Rework app setup

server/internal/app/app.go

@@ -1,223 +0,0 @@
-// Package app provides application-level functionality for initializing and running the server
-package app
-
-import (
-	"database/sql"
-	"fmt"
-	"log"
-	"net/http"
-	"time"
-
-	"github.com/go-chi/chi/v5"
-	"github.com/go-chi/chi/v5/middleware"
-	"github.com/go-chi/cors"
-	"github.com/go-chi/httprate"
-	"github.com/unrolled/secure"
-	"golang.org/x/crypto/bcrypt"
-
-	"novamd/internal/api"
-	"novamd/internal/auth"
-	"novamd/internal/config"
-	"novamd/internal/db"
-	"novamd/internal/handlers"
-	"novamd/internal/models"
-	"novamd/internal/secrets"
-	"novamd/internal/storage"
-)
-
-// Server represents the HTTP server and its dependencies
-type Server struct {
-	router  *chi.Mux
-	config  *config.Config
-	db      db.Database
-	storage storage.Manager
-}
-
-// NewServer initializes a new server instance with all dependencies
-func NewServer(cfg *config.Config) (*Server, error) {
-	// Initialize secrets service
-	secretsService, err := secrets.NewService(cfg.EncryptionKey)
-	if err != nil {
-		return nil, fmt.Errorf("failed to initialize secrets service: %w", err)
-	}
-
-	// Initialize database
-	database, err := initDatabase(cfg, secretsService)
-	if err != nil {
-		return nil, fmt.Errorf("failed to initialize database: %w", err)
-	}
-
-	// Initialize filesystem
-	storageManager := storage.NewService(cfg.WorkDir)
-
-	// Setup admin user
-	err = setupAdminUser(database, storageManager, cfg)
-	if err != nil {
-		return nil, fmt.Errorf("failed to setup admin user: %w", err)
-	}
-
-	// Initialize router
-	router := initRouter(cfg)
-
-	return &Server{
-		router:  router,
-		config:  cfg,
-		db:      database,
-		storage: storageManager,
-	}, nil
-}
-
-// Start configures and starts the HTTP server
-func (s *Server) Start() error {
-	// Set up authentication
-	jwtManager, sessionService, err := s.setupAuth()
-	if err != nil {
-		return fmt.Errorf("failed to setup authentication: %w", err)
-	}
-
-	// Set up routes
-	s.setupRoutes(jwtManager, sessionService)
-
-	// Start server
-	addr := ":" + s.config.Port
-	log.Printf("Server starting on port %s", s.config.Port)
-	return http.ListenAndServe(addr, s.router)
-}
-
-// Close handles graceful shutdown of server dependencies
-func (s *Server) Close() error {
-	return s.db.Close()
-}
-
-// initDatabase initializes and migrates the database
-func initDatabase(cfg *config.Config, secretsService secrets.Service) (db.Database, error) {
-	database, err := db.Init(cfg.DBPath, secretsService)
-	if err != nil {
-		return nil, fmt.Errorf("failed to initialize database: %w", err)
-	}
-
-	if err := database.Migrate(); err != nil {
-		return nil, fmt.Errorf("failed to apply database migrations: %w", err)
-	}
-
-	return database, nil
-}
-
-// initRouter creates and configures the chi router with middleware
-func initRouter(cfg *config.Config) *chi.Mux {
-	r := chi.NewRouter()
-
-	// Basic middleware
-	r.Use(middleware.Logger)
-	r.Use(middleware.Recoverer)
-	r.Use(middleware.RequestID)
-	r.Use(middleware.RealIP)
-	r.Use(middleware.Timeout(30 * time.Second))
-
-	// Security headers
-	r.Use(secure.New(secure.Options{
-		SSLRedirect:     false, // Let proxy handle HTTPS
