Complete rebuild of the plugin

* Fix bug affecting Azure OIDC authentication ( and most likely others ) * Fixes issue #51 * Ensure that appended roles are unique. Update the documentation. * Improvements targetting possible memory usage spikes. * Additional fixes and cleanup * Refactoring code to fix the issues identified by the users. * Modernize run * Fieldalignment * Multiple changes to improve performance and reduce complexity. - Optimise the errors and recovery. - Deduplicate code in metadata cache. - Remove unused performance monitoring code. - Simplify session management and settings handling. * Fix claims issue. * Add ability to overwrite the default scopes in the settings file * Well.. that escalated quickly. Completely forgot that Traefik uses outdated Yaegi and requires compatibility with 1.20 ( pre-generic Go code ). * Bugfix #51: Ensures that user provided scopes overrides work. * fixup! Bugfix #51: Ensures that user provided scopes overrides work. * fixup! fixup! Bugfix #51: Ensures that user provided scopes overrides work. * Abstract the provider logic into a separate package. * Additional micro fixes and cleanups. * Simplify all the things. * fixup! Simplify all the things. * fixup! fixup! Simplify all the things. * fixup! fixup! fixup! Simplify all the things. * fixup! fixup! fixup! fixup! Simplify all the things. * ... * Cleanup tests. * fixup! Cleanup tests. * fixup! fixup! fixup! Cleanup tests. * fixup! fixup! fixup! fixup! Cleanup tests. * fixup! fixup! fixup! fixup! fixup! Cleanup tests. * Issue #53: Fix CSRF token handling in reverse proxy 1. ✅ HTTPS Detection Fixed (session.go:723) - Now uses X-Forwarded-Proto header instead of r.URL.Scheme - Properly detects HTTPS in reverse proxy environments 2. ✅ SameSite Cookie Attribute Fixed - Removed automatic SameSiteStrictMode for HTTPS (would break OAuth) - Keeps SameSiteLaxMode to allow OAuth callbacks from external domains - Only uses Strict for AJAX requests which don't involve OAuth redirects 3. ✅ Cookie Domain Handling Fixed - Now respects X-Forwarded-Host header for cookie domain - Ensures cookies are set for the public domain, not internal proxy domain 4. ✅ EnhanceSessionSecurity Properly Integrated - Function is now actually called during session save - Applies security enhancements without breaking OAuth flow Why Issue #53 Failed Before: 1. Cookies were not marked Secure in HTTPS environments (browser wouldn't send them back) 2. If they had been Secure with SameSite=Strict, Azure callbacks would still fail 3. Cookie domain might have been wrong (internal vs public domain) Why It Works Now: 1. Cookies are properly marked Secure for HTTPS 2. Uses SameSite=Lax to allow OAuth provider callbacks 3. Cookie domain uses public domain from X-Forwarded-Host 4. CSRF token persists through the entire OAuth flow * Next set of enhancements together with memory usage improvements. * Memory leak fixes and optimisations. * CSRF and Cookie Domain fixes * fixup! CSRF and Cookie Domain fixes * Metadata cache leak fix + profiling * fixup! Metadata cache leak fix + profiling * Memory leaks hunting, part 1337. * Further pursue of perfection. * fixup! Further pursue of perfection. * fixup! fixup! Further pursue of perfection. * fixup! fixup! fixup! Further pursue of perfection. * fixup! fixup! fixup! fixup! Further pursue of perfection. * fixup! fixup! fixup! fixup! fixup! Further pursue of perfection. * fixup! fixup! fixup! fixup! fixup! fixup! Further pursue of perfection. * fixup! fixup! fixup! fixup! fixup! fixup! fixup! Further pursue of