+	return 0
 }

esignet-service/config.yaml.example

@@ -0,0 +1,52 @@
+# ─────────────────────────────────────────────────────────────────────────────
+# esignet-service YAML configuration
+#
+# Copy this file to config.yaml (or any path) and set CONFIG_FILE to point at
+# it.  Values here are defaults; any matching environment variable always wins.
+#
+# Load order (lowest → highest priority):
+#   1. Struct defaults  (hard-coded in the binary)
+#   2. This YAML file
+#   3. Environment variables
+#
+# Usage:
+#   CONFIG_FILE=/etc/esignet/config.yaml ./esignet
+#   CONFIG_FILE=config.yaml make dev
+#
+# Tip: commit a config.yaml for local development; never commit secrets.
+# ─────────────────────────────────────────────────────────────────────────────
+
+# ── HTTP Server ───────────────────────────────────────────────────────────────
+server:
+  port: 8088
+  read_timeout: 15s
+  write_timeout: 15s
+  idle_timeout: 60s
+  shutdown_timeout: 30s
+
+# ── PostgreSQL ────────────────────────────────────────────────────────────────
+postgres:
+  url: postgres://postgres:postgres@localhost:5432/app?sslmode=disable
+  max_conns: 10
+  min_conns: 2
+  max_conn_lifetime: 1h
+  max_conn_idle_time: 30m
+  health_timeout: 5s
+
+# ── Redis ─────────────────────────────────────────────────────────────────────
+redis:
+  addr: localhost:6379
+  password: ""
+  db: 0
+  dial_timeout: 5s
+  read_timeout: 3s
+  write_timeout: 3s
+  pool_size: 10
+  health_timeout: 5s
+
+# ── Logging ───────────────────────────────────────────────────────────────────
+log:
+  # debug | info | warn | error
+  level: info
+  # json | text
+  format: json