-		SSLProxyHeaders: map[string]string{"X-Forwarded-Proto": "https"},
-		IsDevelopment:   cfg.IsDevelopment,
-	}).Handler)
-
-	// CORS if origins are configured
-	if len(cfg.CORSOrigins) > 0 {
-		r.Use(cors.Handler(cors.Options{
-			AllowedOrigins:   cfg.CORSOrigins,
-			AllowedMethods:   []string{"GET", "POST", "PUT", "DELETE", "OPTIONS"},
-			AllowedHeaders:   []string{"Accept", "Authorization", "Content-Type", "X-Requested-With"},
-			AllowCredentials: true,
-			MaxAge:           300,
-		}))
-	}
-
-	return r
-}
-
-// setupAuth initializes JWT and session services
-func (s *Server) setupAuth() (auth.JWTManager, *auth.SessionService, error) {
-	// Get or generate JWT signing key
-	signingKey := s.config.JWTSigningKey
-	if signingKey == "" {
-		var err error
-		signingKey, err = s.db.EnsureJWTSecret()
-		if err != nil {
-			return nil, nil, fmt.Errorf("failed to ensure JWT secret: %w", err)
-		}
-	}
-
-	// Initialize JWT service
-	jwtManager, err := auth.NewJWTService(auth.JWTConfig{
-		SigningKey:         signingKey,
-		AccessTokenExpiry:  15 * time.Minute,
-		RefreshTokenExpiry: 7 * 24 * time.Hour,
-	})
-	if err != nil {
-		return nil, nil, fmt.Errorf("failed to initialize JWT service: %w", err)
-	}
-
-	// Initialize session service
-	sessionService := auth.NewSessionService(s.db, jwtManager)
-
-	return jwtManager, sessionService, nil
-}
-
-// setupRoutes configures all application routes
-func (s *Server) setupRoutes(jwtManager auth.JWTManager, sessionService *auth.SessionService) {
-	// Initialize auth middleware
-	authMiddleware := auth.NewMiddleware(jwtManager)
-
-	// Set up API routes
-	s.router.Route("/api/v1", func(r chi.Router) {
-		r.Use(httprate.LimitByIP(s.config.RateLimitRequests, s.config.RateLimitWindow))
-		api.SetupRoutes(r, s.db, s.storage, authMiddleware, sessionService)
-	})
-
-	// Handle all other routes with static file server
-	s.router.Get("/*", handlers.NewStaticHandler(s.config.StaticPath).ServeHTTP)
-}
-
-func setupAdminUser(db db.Database, w storage.WorkspaceManager, cfg *config.Config) error {
-
-	adminEmail := cfg.AdminEmail
-	adminPassword := cfg.AdminPassword
-
-	// Check if admin user exists
-	adminUser, err := db.GetUserByEmail(adminEmail)
-	if adminUser != nil {
-		return nil // Admin user already exists
-	} else if err != sql.ErrNoRows {
-		return err
-	}
-
-	// Hash the password
-	hashedPassword, err := bcrypt.GenerateFromPassword([]byte(adminPassword), bcrypt.DefaultCost)
-	if err != nil {
-		return fmt.Errorf("failed to hash password: %w", err)
-	}
-
-	// Create admin user
-	adminUser = &models.User{
-		Email:        adminEmail,
-		DisplayName:  "Admin",
-		PasswordHash: string(hashedPassword),
-		Role:         models.RoleAdmin,
-	}
-
-	createdUser, err := db.CreateUser(adminUser)
-	if err != nil {
-		return fmt.Errorf("failed to create admin user: %w", err)
-	}
-
-	// Initialize workspace directory
-	err = w.InitializeUserWorkspace(createdUser.ID, createdUser.LastWorkspaceID)
-	if err != nil {
-		return fmt.Errorf("failed to initialize admin workspace: %w", err)
-	}
-
-	log.Printf("Created admin user with ID: %d and default workspace with ID: %d", createdUser.ID, createdUser.LastWorkspaceID)
-
-	return nil
-
-}

server/internal/app/config.go

@@ -0,0 +1,112 @@
