refactor(config): remove features stanza

pkg/config/config.go

@@ -24,10 +24,6 @@ type Config struct {
 	OpenID OpenID `json:"openid"`
 	Redis  Redis  `json:"redis"`
 
-	Features Features `json:"features"`
-}
-
-type Features struct {
 	Loginstatus Loginstatus `json:"loginstatus"`
 }
 
@@ -56,11 +52,11 @@ const (
 	SessionMaxLifetime = "session-max-lifetime"
 	UpstreamHost       = "upstream-host"
 
-	FeaturesLoginstatusEnabled           = "features.loginstatus.enabled"
-	FeaturesLoginstatusCookieDomain      = "features.loginstatus.cookie-domain"
-	FeaturesLoginstatusCookieName        = "features.loginstatus.cookie-name"
-	FeaturesLoginstatusResourceIndicator = "features.loginstatus.resource-indicator"
-	FeaturesLoginstatusTokenURL          = "features.loginstatus.token-url"
+	LoginstatusEnabled           = "loginstatus.enabled"
+	LoginstatusCookieDomain      = "loginstatus.cookie-domain"
+	LoginstatusCookieName        = "loginstatus.cookie-name"
+	LoginstatusResourceIndicator = "loginstatus.resource-indicator"
+	LoginstatusTokenURL          = "loginstatus.token-url"
 )
 
 func Initialize() (*Config, error) {
@@ -78,11 +74,11 @@ func Initialize() (*Config, error) {
 	flag.Duration(SessionMaxLifetime, time.Hour, "Max lifetime for user sessions.")
 	flag.String(UpstreamHost, "127.0.0.1:8080", "Address of upstream host.")
 
-	flag.Bool(FeaturesLoginstatusEnabled, false, "Feature toggle for Loginstatus, a separate service that should provide an opaque token to indicate that a user has been authenticated previously, e.g. by another application in another subdomain.")
-	flag.String(FeaturesLoginstatusCookieDomain, "", "The domain that the cookie should be set for.")
-	flag.String(FeaturesLoginstatusCookieName, "", "The name of the cookie.")
-	flag.String(FeaturesLoginstatusResourceIndicator, "", "The resource indicator that should be included in the authorization request to get an audience-restricted token that Loginstatus accepts. Empty means no resource indicator.")
-	flag.String(FeaturesLoginstatusTokenURL, "", "The URL to the Loginstatus service that returns an opaque token.")
+	flag.Bool(LoginstatusEnabled, false, "Feature toggle for Loginstatus, a separate service that should provide an opaque token to indicate that a user has been authenticated previously, e.g. by another application in another subdomain.")
+	flag.String(LoginstatusCookieDomain, "", "The domain that the cookie should be set for.")
+	flag.String(LoginstatusCookieName, "", "The name of the cookie.")
+	flag.String(LoginstatusResourceIndicator, "", "The resource indicator that should be included in the authorization request to get an audience-restricted token that Loginstatus accepts. Empty means no resource indicator.")
+	flag.String(LoginstatusTokenURL, "", "The URL to the Loginstatus service that returns an opaque token.")
 
 	redisFlags()
 	openIDFlags()

pkg/router/handler.go

@@ -43,7 +43,7 @@ func NewHandler(
 		RedirectURL: provider.GetClientConfiguration().GetRedirectURI(),
 		Scopes:      provider.GetClientConfiguration().GetScopes(),
 	}
-	loginstatusClient := loginstatus.NewClient(cfg.Features.Loginstatus, http.DefaultClient)
+	loginstatusClient := loginstatus.NewClient(cfg.Loginstatus, http.DefaultClient)
 
 	return &Handler{
 		Config:        cfg,

pkg/router/handler_callback.go

@@ -59,7 +59,7 @@ func (h *Handler) Callback(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	if h.Config.Features.Loginstatus.Enabled {
+	if h.Config.Loginstatus.Enabled {
 		loginstatusToken, err := h.Loginstatus.ExchangeToken(r.Context(), tokens.AccessToken)
 		if err != nil {
 			h.InternalError(w, r, fmt.Errorf("callback: exchanging loginstatus token: %w", err))

pkg/router/handler_default.go

@@ -20,7 +20,7 @@ func (h *Handler) Default(w http.ResponseWriter, r *http.Request) {
 		isAuthenticated = true
 
 		// force new authentication if loginstatus is enabled and cookie isn't set
-		if h.Config.Features.Loginstatus.Enabled && !h.Loginstatus.HasCookie(r) {
+		if h.Config.Loginstatus.Enabled && !h.Loginstatus.HasCookie(r) {
 			isAuthenticated = false
 		}
 	}

pkg/router/handler_frontchannellogout.go

@@ -14,7 +14,7 @@ func (h *Handler) FrontChannelLogout(w http.ResponseWriter, r *http.Request) {
 	// Unconditionally destroy all local references to the session.
 	h.deleteCookie(w, SessionCookieName, h.CookieOptions)
 
-	if h.Config.Features.Loginstatus.Enabled {
+	if h.Config.Loginstatus.Enabled {
 		h.Loginstatus.ClearCookie(w, h.CookieOptions)
 	}
 

pkg/router/handler_logout.go

@@ -34,7 +34,7 @@ func (h *Handler) Logout(w http.ResponseWriter, r *http.Request) {
 
 	h.deleteCookie(w, SessionCookieName, h.CookieOptions)
 
-	if h.Config.Features.Loginstatus.Enabled {
+	if h.Config.Loginstatus.Enabled {
 		h.Loginstatus.ClearCookie(w, h.CookieOptions)
 	}
 

pkg/router/login_url.go

@@ -32,8 +32,8 @@ func (h *Handler) LoginURL(r *http.Request, params *openid.LoginParameters) (str
 	v.Add("code_challenge", params.CodeChallenge)
 	v.Add("code_challenge_method", "S256")
 
-	if h.Config.Features.Loginstatus.NeedsResourceIndicator() {
-		v.Add("resource", h.Config.Features.Loginstatus.ResourceIndicator)
+	if h.Config.Loginstatus.NeedsResourceIndicator() {
+		v.Add("resource", h.Config.Loginstatus.ResourceIndicator)
 	}
 
 	err = h.withSecurityLevel(r, v)

pkg/router/login_url_test.go

@@ -103,8 +103,8 @@ func TestLoginURL_WithResourceIndicator(t *testing.T) {
 	provider := mock.NewTestProvider()
 	provider.OpenIDConfiguration.AuthorizationEndpoint = "https://provider/authorize"
 	handler := newHandler(provider)
-	handler.Config.Features.Loginstatus.Enabled = true
-	handler.Config.Features.Loginstatus.ResourceIndicator = "https://some-resource"
+	handler.Config.Loginstatus.Enabled = true
+	handler.Config.Loginstatus.ResourceIndicator = "https://some-resource"
 	result, err := handler.LoginURL(req, params)
 
 	assert.NotEmpty(t, result)