feat: gate Claudomator UI behind Doot session auth via reverse proxy

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2 files changed, 47 insertions, 0 deletions

diff --git a/internal/config/config.go b/internal/config/config.go
index 86d0d5b..d3770f1 100644
--- a/internal/config/config.go
+++ b/internal/config/config.go
@@ -39,6 +39,9 @@ type Config struct {
 	// WebAuthn
 	WebAuthnRPID   string // Relying Party ID (domain, e.g., "doot.terst.org")
 	WebAuthnOrigin string // Expected origin (e.g., "https://doot.terst.org")
+
+	// Claudomator
+	ClaudomatorURL string // URL of Claudomator service
 }
 
 // Load reads configuration from environment variables
@@ -75,6 +78,9 @@ func Load() (*Config, error) {
 		// WebAuthn
 		WebAuthnRPID:   os.Getenv("WEBAUTHN_RP_ID"),
 		WebAuthnOrigin: os.Getenv("WEBAUTHN_ORIGIN"),
+
+		// Claudomator
+		ClaudomatorURL: getEnvWithDefault("CLAUDOMATOR_URL", "http://127.0.0.1:8484"),
 	}
 
 	// Validate required fields
diff --git a/internal/config/config_test.go b/internal/config/config_test.go
index 41cd6e0..0722825 100644
--- a/internal/config/config_test.go
+++ b/internal/config/config_test.go
@@ -276,6 +276,47 @@ func TestLoad(t *testing.T) {
 	}
 }
 
+func TestConfig_ClaudomatorURL_Default(t *testing.T) {
+	os.Unsetenv("CLAUDOMATOR_URL")
+	os.Setenv("TODOIST_API_KEY", "test-todoist-key")
+	os.Setenv("TRELLO_API_KEY", "test-trello-key")
+	os.Setenv("TRELLO_TOKEN", "test-trello-token")
+	defer func() {
+		os.Unsetenv("TODOIST_API_KEY")
+		os.Unsetenv("TRELLO_API_KEY")
+		os.Unsetenv("TRELLO_TOKEN")
+	}()
+
+	cfg, err := Load()
+	if err != nil {
+		t.Fatalf("Load failed: %v", err)
+	}
+	if cfg.ClaudomatorURL != "http://127.0.0.1:8484" {
+		t.Errorf("Expected default ClaudomatorURL 'http://127.0.0.1:8484', got '%s'", cfg.ClaudomatorURL)
+	}
+}
+
+func TestConfig_ClaudomatorURL_EnvOverride(t *testing.T) {
+	os.Setenv("CLAUDOMATOR_URL", "http://1.2.3.4:9000")
+	os.Setenv("TODOIST_API_KEY", "test-todoist-key")
+	os.Setenv("TRELLO_API_KEY", "test-trello-key")
+	os.Setenv("TRELLO_TOKEN", "test-trello-token")
+	defer func() {
+		os.Unsetenv("CLAUDOMATOR_URL")
+		os.Unsetenv("TODOIST_API_KEY")
+		os.Unsetenv("TRELLO_API_KEY")
+		os.Unsetenv("TRELLO_TOKEN")
+	}()
+
+	cfg, err := Load()
+	if err != nil {
+		t.Fatalf("Load failed: %v", err)
+	}
+	if cfg.ClaudomatorURL != "http://1.2.3.4:9000" {
+		t.Errorf("Expected ClaudomatorURL 'http://1.2.3.4:9000', got '%s'", cfg.ClaudomatorURL)
+	}
+}
+
 func TestLoad_ValidationError(t *testing.T) {
 	// Clear required env vars to trigger validation error
 	os.Unsetenv("TODOIST_API_KEY")