+package app
+
+import (
+	"fmt"
+	"novamd/internal/secrets"
+	"os"
+	"strconv"
+	"strings"
+	"time"
+)
+
+// Config holds the configuration for the application
+type Config struct {
+	DBPath            string
+	WorkDir           string
+	StaticPath        string
+	Port              string
+	AppURL            string
+	CORSOrigins       []string
+	AdminEmail        string
+	AdminPassword     string
+	EncryptionKey     string
+	JWTSigningKey     string
+	RateLimitRequests int
+	RateLimitWindow   time.Duration
+	IsDevelopment     bool
+}
+
+// DefaultConfig returns a new Config instance with default values
+func DefaultConfig() *Config {
+	return &Config{
+		DBPath:            "./novamd.db",
+		WorkDir:           "./data",
+		StaticPath:        "../app/dist",
+		Port:              "8080",
+		RateLimitRequests: 100,
+		RateLimitWindow:   time.Minute * 15,
+		IsDevelopment:     false,
+	}
+}
+
+// validate checks if the configuration is valid
+func (c *Config) validate() error {
+	if c.AdminEmail == "" || c.AdminPassword == "" {
+		return fmt.Errorf("NOVAMD_ADMIN_EMAIL and NOVAMD_ADMIN_PASSWORD must be set")
+	}
+
+	// Validate encryption key
+	if err := secrets.ValidateKey(c.EncryptionKey); err != nil {
+		return fmt.Errorf("invalid NOVAMD_ENCRYPTION_KEY: %w", err)
+	}
+
+	return nil
+}
+
+// LoadConfig creates a new Config instance with values from environment variables
+func LoadConfig() (*Config, error) {
+	config := DefaultConfig()
+
+	if env := os.Getenv("NOVAMD_ENV"); env != "" {
+		config.IsDevelopment = env == "development"
+	}
+
+	if dbPath := os.Getenv("NOVAMD_DB_PATH"); dbPath != "" {
+		config.DBPath = dbPath
+	}
+
+	if workDir := os.Getenv("NOVAMD_WORKDIR"); workDir != "" {
+		config.WorkDir = workDir
+	}
+
+	if staticPath := os.Getenv("NOVAMD_STATIC_PATH"); staticPath != "" {
+		config.StaticPath = staticPath
+	}
+
+	if port := os.Getenv("NOVAMD_PORT"); port != "" {
+		config.Port = port
+	}
+
+	if appURL := os.Getenv("NOVAMD_APP_URL"); appURL != "" {
+		config.AppURL = appURL
+	}
+
+	if corsOrigins := os.Getenv("NOVAMD_CORS_ORIGINS"); corsOrigins != "" {
+		config.CORSOrigins = strings.Split(corsOrigins, ",")
+	}
+
+	config.AdminEmail = os.Getenv("NOVAMD_ADMIN_EMAIL")
+	config.AdminPassword = os.Getenv("NOVAMD_ADMIN_PASSWORD")
+	config.EncryptionKey = os.Getenv("NOVAMD_ENCRYPTION_KEY")
+	config.JWTSigningKey = os.Getenv("NOVAMD_JWT_SIGNING_KEY")
+
+	// Configure rate limiting
+	if reqStr := os.Getenv("NOVAMD_RATE_LIMIT_REQUESTS"); reqStr != "" {
+		if parsed, err := strconv.Atoi(reqStr); err == nil {
+			config.RateLimitRequests = parsed
+		}
+	}
+
+	if windowStr := os.Getenv("NOVAMD_RATE_LIMIT_WINDOW"); windowStr != "" {
+		if parsed, err := time.ParseDuration(windowStr); err == nil {
+			config.RateLimitWindow = parsed
+		}
+	}
+
+	// Validate all settings
+	if err := config.validate(); err != nil {
+		return nil, err
+	}
+
+	return config, nil
+}

server/internal/app/config_test.go

@@ -0,0 +1,214 @@
+package app_test
+
+import (
+	"novamd/internal/app"
+	"os"
+	"testing"
+	"time"
+)
+
+func TestDefaultConfig(t *testing.T) {
+	cfg := app.DefaultConfig()
+
+	tests := []struct {
+		name     string
+		got      interface{}
+		expected interface{}
+	}{
+		{"DBPath", cfg.DBPath, "./novamd.db"},
