barbercollie/tinyauth
1
0
Fork 1
mirror of https://github.com/steveiliop56/tinyauth.git synced 2026-07-14 14:01:34 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat: adopt domain validator in oauth controller and acls service

Browse Source
This commit is contained in:
Stavros
2026-07-14 00:37:22 +03:00
parent 3008ffad34
commit 0c1cc98fd3
5 changed files with 41 additions and 79 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/service/access_controls_service.go
+8 -37
View File
@@ -1,12 +1,11 @@
package service
import (
"fmt"
"net/url"
"strings"
"github.com/tinyauthapp/tinyauth/internal/model"
"github.com/tinyauthapp/tinyauth/internal/utils/logger"
"github.com/tinyauthapp/tinyauth/pkg/validators"
"go.uber.org/dig"
)
@@ -40,13 +39,17 @@ func NewAccessControlsService(i AccessControlServiceInput) *AccessControlsServic
func (service *AccessControlsService) lookupStaticACLs(domain string) (*model.App, error) {
var nameMatch *model.App
v := validators.NewDomainValidator(validators.DomainValidatorOptions{})
// First try to find a matching app by domain, then fallback to matching by app name (subdomain)
for app, config := range service.config.Apps {
match, err := service.checkDomain(domain, config.Config.Domain)
if err != nil {
err := v.Validate(config.Config.Domain, domain)
// Maybe not the best way to check if a match succeeded, but expected is only
// used on match errors and not parsing errors
if err != nil && !strings.HasPrefix(err.Error(), "expected") {
return nil, err
}
if match {
if err == nil {
service.log.App.Debug().Str("name", app).Msg("Found matching container by domain")
return &config, nil
}
@@ -80,35 +83,3 @@ func (service *AccessControlsService) GetAccessControls(domain string) (*model.A
// no labels
return nil, nil
}
func (service *AccessControlsService) checkDomain(check, target string) (bool, error) {
// Domains don't have a scheme, so we use a mock one
cu, err := url.Parse("tinyauth://" + check)
if err != nil {
return false, fmt.Errorf("failed to parse check domain: %w", err)
}
if cu.Host == "" {
return false, fmt.Errorf("check domain is empty")
}
tu, err := url.Parse("tinyauth://" + target)
if err != nil {
return false, fmt.Errorf("failed to parse target domain: %w", err)
}
if tu.Host == "" {
return false, fmt.Errorf("target domain is empty")
}
// non-dns check url
ndcu := strings.TrimSuffix(cu.Hostname(), ".")
// non-dns target url
ndtu := strings.TrimSuffix(tu.Hostname(), ".")
// Strip out the port
return strings.EqualFold(ndcu, ndtu), nil
}