[config] validate gateway mode

.env.example

@@ -189,6 +189,13 @@ SSE__KEEP_ALIVE_PERIOD_SECONDS=15
 # Example: 300
 MESSAGES__CACHE_TTL_SECONDS=300
 
+# Message hashing interval
+# Purpose: Interval in seconds for computing message content hashes (used for duplicate detection)
+# Format: Integer (seconds)
+# Default: 60
+# Example: 60
+MESSAGES__HASHING_INTERVAL_SECONDS=60
+
 # Message queue max pending
 # Purpose: Maximum number of pending messages in queue (0 = unlimited)
 # Format: Integer
@@ -296,12 +303,26 @@ JWT__ISSUER=sms-gate.app
 # OTP (ONE-TIME PASSWORD) CONFIGURATION
 # =============================================================================
 
+# OTP enabled
+# Purpose: Enable one-time code authentication for device registration
+# Format: Boolean (true/false)
+# Default: true
+# Example: true
+OTP__ENABLED=true
+
+# OTP code length
+# Purpose: Number of digits in the one-time password code (min 6)
+# Format: Integer
+# Default: 6
+# Example: 6
+OTP__LENGTH=6
+
 # OTP TTL
 # Purpose: Time-to-live for one-time passwords in seconds
 # Format: Integer (seconds)
-# Default: 300 (5 minutes)
-# Example: 300
-OTP__TTL=300
+# Default: 60
+# Example: 60
+OTP__TTL=60
 
 # OTP retries
 # Purpose: Number of retry attempts for OTP generation (handles collision)

CHANGELOG.md

@@ -0,0 +1,9 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+## [Unreleased]
+
+### Bug Fixes
+
+- **Gateway mode validation** — `gateway.mode` now accepts only `public` or `private`; any other value fails at startup with a clear error instead of silently defaulting to public-mode FCM push.

internal/config/errors.go

@@ -0,0 +1,7 @@
+package config
+
+import "errors"
+
+var (
+	ErrInvalidConfig = errors.New("invalid config")
+)

internal/config/module.go

@@ -1,6 +1,7 @@
 package config
 
 import (
+	"fmt"
 	"strings"
 	"time"
 
@@ -67,10 +68,19 @@ func Module() fx.Option {
 				ConnMaxLifetime: 0,
 			}
 		}),
-		fx.Provide(func(cfg Config) push.Config {
-			mode := push.ModeFCM
-			if cfg.Gateway.Mode == GatewayModePrivate {
+		fx.Provide(func(cfg Config) (push.Config, error) {
+			var mode push.Mode
+			switch cfg.Gateway.Mode {
+			case GatewayModePublic:
+				mode = push.ModeFCM
+			case GatewayModePrivate:
 				mode = push.ModeUpstream
+			default:
+				return push.Config{}, fmt.Errorf(
+					"%w: gateway mode must be either 'public' or 'private', got %q",
+					ErrInvalidConfig,
+					cfg.Gateway.Mode,
+				)
 			}
 
 			return push.Config{
@@ -81,7 +91,7 @@ func Module() fx.Option {
 				},
 				Debounce: time.Duration(cfg.FCM.DebounceSeconds) * time.Second,
 				Timeout:  time.Duration(cfg.FCM.TimeoutSeconds) * time.Second,
-			}
+			}, nil
 		}),
 		fx.Provide(func(cfg Config) auth.Config {
 			return auth.Config{