+		{"WorkDir", cfg.WorkDir, "./data"},
+		{"StaticPath", cfg.StaticPath, "../app/dist"},
+		{"Port", cfg.Port, "8080"},
+		{"RateLimitRequests", cfg.RateLimitRequests, 100},
+		{"RateLimitWindow", cfg.RateLimitWindow, time.Minute * 15},
+		{"IsDevelopment", cfg.IsDevelopment, false},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if tt.got != tt.expected {
+				t.Errorf("DefaultConfig().%s = %v, want %v", tt.name, tt.got, tt.expected)
+			}
+		})
+	}
+}
+
+// setEnv is a helper function to set environment variables and check for errors
+func setEnv(t *testing.T, key, value string) {
+	if err := os.Setenv(key, value); err != nil {
+		t.Fatalf("Failed to set environment variable %s: %v", key, err)
+	}
+}
+
+func TestLoad(t *testing.T) {
+	// Helper function to reset environment variables
+	cleanup := func() {
+		envVars := []string{
+			"NOVAMD_ENV",
+			"NOVAMD_DB_PATH",
+			"NOVAMD_WORKDIR",
+			"NOVAMD_STATIC_PATH",
+			"NOVAMD_PORT",
+			"NOVAMD_APP_URL",
+			"NOVAMD_CORS_ORIGINS",
+			"NOVAMD_ADMIN_EMAIL",
+			"NOVAMD_ADMIN_PASSWORD",
+			"NOVAMD_ENCRYPTION_KEY",
+			"NOVAMD_JWT_SIGNING_KEY",
+			"NOVAMD_RATE_LIMIT_REQUESTS",
+			"NOVAMD_RATE_LIMIT_WINDOW",
+		}
+		for _, env := range envVars {
+			if err := os.Unsetenv(env); err != nil {
+				t.Fatalf("Failed to unset environment variable %s: %v", env, err)
+			}
+		}
+	}
+
+	t.Run("load with defaults", func(t *testing.T) {
+		cleanup()
+		defer cleanup()
+
+		// Set required env vars
+		setEnv(t, "NOVAMD_ADMIN_EMAIL", "admin@example.com")
+		setEnv(t, "NOVAMD_ADMIN_PASSWORD", "password123")
+		setEnv(t, "NOVAMD_ENCRYPTION_KEY", "YWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXoxMjM0NTY=") // 32 bytes base64 encoded
+
+		cfg, err := app.LoadConfig()
+		if err != nil {
+			t.Fatalf("Load() error = %v", err)
+		}
+
+		if cfg.DBPath != "./novamd.db" {
+			t.Errorf("default DBPath = %v, want %v", cfg.DBPath, "./novamd.db")
+		}
+	})
+
+	t.Run("load with custom values", func(t *testing.T) {
+		cleanup()
+		defer cleanup()
+
+		// Set all environment variables
+		envs := map[string]string{
+			"NOVAMD_ENV":                 "development",
+			"NOVAMD_DB_PATH":             "/custom/db/path.db",
+			"NOVAMD_WORKDIR":             "/custom/work/dir",
+			"NOVAMD_STATIC_PATH":         "/custom/static/path",
+			"NOVAMD_PORT":                "3000",
+			"NOVAMD_APP_URL":             "http://localhost:3000",
+			"NOVAMD_CORS_ORIGINS":        "http://localhost:3000,http://localhost:3001",
+			"NOVAMD_ADMIN_EMAIL":         "admin@example.com",
+			"NOVAMD_ADMIN_PASSWORD":      "password123",
+			"NOVAMD_ENCRYPTION_KEY":      "YWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXoxMjM0NTY=",
+			"NOVAMD_JWT_SIGNING_KEY":     "secret-key",
+			"NOVAMD_RATE_LIMIT_REQUESTS": "200",
+			"NOVAMD_RATE_LIMIT_WINDOW":   "30m",
+		}
+
+		for k, v := range envs {
+			setEnv(t, k, v)
+		}
+
+		cfg, err := app.LoadConfig()
+		if err != nil {
+			t.Fatalf("Load() error = %v", err)
+		}
+
+		tests := []struct {
+			name     string
+			got      interface{}
+			expected interface{}
+		}{
+			{"IsDevelopment", cfg.IsDevelopment, true},
+			{"DBPath", cfg.DBPath, "/custom/db/path.db"},
+			{"WorkDir", cfg.WorkDir, "/custom/work/dir"},
