refactor: rework the way trusted proxies ip work (#1007)

internal/bootstrap/router_bootstrap.go

@@ -30,6 +30,16 @@ func (app *BootstrapApp) setupRouter() error {
 		if err != nil {
 			return fmt.Errorf("failed to set trusted proxies: %w", err)
 		}
+
+		app.runtime.TrustedProxiesConfigured = true
+	} else {
+		err := engine.SetTrustedProxies(nil)
+
+		if err != nil {
+			return fmt.Errorf("failed to set trusted proxies: %w", err)
+		}
+
+		app.log.App.Warn().Msg("Trusted proxies are not configured, IP access controls will NOT work")
 	}
 
 	middlewareProvideFor := []any{

internal/controller/proxy_controller.go

@@ -114,6 +114,7 @@ func (controller *ProxyController) proxyHandler(c *gin.Context) {
 		ACLs:                     acls,
 		IP:                       net.ParseIP(clientIP),
 		Path:                     proxyCtx.Path,
+		TrustedProxiesConfigured: controller.runtime.TrustedProxiesConfigured,
 	}
 
 	if controller.policyEngine.Evaluate(service.RuleIPBypassed, aclsCtx) {

internal/model/runtime.go

@@ -12,6 +12,7 @@ type RuntimeConfig struct {
 	OAuthProviders           map[string]OAuthServiceConfig
 	OAuthWhitelist           []string
 	ConfiguredProviders      []Provider
+	TrustedProxiesConfigured bool
 }
 
 type Provider struct {

internal/service/access_controls_rules.go

@@ -215,6 +215,10 @@ type IPAllowedRule struct {
 }
 
 func (rule *IPAllowedRule) Evaluate(ctx *ACLContext) Effect {
+	if !ctx.TrustedProxiesConfigured {
+		return EffectAllow // We can't block the proxy
+	}
+
 	// merge global and per-app block/allow lists
 	blockedIps := append([]string{}, rule.Config.Auth.IP.Block...)
 	allowedIPs := append([]string{}, rule.Config.Auth.IP.Allow...)
@@ -263,6 +267,10 @@ type IPBypassedRule struct {
 }
 
 func (rule *IPBypassedRule) Evaluate(ctx *ACLContext) Effect {
+	if !ctx.TrustedProxiesConfigured {
+		return EffectDeny
+	}
+
 	// merge global and per-app bypass lists
 	bypassList := append([]string{}, rule.Config.Auth.IP.Bypass...)
 	if ctx.ACLs != nil {

