Added config generate-csrf-key, to store a CSRF key that survives restarts and works across instances

Without server.csrf.tokens.key, each server process signs CSRF tokens with
a random key of its own, so tokens are lost on a restart and rejected by
other instances. "job-search config generate-csrf-key" stores a new random
32-byte hex key in the configuration file, without printing it. --print
only prints a key, for JOBSEARCH_SERVER_CSRF_TOKENS_KEY or another
instance. An existing key is only replaced with --force, as that
invalidates every issued token, and no key is stored while
JOBSEARCH_SERVER_CSRF_TOKENS_KEY is set, as it would override the file.

internal/cli/config/csrf_key.go

@@ -0,0 +1,129 @@
+package config
+
+import (
+	"crypto/rand"
+	"encoding/hex"
+	"errors"
+	"fmt"
+	"log/slog"
+	"os"
+
+	"github.com/spf13/cobra"
+	"github.com/spf13/viper"
+
+	"git.avsdev.uk/Go/job-search/internal/cli"
+	"git.avsdev.uk/Go/job-search/internal/config"
+)
+
+// csrfKeySetting is the setting generate-csrf-key stores the key in.
+const csrfKeySetting = "server.csrf.tokens.key"
+
+// csrfKeyBytes is the length of a generated key: 32 bytes, as the server
+// generates for itself when no key is set.
+const csrfKeyBytes = 32
+
+// commandGenerateCSRFKey returns the "config generate-csrf-key" command,
+// which stores a new random CSRF key in the configuration file, or prints it.
+func commandGenerateCSRFKey(opts *cli.Options) *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "generate-csrf-key",
+		Args:  cobra.NoArgs,
+		Short: "Generate a CSRF key and store it in the configuration file",
+		Long: `Generate a random key for signing CSRF tokens and store it in
+server.csrf.tokens.key in the configuration file. Without a key, each server
+process signs with a random key of its own, so tokens don't survive a restart
+and aren't valid across instances. Give every instance the same key, and
+restart them to use it.
+
+The key isn't printed. With --print, it is only printed, and the
+configuration file isn't changed: use that to set
+JOBSEARCH_SERVER_CSRF_TOKENS_KEY instead, or another instance's file.
+
+An existing key is only replaced with --force, as a new key invalidates
+every token already issued. A key set by JOBSEARCH_SERVER_CSRF_TOKENS_KEY
+overrides the file, so the command refuses to store one while it is set.`,
+		PersistentPreRun: func(cmd *cobra.Command, args []string) {
+			slog.Debug(
+				"command persistent pre-run", "command", "config.generate-csrf-key",
+			)
+		},
+		PersistentPostRun: func(cmd *cobra.Command, args []string) {
+			slog.Debug(
+				"command persistent post-run", "command", "config.generate-csrf-key",
+			)
+		},
+		RunE: func(cmd *cobra.Command, args []string) error {
+			slog.Debug("command run", "command", "config.generate-csrf-key")
+
+			printOnly, printErr := cmd.Flags().GetBool("print")
+			force, forceErr := cmd.Flags().GetBool("force")
+			err := errors.Join(printErr, forceErr)
+			if err != nil {
+				return err
+			}
+
+			key := generateCSRFKey()
+			if printOnly {
+				fmt.Fprintln(cmd.OutOrStdout(), key) //nolint:errcheck // printing only
+				return nil
+			}
+
+			envVar := config.EnvVarName(csrfKeySetting)
+			if os.Getenv(envVar) != "" {
+				return fmt.Errorf(
+					"%s is set and overrides the configuration file: "+
+						"unset it first, or use --print to make a key for it",
+					envVar,
+				)
+			}
+
+			conf, err := opts.RunSetup(cmd, true, true)
+			if err != nil {
+				return fmt.Errorf("load configuration: %w", err)
+			}
+			if viper.ConfigFileUsed() == "" {
+				return errors.New("no configuration file exists")
+			}
+			if conf.Server.CSRF.Tokens.Key != "" && !force {
+				return fmt.Errorf(
+					"%s is already set: --force replaces it, which invalidates "+
+						"every token already issued",
+					csrfKeySetting,
+				)
+			}
+
+			_, _, err = config.StoreValue(conf, csrfKeySetting, key)
+			if err != nil {
+				return err
+			}
+
+			fmt.Fprintf( //nolint:errcheck // printing only
+				cmd.OutOrStdout(),
+				"%s set in %s; restart the server to use it, and give every "+
+					"instance the same key\n",
+				csrfKeySetting,
+				viper.ConfigFileUsed(),
+			)
+
+			return nil
+		},
+	}
+	cmd.Flags().Bool(
+		"print", false, "only print the key; don't change the configuration file",
+	)
+	cmd.Flags().Bool(
+		"force", false, "replace an existing key, invalidating issued tokens",
+	)
+	cmd.MarkFlagsMutuallyExclusive("print", "force")
+
+	return cmd
+}
+
+// generateCSRFKey returns a new random key, hex encoded as
+// server.csrf.tokens.key expects.
+func generateCSRFKey() string {
+	key := make([]byte, csrfKeyBytes)
+	rand.Read(key) // crypto/rand.Read never returns an error
+
+	return hex.EncodeToString(key)
+}