+			{"StaticPath", cfg.StaticPath, "/custom/static/path"},
+			{"Port", cfg.Port, "3000"},
+			{"AppURL", cfg.AppURL, "http://localhost:3000"},
+			{"AdminEmail", cfg.AdminEmail, "admin@example.com"},
+			{"AdminPassword", cfg.AdminPassword, "password123"},
+			{"JWTSigningKey", cfg.JWTSigningKey, "secret-key"},
+			{"RateLimitRequests", cfg.RateLimitRequests, 200},
+			{"RateLimitWindow", cfg.RateLimitWindow, 30 * time.Minute},
+		}
+
+		for _, tt := range tests {
+			t.Run(tt.name, func(t *testing.T) {
+				if tt.got != tt.expected {
+					t.Errorf("%s = %v, want %v", tt.name, tt.got, tt.expected)
+				}
+			})
+		}
+
+		// Test CORS origins separately as it's a slice
+		expectedOrigins := []string{"http://localhost:3000", "http://localhost:3001"}
+		if len(cfg.CORSOrigins) != len(expectedOrigins) {
+			t.Errorf("CORSOrigins length = %v, want %v", len(cfg.CORSOrigins), len(expectedOrigins))
+		}
+		for i, origin := range cfg.CORSOrigins {
+			if origin != expectedOrigins[i] {
+				t.Errorf("CORSOrigins[%d] = %v, want %v", i, origin, expectedOrigins[i])
+			}
+		}
+	})
+
+	t.Run("validation failures", func(t *testing.T) {
+		testCases := []struct {
+			name          string
+			setupEnv      func(*testing.T)
+			expectedError string
+		}{
+			{
+				name: "missing admin email",
+				setupEnv: func(t *testing.T) {
+					cleanup()
+					setEnv(t, "NOVAMD_ADMIN_PASSWORD", "password123")
+					setEnv(t, "NOVAMD_ENCRYPTION_KEY", "YWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXoxMjM0NTY=")
+				},
+				expectedError: "NOVAMD_ADMIN_EMAIL and NOVAMD_ADMIN_PASSWORD must be set",
+			},
+			{
+				name: "missing admin password",
+				setupEnv: func(t *testing.T) {
+					cleanup()
+					setEnv(t, "NOVAMD_ADMIN_EMAIL", "admin@example.com")
+					setEnv(t, "NOVAMD_ENCRYPTION_KEY", "YWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXoxMjM0NTY=")
+				},
+				expectedError: "NOVAMD_ADMIN_EMAIL and NOVAMD_ADMIN_PASSWORD must be set",
+			},
+			{
+				name: "missing encryption key",
+				setupEnv: func(t *testing.T) {
+					cleanup()
+					setEnv(t, "NOVAMD_ADMIN_EMAIL", "admin@example.com")
+					setEnv(t, "NOVAMD_ADMIN_PASSWORD", "password123")
+				},
+				expectedError: "invalid NOVAMD_ENCRYPTION_KEY: encryption key is required",
+			},
+			{
+				name: "invalid encryption key",
+				setupEnv: func(t *testing.T) {
+					cleanup()
+					setEnv(t, "NOVAMD_ADMIN_EMAIL", "admin@example.com")
+					setEnv(t, "NOVAMD_ADMIN_PASSWORD", "password123")
+					setEnv(t, "NOVAMD_ENCRYPTION_KEY", "invalid-key")
+				},
+				expectedError: "invalid NOVAMD_ENCRYPTION_KEY: invalid base64 encoding: illegal base64 data at input byte 7",
+			},
+		}
+
+		for _, tc := range testCases {
+			t.Run(tc.name, func(t *testing.T) {
+				tc.setupEnv(t)
+				_, err := app.LoadConfig()
+				if err == nil {
+					t.Error("expected error, got nil")
+					return
+				}
+				if err.Error() != tc.expectedError {
+					t.Errorf("error = %v, want error containing %v", err, tc.expectedError)
+				}
+			})
+		}
+	})
+}

server/internal/app/init.go

@@ -0,0 +1,111 @@
+// Package app provides application-level functionality for initializing and running the server
+package app
+
+import (
+	"database/sql"
