feat: add independent Bell authentication and RBAC (#12)

Bell/server/config/config.go

@@ -11,6 +11,8 @@ type Config struct {
 	Environment     string
 	HTTPAddress     string
 	DatabaseURL     string
+	SessionSecret   string
+	CookieSecure    bool
 	ShutdownTimeout time.Duration
 }
 
@@ -19,6 +21,7 @@ func Load() (Config, error) {
 		Environment:     value("BELL_ENV", "development"),
 		HTTPAddress:     value("BELL_HTTP_ADDRESS", "127.0.0.1:8082"),
 		DatabaseURL:     os.Getenv("BELL_DATABASE_URL"),
+		SessionSecret:   os.Getenv("BELL_SESSION_SECRET"),
 		ShutdownTimeout: 10 * time.Second,
 	}
 	if raw := os.Getenv("BELL_SHUTDOWN_SECONDS"); raw != "" {
@@ -31,6 +34,10 @@ func Load() (Config, error) {
 	if cfg.DatabaseURL == "" {
 		return Config{}, fmt.Errorf("BELL_DATABASE_URL is required")
 	}
+	if len(cfg.SessionSecret) < 32 {
+		return Config{}, fmt.Errorf("BELL_SESSION_SECRET must contain at least 32 characters")
+	}
+	cfg.CookieSecure = cfg.Environment == "production"
 	return cfg, nil
 }