internal/service/access_controls_rules_test.go

@@ -611,11 +611,20 @@ func TestIPAllowedRule(t *testing.T) {
 		ctx      *ACLContext
 		expected Effect
 	}{
+		{
+			name: "when trusted proxies are not configured, IP is allowed",
+			ctx: &ACLContext{
+				ACLs: &model.App{},
+				IP:   net.ParseIP("10.0.0.1"),
+			},
+			expected: EffectAllow,
+		},
 		{
 			name: "allows when ACLs are nil and no global lists configured",
 			ctx: &ACLContext{
 				ACLs:                     nil,
 				IP:                       net.ParseIP("10.0.0.1"),
+				TrustedProxiesConfigured: true,
 			},
 			expected: EffectAllow,
 		},
@@ -626,6 +635,7 @@ func TestIPAllowedRule(t *testing.T) {
 					IP: model.AppIP{Block: []string{"10.0.0.1"}},
 				},
 				IP:                       net.ParseIP("10.0.0.1"),
+				TrustedProxiesConfigured: true,
 			},
 			expected: EffectDeny,
 		},
@@ -639,6 +649,7 @@ func TestIPAllowedRule(t *testing.T) {
 			ctx: &ACLContext{
 				ACLs:                     &model.App{},
 				IP:                       net.ParseIP("10.0.0.5"),
+				TrustedProxiesConfigured: true,
 			},
 			expected: EffectDeny,
 		},
@@ -649,6 +660,7 @@ func TestIPAllowedRule(t *testing.T) {
 					IP: model.AppIP{Allow: []string{"192.168.1.0/24"}},
 				},
 				IP:                       net.ParseIP("192.168.1.10"),
+				TrustedProxiesConfigured: true,
 			},
 			expected: EffectAllow,
 		},
@@ -662,6 +674,7 @@ func TestIPAllowedRule(t *testing.T) {
 			ctx: &ACLContext{
 				ACLs:                     &model.App{},
 				IP:                       net.ParseIP("192.168.1.10"),
+				TrustedProxiesConfigured: true,
 			},
 			expected: EffectAllow,
 		},
@@ -672,6 +685,7 @@ func TestIPAllowedRule(t *testing.T) {
 					IP: model.AppIP{Allow: []string{"192.168.1.0/24"}},
 				},
 				IP:                       net.ParseIP("10.0.0.1"),
+				TrustedProxiesConfigured: true,
 			},
 			expected: EffectDeny,
 		},
@@ -680,6 +694,7 @@ func TestIPAllowedRule(t *testing.T) {
 			ctx: &ACLContext{
 				ACLs:                     &model.App{},
 				IP:                       net.ParseIP("10.0.0.1"),
+				TrustedProxiesConfigured: true,
 			},
 			expected: EffectAllow,
 		},
@@ -693,6 +708,7 @@ func TestIPAllowedRule(t *testing.T) {
 					},
 				},
 				IP:                       net.ParseIP("10.0.0.1"),
+				TrustedProxiesConfigured: true,
 			},
 			expected: EffectDeny,
 		},
@@ -706,6 +722,7 @@ func TestIPAllowedRule(t *testing.T) {
 					},
 				},
 				IP:                       net.ParseIP("10.0.0.1"),
+				TrustedProxiesConfigured: true,
 			},
 			expected: EffectAllow,
 		},
@@ -735,12 +752,23 @@ func TestIPBypassedRule(t *testing.T) {
 		ctx      *ACLContext
 		expected Effect
 	}{
+		{
+			name: "when trusted proxies are not configured, IP is not bypassed",
+			rule: defaultIPBR,
+			ctx: &ACLContext{
+				ACLs:                     &model.App{},
+				IP:                       net.ParseIP("10.0.0.1"),
+				TrustedProxiesConfigured: false,
+			},
+			expected: EffectDeny,
+		},
 		{
 			name: "deny when ACLs are nil and no global bypass",
 			rule: defaultIPBR,
 			ctx: &ACLContext{
 				ACLs:                     nil,
 				IP:                       net.ParseIP("10.0.0.1"),
+				TrustedProxiesConfigured: true,
 			},
 			expected: EffectDeny,
 		},
@@ -750,6 +778,7 @@ func TestIPBypassedRule(t *testing.T) {
 			ctx: &ACLContext{
 				ACLs:                     nil,
 				IP:                       net.ParseIP("10.0.0.5"),
+				TrustedProxiesConfigured: true,
 			},
 			expected: EffectAllow,
 		},
@@ -759,6 +788,7 @@ func TestIPBypassedRule(t *testing.T) {
 			ctx: &ACLContext{
 				ACLs:                     nil,
 				IP:                       net.ParseIP("192.168.1.1"),
+				TrustedProxiesConfigured: true,
 			},
 			expected: EffectDeny,
 		},
@@ -770,6 +800,7 @@ func TestIPBypassedRule(t *testing.T) {
 					IP: model.AppIP{Bypass: []string{"10.0.0.0/24"}},
 				},
 				IP:                       net.ParseIP("10.0.0.5"),
+				TrustedProxiesConfigured: true,
 			},
 			expected: EffectAllow,
 		},
@@ -781,6 +812,7 @@ func TestIPBypassedRule(t *testing.T) {
 					IP: model.AppIP{Bypass: []string{"172.16.0.0/24"}},
 				},
 				IP:                       net.ParseIP("10.0.0.5"),
+				TrustedProxiesConfigured: true,
 			},
 			expected: EffectAllow,
 		},
@@ -792,6 +824,7 @@ func TestIPBypassedRule(t *testing.T) {
 					IP: model.AppIP{Bypass: []string{"10.0.0.0/24"}},
 				},
 				IP:                       net.ParseIP("10.0.0.5"),
+				TrustedProxiesConfigured: true,
 			},
 			expected: EffectAllow,
 		},
@@ -803,6 +836,7 @@ func TestIPBypassedRule(t *testing.T) {
 					IP: model.AppIP{Bypass: []string{"10.0.0.0/24"}},
 				},
 				IP:                       net.ParseIP("192.168.1.1"),
+				TrustedProxiesConfigured: true,
 			},
 			expected: EffectDeny,
 		},
@@ -812,6 +846,7 @@ func TestIPBypassedRule(t *testing.T) {
 			ctx: &ACLContext{
 				ACLs:                     &model.App{},
 				IP:                       net.ParseIP("10.0.0.1"),
+				TrustedProxiesConfigured: true,
 			},
 			expected: EffectDeny,
 		},
@@ -823,6 +858,7 @@ func TestIPBypassedRule(t *testing.T) {
 					IP: model.AppIP{Bypass: []string{"not-an-ip", "10.0.0.1"}},
 				},
 				IP:                       net.ParseIP("10.0.0.1"),
+				TrustedProxiesConfigured: true,
 			},
 			expected: EffectAllow,
 		},

internal/service/policy_engine.go

@@ -33,6 +33,7 @@ type ACLContext struct {
 	UserContext              *model.UserContext
 	IP                       net.IP
 	Path                     string
+	TrustedProxiesConfigured bool
 }
 
 type PolicyEngine struct {

internal/test/test.go

@@ -166,6 +166,7 @@ func CreateTestConfigs(t *testing.T) (model.Config, model.RuntimeConfig) {
 		CookieDomain:             "example.com",
 		AppURL:                   "https://tinyauth.example.com",
 		SessionCookieName:        "tinyauth-session",
+		TrustedProxiesConfigured: true,
 	}
 
 	return config, runtime