+	"fmt"
+	"log"
+	"time"
+
+	"golang.org/x/crypto/bcrypt"
+
+	"novamd/internal/auth"
+	"novamd/internal/db"
+	"novamd/internal/models"
+	"novamd/internal/secrets"
+	"novamd/internal/storage"
+)
+
+// initSecretsService initializes the secrets service
+func initSecretsService(cfg *Config) (secrets.Service, error) {
+	secretsService, err := secrets.NewService(cfg.EncryptionKey)
+	if err != nil {
+		return nil, fmt.Errorf("failed to initialize secrets service: %w", err)
+	}
+	return secretsService, nil
+}
+
+// initDatabase initializes and migrates the database
+func initDatabase(cfg *Config, secretsService secrets.Service) (db.Database, error) {
+	database, err := db.Init(cfg.DBPath, secretsService)
+	if err != nil {
+		return nil, fmt.Errorf("failed to initialize database: %w", err)
+	}
+
+	if err := database.Migrate(); err != nil {
+		return nil, fmt.Errorf("failed to apply database migrations: %w", err)
+	}
+
+	return database, nil
+}
+
+// initAuth initializes JWT and session services
+func initAuth(cfg *Config, database db.Database) (auth.JWTManager, *auth.SessionService, error) {
+	// Get or generate JWT signing key
+	signingKey := cfg.JWTSigningKey
+	if signingKey == "" {
+		var err error
+		signingKey, err = database.EnsureJWTSecret()
+		if err != nil {
+			return nil, nil, fmt.Errorf("failed to ensure JWT secret: %w", err)
+		}
+	}
+
+	// Initialize JWT service
+	jwtManager, err := auth.NewJWTService(auth.JWTConfig{
+		SigningKey:         signingKey,
+		AccessTokenExpiry:  15 * time.Minute,
+		RefreshTokenExpiry: 7 * 24 * time.Hour,
+	})
+	if err != nil {
+		return nil, nil, fmt.Errorf("failed to initialize JWT service: %w", err)
+	}
+
+	// Initialize session service
+	sessionService := auth.NewSessionService(database, jwtManager)
+
+	return jwtManager, sessionService, nil
+}
+
+// setupAdminUser creates the admin user if it doesn't exist
+func setupAdminUser(database db.Database, storageManager storage.Manager, cfg *Config) error {
+	adminEmail := cfg.AdminEmail
+	adminPassword := cfg.AdminPassword
+
+	// Check if admin user exists
+	adminUser, err := database.GetUserByEmail(adminEmail)
+	if adminUser != nil {
+		return nil // Admin user already exists
+	} else if err != sql.ErrNoRows {
+		return err
+	}
+
+	// Hash the password
+	hashedPassword, err := bcrypt.GenerateFromPassword([]byte(adminPassword), bcrypt.DefaultCost)
+	if err != nil {
+		return fmt.Errorf("failed to hash password: %w", err)
+	}
+
+	// Create admin user
+	adminUser = &models.User{
+		Email:        adminEmail,
+		DisplayName:  "Admin",
+		PasswordHash: string(hashedPassword),
+		Role:         models.RoleAdmin,
+	}
+
+	createdUser, err := database.CreateUser(adminUser)
+	if err != nil {
+		return fmt.Errorf("failed to create admin user: %w", err)
+	}
+
+	// Initialize workspace directory
+	err = storageManager.InitializeUserWorkspace(createdUser.ID, createdUser.LastWorkspaceID)
+	if err != nil {
+		return fmt.Errorf("failed to initialize admin workspace: %w", err)
+	}
+
+	log.Printf("Created admin user with ID: %d and default workspace with ID: %d", createdUser.ID, createdUser.LastWorkspaceID)
+
+	return nil
+}

server/internal/app/options.go

@@ -0,0 +1,53 @@
+package app
+
+import (
+	"novamd/internal/auth"
