feat(otp): replace inline OTPaaS calls with provider abstraction

.env.example

@@ -1,6 +1,10 @@
 TW_ENV=development
 TW_LOG_LEVEL=INFO
 
+TW_OTP_PROVIDER=mock
+TW_ALLOWED_EMAIL_DOMAINS=@schools.gov.sg
+TW_MOCK_ALLOWED_EMAILS=tracy_lim@schools.gov.sg
+
 # TW_VITE_DEV_SERVER_URL=http://localhost:5173
 # TW_BUNDLE_DIRECTORY=dist
 

server/cmd/tw/main.go

@@ -15,6 +15,7 @@ import (
 	"github.com/String-sg/teacher-workspace/server/internal/config"
 	"github.com/String-sg/teacher-workspace/server/internal/handler"
 	"github.com/String-sg/teacher-workspace/server/internal/middleware"
+	"github.com/String-sg/teacher-workspace/server/internal/otp"
 	"github.com/String-sg/teacher-workspace/server/pkg/dotenv"
 	"golang.org/x/sync/errgroup"
 )
@@ -58,7 +59,23 @@ func main() {
 }
 
 func run(ctx context.Context, cfg *config.Config) error {
-	h, err := handler.New(cfg)
+	var otpProvider otp.Provider
+	switch cfg.OTPProvider {
+	case config.ProviderMock:
+		otpProvider = otp.NewMockProvider(cfg.Mock.AllowedEmails)
+	case config.ProviderOTPaaS:
+		otpProvider = otp.NewOTPaaSProvider(
+			cfg.OTPaaS.Host,
+			cfg.OTPaaS.ID,
+			cfg.OTPaaS.Namespace,
+			cfg.OTPaaS.Secret,
+			cfg.OTPaaS.Timeout,
+		)
+	default:
+		return fmt.Errorf("unsupported OTP provider: %q", cfg.OTPProvider)
+	}
+
+	h, err := handler.New(cfg, otpProvider)
 	if err != nil {
 		return fmt.Errorf("create handler: %w", err)
 	}

server/internal/config/config.go

@@ -10,22 +10,30 @@ import (
 )
 
 type Environment string
+type Provider string
 
 const (
 	EnvironmentDevelopment Environment = "development"
 	EnvironmentProduction  Environment = "production"
+
+	ProviderOTPaaS Provider = "otpaas"
+	ProviderMock   Provider = "mock"
 )
 
 // Config is the main configuration for the application.
 type Config struct {
 	Environment Environment `dotenv:"TW_ENV"`
 	LogLevel    slog.Level  `dotenv:"TW_LOG_LEVEL"`
 
+	OTPProvider         Provider `dotenv:"TW_OTP_PROVIDER"`
+	AllowedEmailDomains []string `dotenv:"TW_ALLOWED_EMAIL_DOMAINS"`
+
 	ViteDevServerURL *url.URL `dotenv:"TW_VITE_DEV_SERVER_URL"`
 	BundleDirectory  string   `dotenv:"TW_BUNDLE_DIRECTORY"`
 
 	Server ServerConfig `dotenv:",squash"`
 	OTPaaS OTPaaSConfig `dotenv:",squash"`
+	Mock   MockConfig   `dotenv:",squash"`
 }
 
 // ServerConfig represents the configuration for the HTTP server.
@@ -47,12 +55,19 @@ type OTPaaSConfig struct {
 	Timeout time.Duration `dotenv:"TW_OTPAAS_TIMEOUT"`
 }
 
+type MockConfig struct {
+	AllowedEmails []string `dotenv:"TW_MOCK_ALLOWED_EMAILS"`
+}
+
 // Default returns the default configuration for the application.
 func Default() *Config {
 	return &Config{
 		Environment: EnvironmentDevelopment,
 		LogLevel:    slog.LevelInfo,
 
+		OTPProvider:         ProviderOTPaaS,
+		AllowedEmailDomains: []string{"@schools.gov.sg"},
+
 		ViteDevServerURL: must(url.Parse("http://localhost:5173")),
 		BundleDirectory:  "dist",
 
@@ -72,6 +87,9 @@ func Default() *Config {
 			Secret:    "",
 			Timeout:   10 * time.Second,
 		},
+		Mock: MockConfig{
+			AllowedEmails: nil,
+		},
 	}
 }
 
@@ -82,6 +100,12 @@ func (cfg *Config) Validate() error {
 		errs = append(errs, fmt.Errorf("TW_ENV must be one of %q or %q; got %q", EnvironmentDevelopment, EnvironmentProduction, cfg.Environment))
 	}
 
+	if len(cfg.AllowedEmailDomains) == 0 {
+		errs = append(errs, errors.New("TW_ALLOWED_EMAIL_DOMAINS is required"))
+	}
+
+	errs = append(errs, cfg.Server.validate())
+
 	switch cfg.Environment {
 	case EnvironmentDevelopment:
 		if cfg.ViteDevServerURL.Scheme != "http" && cfg.ViteDevServerURL.Scheme != "https" {
@@ -100,7 +124,16 @@ func (cfg *Config) Validate() error {
 		}
 	}
 
-	return errors.Join(append(errs, cfg.Server.validate(), cfg.OTPaaS.validate())...)
+	switch cfg.OTPProvider {
+	case ProviderOTPaaS:
+		errs = append(errs, cfg.OTPaaS.validate())
+	case ProviderMock:
+		errs = append(errs, cfg.Mock.validate())
+	default:
+		errs = append(errs, fmt.Errorf("TW_OTP_PROVIDER must be one of %q or %q; got %q", ProviderOTPaaS, ProviderMock, cfg.OTPProvider))
+	}
+
+	return errors.Join(errs...)
 }
 
 func (c ServerConfig) validate() error {
@@ -147,6 +180,16 @@ func (c OTPaaSConfig) validate() error {
 	return errors.Join(errs...)
 }
 
+func (c MockConfig) validate() error {
+	var errs []error
+
+	if len(c.AllowedEmails) == 0 {
+		errs = append(errs, errors.New("TW_MOCK_ALLOWED_EMAILS is required"))
+	}
+
+	return errors.Join(errs...)
+}
+
 func must[T any](value T, err error) T {
 	if err != nil {
 		panic(err)