v0.26.0

internal/net/gphttp/middleware/oidc.go

@@ -7,8 +7,10 @@ import (
 	"sync"
 	"sync/atomic"
 
+	"github.com/rs/zerolog/log"
 	"github.com/yusing/godoxy/internal/auth"
-	gperr "github.com/yusing/goutils/errs"
+	httpevents "github.com/yusing/goutils/events/http"
+	"github.com/yusing/goutils/http/httpheaders"
 )
 
 type oidcMiddleware struct {
@@ -28,7 +30,7 @@ var OIDC = NewMiddleware[oidcMiddleware]()
 
 func (amw *oidcMiddleware) finalize() error {
 	if !auth.IsOIDCEnabled() {
-		return gperr.New("OIDC not enabled but OIDC middleware is used")
+		log.Error().Msg("OIDC not enabled but OIDC middleware is used")
 	}
 	return nil
 }
@@ -97,6 +99,10 @@ func (amw *oidcMiddleware) initSlow() error {
 }
 
 func (amw *oidcMiddleware) before(w http.ResponseWriter, r *http.Request) (proceed bool) {
+	if !auth.IsOIDCEnabled() {
+		return true
+	}
+
 	if err := amw.init(); err != nil {
 		// no need to log here, main OIDC should've already failed and logged
 		http.Error(w, err.Error(), http.StatusInternalServerError)
@@ -105,7 +111,7 @@ func (amw *oidcMiddleware) before(w http.ResponseWriter, r *http.Request) (proce
 
 	if r.URL.Path == auth.OIDCLogoutPath {
 		amw.auth.LogoutHandler(w, r)
-		return true
+		return false
 	}
 
 	err := amw.auth.CheckToken(r)
@@ -113,11 +119,31 @@ func (amw *oidcMiddleware) before(w http.ResponseWriter, r *http.Request) (proce
 		return true
 	}
 
+	emitBlockedEvent := func() {
+		if r.Method != http.MethodHead {
+			httpevents.Blocked(r, "OIDC", err.Error())
+		}
+	}
+
+	isGet := r.Method == http.MethodGet
+	isWS := httpheaders.IsWebsocket(r.Header)
 	switch {
+	case r.Method == http.MethodHead:
+		w.WriteHeader(http.StatusOK)
+	case !isGet, isWS:
+		http.Error(w, err.Error(), http.StatusForbidden)
+		reqType := r.Method
+		if isWS {
+			reqType = "WebSocket"
+		}
+		OIDC.LogWarn(r).Msgf("[OIDC] %s request blocked.\nConsider adding bypass rule for this path if needed", reqType)
+		emitBlockedEvent()
+		return false
 	case errors.Is(err, auth.ErrMissingOAuthToken):
 		amw.auth.HandleAuth(w, r)
 	default:
 		auth.WriteBlockPage(w, http.StatusForbidden, err.Error(), "Logout", auth.OIDCLogoutPath)
+		emitBlockedEvent()
 	}
 	return false
 }