+	"novamd/internal/db"
+	"novamd/internal/storage"
+)
+
+// Options holds all dependencies and configuration for the server
+type Options struct {
+	Config         *Config
+	Database       db.Database
+	Storage        storage.Manager
+	JWTManager     auth.JWTManager
+	SessionService *auth.SessionService
+}
+
+// DefaultOptions creates server options with default configuration
+func DefaultOptions(cfg *Config) (*Options, error) {
+	// Initialize secrets service
+	secretsService, err := initSecretsService(cfg)
+	if err != nil {
+		return nil, err
+	}
+
+	// Initialize database
+	database, err := initDatabase(cfg, secretsService)
+	if err != nil {
+		return nil, err
+	}
+
+	// Initialize storage
+	storageManager := storage.NewService(cfg.WorkDir)
+
+	// Initialize auth services
+	jwtManager, sessionService, err := initAuth(cfg, database)
+	if err != nil {
+		return nil, err
+	}
+
+	// Setup admin user
+	if err := setupAdminUser(database, storageManager, cfg); err != nil {
+		return nil, err
+	}
+
+	return &Options{
+		Config:         cfg,
+		Database:       database,
+		Storage:        storageManager,
+		JWTManager:     jwtManager,
+		SessionService: sessionService,
+	}, nil
+}

server/internal/app/routes.go

@@ -0,0 +1,142 @@
+package app
+
+import (
+	"novamd/internal/auth"
+	"novamd/internal/context"
+	"novamd/internal/handlers"
+	"time"
+
+	"github.com/go-chi/chi/v5"
+	"github.com/go-chi/chi/v5/middleware"
+	"github.com/go-chi/cors"
+	"github.com/go-chi/httprate"
+	"github.com/unrolled/secure"
+)
+
+// setupRouter creates and configures the chi router with middleware and routes
+func setupRouter(o Options) *chi.Mux {
+	r := chi.NewRouter()
+
+	// Basic middleware
+	r.Use(middleware.Logger)
+	r.Use(middleware.Recoverer)
+	r.Use(middleware.RequestID)
+	r.Use(middleware.RealIP)
+	r.Use(middleware.Timeout(30 * time.Second))
+
+	// Security headers
+	r.Use(secure.New(secure.Options{
+		SSLRedirect:     false,
+		SSLProxyHeaders: map[string]string{"X-Forwarded-Proto": "https"},
+		IsDevelopment:   o.Config.IsDevelopment,
+	}).Handler)
+
+	// CORS if origins are configured
+	if len(o.Config.CORSOrigins) > 0 {
+		r.Use(cors.Handler(cors.Options{
+			AllowedOrigins:   o.Config.CORSOrigins,
+			AllowedMethods:   []string{"GET", "POST", "PUT", "DELETE", "OPTIONS"},
+			AllowedHeaders:   []string{"Accept", "Authorization", "Content-Type", "X-Requested-With"},
+			AllowCredentials: true,
+			MaxAge:           300,
+		}))
+	}
+
+	// Initialize auth middleware and handler
+	authMiddleware := auth.NewMiddleware(o.JWTManager)
+	handler := &handlers.Handler{
+		DB:      o.Database,
+		Storage: o.Storage,
+	}
+
+	// API routes
+	r.Route("/api/v1", func(r chi.Router) {
+		// Rate limiting for API routes
+		if o.Config.RateLimitRequests > 0 {
+			r.Use(httprate.LimitByIP(
+				o.Config.RateLimitRequests,
+				o.Config.RateLimitWindow,
+			))
+		}
+
+		// Public routes (no authentication required)
+		r.Group(func(r chi.Router) {
+			r.Post("/auth/login", handler.Login(o.SessionService))
+			r.Post("/auth/refresh", handler.RefreshToken(o.SessionService))
+		})
+
+		// Protected routes (authentication required)
+		r.Group(func(r chi.Router) {
+			r.Use(authMiddleware.Authenticate)
