Fix API config structure and add comprehensive test coverage (minekube#563)

* fix: simplify API config to use bind string directly

fixed api config from using wrong nested config to bind string like it was supposed to:

old yaml:
api:
  enabled: true
  config:
    bind: 0.0.0.0:8080

new yaml:
api:
  enabled: true
  bind: 0.0.0.0:3000

* fix: use config struct

* Add comprehensive test coverage for API config changes

- Tests flattened YAML structure parsing (current format)
- Tests nested YAML structure behavior (legacy format)
- Tests validation for invalid/empty bind addresses
- Tests disabled API configuration handling
- Ensures the yaml:",inline" fix works correctly

Co-authored-by: robinbraemer <robinbraemer@users.noreply.github.com>

* SECURITY: Fix API default config and restore proper validation

- Restore api.DefaultConfig usage (localhost:8080) instead of hardcoded 0.0.0.0:8080
- Security fix: Default API bind should use localhost, not 0.0.0.0 (all interfaces)
- Restore proper c.API.Config.Validate() method instead of direct field validation
- Add TestAPIConfigDefaultSecurity to ensure secure defaults
- Update test assertions to match proper validation error format

This prevents accidentally exposing the API to all network interfaces by default.

---------

Co-authored-by: Dylan <dylan@dylanh.dev>
Co-authored-by: robinbraemer <robinbraemer@users.noreply.github.com>

Author: robinbraemer

pkg/gate/config/api_config_test.go

@@ -0,0 +1,128 @@
+package config
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"gopkg.in/yaml.v3"
+)
+
+func TestAPIConfigFlattened(t *testing.T) {
+	// Test YAML that matches our current config files (flattened structure)
+	yamlConfig := `
+api:
+  enabled: true
+  bind: "0.0.0.0:3000"
+`
+
+	var cfg Config
+	err := yaml.Unmarshal([]byte(yamlConfig), &cfg)
+	require.NoError(t, err, "Should unmarshal flattened API config")
+
+	assert.True(t, cfg.API.Enabled, "API should be enabled")
+	assert.Equal(t, "0.0.0.0:3000", cfg.API.Config.Bind, "API bind should be parsed correctly")
+
+	// Test validation
+	warns, errs := cfg.Validate()
+	assert.Empty(t, errs, "Should have no validation errors")
+	assert.Empty(t, warns, "Should have no validation warnings")
+}
+
+func TestAPIConfigNested(t *testing.T) {
+	// Test YAML with old nested structure (should NOT work with yaml:",inline" - this is expected)
+	yamlConfig := `
+api:
+  enabled: true
+  config:
+    bind: "0.0.0.0:3000"
+`
+
+	var cfg Config
+	err := yaml.Unmarshal([]byte(yamlConfig), &cfg)
+	require.NoError(t, err, "Should unmarshal nested API config without errors")
+
+	assert.True(t, cfg.API.Enabled, "API should be enabled")
+	assert.Equal(t, "", cfg.API.Config.Bind, "API bind should be empty (nested structure not supported with inline)")
+
+	// Test validation (should fail because bind is empty)
+	_, errs := cfg.Validate()
+	assert.NotEmpty(t, errs, "Should have validation errors because nested config is ignored")
+	assert.Contains(t, errs[0].Error(), "api:", "Error should mention API validation")
+}
+
+func TestAPIConfigDisabled(t *testing.T) {
+	// Test disabled API
+	yamlConfig := `
+api:
+  enabled: false
+  bind: "localhost:8080"
+`
+
+	var cfg Config
+	err := yaml.Unmarshal([]byte(yamlConfig), &cfg)
+	require.NoError(t, err, "Should unmarshal disabled API config")
+
+	assert.False(t, cfg.API.Enabled, "API should be disabled")
+	assert.Equal(t, "localhost:8080", cfg.API.Config.Bind, "API bind should still be parsed")
+
+	// Test validation (should pass even when disabled)
+	warns, errs := cfg.Validate()
+	assert.Empty(t, errs, "Should have no validation errors for disabled API")
+	assert.Empty(t, warns, "Should have no validation warnings for disabled API")
+}
+
+func TestAPIConfigInvalidBind(t *testing.T) {
+	// Test invalid bind address
+	yamlConfig := `
+api:
+  enabled: true
+  bind: "invalid-address"
+`
+
+	var cfg Config
+	err := yaml.Unmarshal([]byte(yamlConfig), &cfg)
+	require.NoError(t, err, "Should unmarshal config with invalid bind")
+
+	assert.True(t, cfg.API.Enabled, "API should be enabled")
+	assert.Equal(t, "invalid-address", cfg.API.Config.Bind, "Invalid bind should be parsed")
+
+	// Test validation (should fail)
+	_, errs := cfg.Validate()
+	assert.NotEmpty(t, errs, "Should have validation errors for invalid bind")
+	assert.Contains(t, errs[0].Error(), "api:", "Error should mention API validation")
+}
+
+func TestAPIConfigEmptyBind(t *testing.T) {
+	// Test empty bind address
+	yamlConfig := `
+api:
+  enabled: true
+  bind: ""
+`
+
+	var cfg Config
+	err := yaml.Unmarshal([]byte(yamlConfig), &cfg)
+	require.NoError(t, err, "Should unmarshal config with empty bind")
+
+	assert.True(t, cfg.API.Enabled, "API should be enabled")
+	assert.Equal(t, "", cfg.API.Config.Bind, "Empty bind should be parsed")
+
+	// Test validation (should fail)
+	_, errs := cfg.Validate()
+	assert.NotEmpty(t, errs, "Should have validation errors for empty bind")
+	assert.Contains(t, errs[0].Error(), "api:", "Error should mention API validation")
+}
+
+func TestAPIConfigDefaultSecurity(t *testing.T) {
+	// Test that default config uses localhost (not 0.0.0.0) for security
+	cfg := DefaultConfig
+	
+	assert.False(t, cfg.API.Enabled, "API should be disabled by default")
+	assert.Equal(t, "localhost:8080", cfg.API.Config.Bind, "Default API bind should use localhost for security")
+	
+	// Test that API config itself is valid (even though full config may have other warnings)
+	apiWarns, apiErrs := cfg.API.Config.Validate()
+	assert.Empty(t, apiErrs, "Default API config should have no validation errors")
+	assert.Empty(t, apiWarns, "Default API config should have no validation warnings")
+}

pkg/gate/config/config.go

@@ -45,7 +45,7 @@ type HealthService struct {
 // API is the configuration for the Gate API.
 type API struct {
 	Enabled bool       `json:"enabled,omitempty" yaml:"enabled,omitempty"`
-	Config  api.Config `json:"config,omitempty" yaml:"config,omitempty"`
+	Config  api.Config `yaml:",inline"`
 }
 
 // Validate validates a Config and all enabled configs.