feat(auth): implement user and device authentication

backend-api/internal/config/config_test.go

@@ -39,6 +39,8 @@ func TestLoadAcceptsExplicitConfiguration(t *testing.T) {
 		HTTPAddressEnvironment:    "192.0.2.10:9090",
 		DatabasePathEnvironment:   "tmp/test.db",
 		AssetDirectoryEnvironment: "tmp/assets",
+		TLSCertificateEnvironment: "tmp/server.crt",
+		TLSPrivateKeyEnvironment:  "tmp/server.key",
 	}
 
 	cfg, err := Load(mapEnvironment(values))
@@ -55,6 +57,14 @@ func TestLoadAcceptsExplicitConfiguration(t *testing.T) {
 	if cfg.AssetDirectory != filepath.Clean(values[AssetDirectoryEnvironment]) {
 		t.Fatalf("AssetDirectory = %q", cfg.AssetDirectory)
 	}
+	if cfg.TLSCertificate != filepath.Clean(values[TLSCertificateEnvironment]) ||
+		cfg.TLSPrivateKey != filepath.Clean(values[TLSPrivateKeyEnvironment]) {
+		t.Fatalf(
+			"TLS files = %q / %q",
+			cfg.TLSCertificate,
+			cfg.TLSPrivateKey,
+		)
+	}
 }
 
 func TestLoadRejectsUnsafeOrInvalidValues(t *testing.T) {
@@ -116,6 +126,25 @@ func TestLoadRejectsUnsafeOrInvalidValues(t *testing.T) {
 				AssetDirectoryEnvironment: ".",
 			},
 		},
+		{
+			name: "non loopback without TLS",
+			values: map[string]string{
+				HTTPAddressEnvironment: "0.0.0.0:8080",
+			},
+		},
+		{
+			name: "TLS certificate without key",
+			values: map[string]string{
+				TLSCertificateEnvironment: "tmp/server.crt",
+			},
+		},
+		{
+			name: "blank TLS key",
+			values: map[string]string{
+				TLSCertificateEnvironment: "tmp/server.crt",
+				TLSPrivateKeyEnvironment:  " ",
+			},
+		},
 	}
 
 	for _, test := range tests {