Add native NixOS deployment and UI-managed provider credentials

internal/banking/enablebanking.go

@@ -19,7 +19,6 @@ import (
 	"io"
 	"net/http"
 	"net/url"
-	"os"
 	"strings"
 	"time"
 
@@ -58,21 +57,29 @@ type EnableBanking struct {
 
 var _ Provider = (*EnableBanking)(nil)
 
-func NewEnableBanking(appID, keyFile, redirectURL string) (*EnableBanking, error) {
-	if strings.TrimSpace(appID) == "" {
-		return nil, fmt.Errorf("Enable Banking application ID is required")
+// MaxPrivateKeyPEM bounds uploaded and environment-loaded private keys.
+const MaxPrivateKeyPEM = 32 * 1024
+
+func NewEnableBanking(appID string, keyPEM []byte, redirectURL string) (*EnableBanking, error) {
+	if len(appID) == 0 || len(appID) > 256 {
+		return nil, errors.New("invalid Enable Banking application ID")
+	}
+	for _, c := range appID {
+		if c < 33 || c > 126 {
+			return nil, errors.New("invalid Enable Banking application ID")
+		}
 	}
 	redirect, err := url.Parse(redirectURL)
-	if err != nil || redirect.Host == "" || (redirect.Scheme != "https" && redirect.Scheme != "http") || redirect.User != nil {
-		return nil, fmt.Errorf("invalid Enable Banking redirect URL")
+	if err != nil || redirect.Hostname() == "" || (redirect.Scheme != "https" && redirect.Scheme != "http") || redirect.User != nil || redirect.Opaque != "" || redirect.Path != "/api/banking/callback" || redirect.RawPath != "" || redirect.RawQuery != "" || redirect.ForceQuery || redirect.Fragment != "" || strings.Contains(redirectURL, "#") {
+		return nil, errors.New("invalid Enable Banking redirect URL")
 	}
-	content, err := os.ReadFile(keyFile)
-	if err != nil {
-		return nil, fmt.Errorf("read Enable Banking RSA private key: %w", err)
+	if len(keyPEM) > MaxPrivateKeyPEM {
+		return nil, errors.New("Enable Banking private key exceeds size limit")
 	}
-	block, _ := pem.Decode(content)
-	if block == nil {
-		return nil, fmt.Errorf("Enable Banking key must be PEM encoded")
+	content := bytes.TrimSpace(keyPEM)
+	block, rest := pem.Decode(content)
+	if block == nil || !bytes.HasPrefix(content, []byte("-----BEGIN "+block.Type+"-----")) || len(bytes.TrimSpace(rest)) != 0 || len(block.Headers) != 0 {
+		return nil, errors.New("Enable Banking key must be a single PEM private key")
 	}
 	var key *rsa.PrivateKey
 	switch block.Type {