+			r.Use(context.WithUserContextMiddleware)
+
+			// Auth routes
+			r.Post("/auth/logout", handler.Logout(o.SessionService))
+			r.Get("/auth/me", handler.GetCurrentUser())
+
+			// User profile routes
+			r.Put("/profile", handler.UpdateProfile())
+			r.Delete("/profile", handler.DeleteAccount())
+
+			// Admin-only routes
+			r.Route("/admin", func(r chi.Router) {
+				r.Use(authMiddleware.RequireRole("admin"))
+				// User management
+				r.Route("/users", func(r chi.Router) {
+					r.Get("/", handler.AdminListUsers())
+					r.Post("/", handler.AdminCreateUser())
+					r.Get("/{userId}", handler.AdminGetUser())
+					r.Put("/{userId}", handler.AdminUpdateUser())
+					r.Delete("/{userId}", handler.AdminDeleteUser())
+				})
+				// Workspace management
+				r.Route("/workspaces", func(r chi.Router) {
+					r.Get("/", handler.AdminListWorkspaces())
+				})
+				// System stats
+				r.Get("/stats", handler.AdminGetSystemStats())
+			})
+
+			// Workspace routes
+			r.Route("/workspaces", func(r chi.Router) {
+				r.Get("/", handler.ListWorkspaces())
+				r.Post("/", handler.CreateWorkspace())
+				r.Get("/last", handler.GetLastWorkspaceName())
+				r.Put("/last", handler.UpdateLastWorkspaceName())
+
+				// Single workspace routes
+				r.Route("/{workspaceName}", func(r chi.Router) {
+					r.Use(context.WithWorkspaceContextMiddleware(o.Database))
+					r.Use(authMiddleware.RequireWorkspaceAccess)
+
+					r.Get("/", handler.GetWorkspace())
+					r.Put("/", handler.UpdateWorkspace())
+					r.Delete("/", handler.DeleteWorkspace())
+
+					// File routes
+					r.Route("/files", func(r chi.Router) {
+						r.Get("/", handler.ListFiles())
+						r.Get("/last", handler.GetLastOpenedFile())
+						r.Put("/last", handler.UpdateLastOpenedFile())
+						r.Get("/lookup", handler.LookupFileByName())
+
+						r.Post("/*", handler.SaveFile())
+						r.Get("/*", handler.GetFileContent())
+						r.Delete("/*", handler.DeleteFile())
+					})
+
+					// Git routes
+					r.Route("/git", func(r chi.Router) {
+						r.Post("/commit", handler.StageCommitAndPush())
+						r.Post("/pull", handler.PullChanges())
+					})
+				})
+			})
+		})
+	})
+
+	// Handle all other routes with static file server
+	r.Get("/*", handlers.NewStaticHandler(o.Config.StaticPath).ServeHTTP)
+
+	return r
+}

server/internal/app/server.go

@@ -0,0 +1,40 @@
+package app
+
+import (
+	"log"
+	"net/http"
+
+	"github.com/go-chi/chi/v5"
+)
+
+// Server represents the HTTP server and its dependencies
+type Server struct {
+	router  *chi.Mux
+	options *Options
+}
+
+// NewServer creates a new server instance with the given options
+func NewServer(options *Options) *Server {
+	return &Server{
+		router:  setupRouter(*options),
+		options: options,
+	}
+}
+
+// Start configures and starts the HTTP server
+func (s *Server) Start() error {
+	// Start server
+	addr := ":" + s.options.Config.Port
+	log.Printf("Server starting on port %s", s.options.Config.Port)
+	return http.ListenAndServe(addr, s.router)
+}
+
+// Close handles graceful shutdown of server dependencies
+func (s *Server) Close() error {
+	return s.options.Database.Close()
+}
+
+// Router returns the chi router for testing
+func (s *Server) Router() chi.Router {
+	return s.router
+}