feat: add treatvault block and TreatVault label constants

parser.go

@@ -48,10 +48,51 @@ type parser struct {
 }
 
 func (p *parser) parse() (Config, error) {
-	p.skipNewlines()
-	if err := p.expectWord("pawsql"); err != nil {
-		return Config{}, err
+	var cfg Config
+	pawSQLSeen := false
+	for {
+		p.skipNewlines()
+		if p.current().kind == tokenEOF {
+			break
+		}
+		if p.current().kind != tokenWord {
+			return Config{}, p.errorf("expected top-level service block")
+		}
+		switch p.current().text {
+		case "pawsql":
+			if pawSQLSeen {
+				return Config{}, p.errorf("pawsql may only be specified once")
+			}
+			pawSQLSeen = true
+			p.index++
+			pawSQL, err := p.parsePawSQL()
+			if err != nil {
+				return Config{}, err
+			}
+			cfg.Listen = pawSQL.Listen
+			cfg.TLS = pawSQL.TLS
+			cfg.Databases = pawSQL.Databases
+		case "treatvault":
+			if cfg.TreatVault != nil {
+				return Config{}, p.errorf("treatvault may only be specified once")
+			}
+			p.index++
+			treatVault, err := p.parseTreatVault()
+			if err != nil {
+				return Config{}, err
+			}
+			cfg.TreatVault = &treatVault
+		default:
+			return Config{}, p.errorf("unknown top-level service %q", p.current().text)
+		}
 	}
+	if !pawSQLSeen {
+		return Config{}, p.errorf("pawsql block is required")
+	}
+	return cfg, nil
+}
+
+func (p *parser) parsePawSQL() (Config, error) {
 	if err := p.expect(tokenOpenBrace, "{"); err != nil {
 		return Config{}, err
 	}
@@ -60,7 +101,7 @@ func (p *parser) parse() (Config, error) {
 		p.skipNewlines()
 		if p.current().kind == tokenCloseBrace {
 			p.index++
-			break
+			return cfg, nil
 		}
 		if p.current().kind == tokenEOF {
 			return Config{}, p.errorf("expected } to close pawsql block")
@@ -107,11 +148,49 @@ func (p *parser) parse() (Config, error) {
 			return Config{}, p.errorf("unknown directive %q", p.current().text)
 		}
 	}
-	p.skipNewlines()
-	if p.current().kind != tokenEOF {
-		return Config{}, p.errorf("unexpected content after pawsql block")
+}
+
+func (p *parser) parseTreatVault() (TreatVaultConfig, error) {
+	if err := p.expect(tokenOpenBrace, "{"); err != nil {
+		return TreatVaultConfig{}, err
+	}
+	var cfg TreatVaultConfig
+	for {
+		p.skipNewlines()
+		if p.current().kind == tokenCloseBrace {
+			p.index++
+			return cfg, nil
+		}
+		if p.current().kind == tokenEOF {
+			return TreatVaultConfig{}, p.errorf("expected } to close treatvault block")
+		}
+		directive := p.current()
+		if directive.kind != tokenWord {
+			return TreatVaultConfig{}, p.errorf("expected treatvault directive")
+		}
+		p.index++
+		value, err := p.value("treatvault value")
+		if err != nil {
+			return TreatVaultConfig{}, err
+		}
+		switch directive.text {
+		case "file":
+			if cfg.File != "" {
+				return TreatVaultConfig{}, fmt.Errorf("line %d: file may only be specified once", directive.line)
+			}
+			cfg.File = value
+		case "identity_secret":
+			if cfg.IdentitySecret != "" {
+				return TreatVaultConfig{}, fmt.Errorf("line %d: identity_secret may only be specified once", directive.line)
+			}
+			cfg.IdentitySecret = value
+		default:
+			return TreatVaultConfig{}, fmt.Errorf("line %d: unknown treatvault directive %q", directive.line, directive.text)
+		}
+		if err := p.endLine(); err != nil {
+			return TreatVaultConfig{}, err
+		}
 	}
-	return cfg, nil
 }
 
 func (p *parser) parseTLS() (TLSConfig, error) {