perfection. * fixup! fixup! fixup! fixup! fixup! fixup! fixup! fixup! Further pursue of perfection. * fixup! fixup! fixup! fixup! fixup! fixup! fixup! fixup! fixup! Further pursue of perfection. * Clear race conditions * fixup! Clear race conditions * Weekend fun with memory leaks * Splitting code into multiple files with reasonable testing coverage. ``` ok github.com/lukaszraczylo/traefikoidc 117.017s coverage: 72.6% of statements ok github.com/lukaszraczylo/traefikoidc/auth 0.505s coverage: 87.1% of statements ok github.com/lukaszraczylo/traefikoidc/circuit_breaker 0.283s coverage: 99.0% of statements github.com/lukaszraczylo/traefikoidc/config coverage: 0.0% of statements ok github.com/lukaszraczylo/traefikoidc/handlers 0.349s coverage: 98.2% of statements ok github.com/lukaszraczylo/traefikoidc/internal/providers (cached) coverage: 94.3% of statements ok github.com/lukaszraczylo/traefikoidc/middleware 0.808s coverage: 78.0% of statements ok github.com/lukaszraczylo/traefikoidc/recovery 0.653s coverage: 100.0% of statements ok github.com/lukaszraczylo/traefikoidc/session/chunking (cached) coverage: 87.8% of statements ok github.com/lukaszraczylo/traefikoidc/session/core (cached) coverage: 85.6% of statements ok github.com/lukaszraczylo/traefikoidc/session/crypto (cached) coverage: 81.8% of statements ok github.com/lukaszraczylo/traefikoidc/session/storage (cached) coverage: 93.5% of statements ok github.com/lukaszraczylo/traefikoidc/session/validators (cached) coverage: 98.8% of statements ```` * fixup! Splitting code into multiple files with reasonable testing coverage. * fixup! fixup! Splitting code into multiple files with reasonable testing coverage. * Weekend fun with further optimisations. * fixup! Weekend fun with further optimisations. * fixup! fixup! Weekend fun with further optimisations. * fixup! fixup! fixup! Weekend fun with further optimisations. * fixup! fixup! fixup! fixup! Weekend fun with further optimisations. * fixup! fixup! fixup! fixup! fixup! Weekend fun with further optimisations. * Pre-release cleanup. * Enhance test coverage. * fixup! Enhance test coverage. * fixup! fixup! Enhance test coverage. * fixup! fixup! fixup! Enhance test coverage.
2026-06-05 22:44:17 +00:00 · 2025-09-18 11:01:30 +01:00
parent 784b161732
commit 1b49e133da
181 changed files with 78067 additions and 8289 deletions
@@ -0,0 +1,109 @@
+package traefikoidc
+
+import (
+	"strings"
+	"sync"
+)
+
+// StringBuilderPool manages a pool of string builders for efficient string operations
+type StringBuilderPool struct {
+	pool sync.Pool
+}
+
+var (
+	globalStringBuilderPool     *StringBuilderPool
+	globalStringBuilderPoolOnce sync.Once
+)
+
+// GetGlobalStringBuilderPool returns the global string builder pool
+func GetGlobalStringBuilderPool() *StringBuilderPool {
+	globalStringBuilderPoolOnce.Do(func() {
+		globalStringBuilderPool = &StringBuilderPool{
+			pool: sync.Pool{
+				New: func() interface{} {
+					return &strings.Builder{}
+				},
+			},
+		}
+	})
+	return globalStringBuilderPool
+}
+
+// Get retrieves a string builder from the pool
+func (p *StringBuilderPool) Get() *strings.Builder {
+	sb := p.pool.Get().(*strings.Builder)
+	sb.Reset() // Ensure it's clean
+	return sb
+}
+
+// Put returns a string builder to the pool
+func (p *StringBuilderPool) Put(sb *strings.Builder) {
+	if sb == nil {
+		return
+	}
+	// Only return to pool if not too large (avoid keeping huge buffers)
+	if sb.Cap() <= 4096 {
+		sb.Reset()
+		p.pool.Put(sb)
+	}
+}
+
+// FormatString efficiently formats a string using the pool
+func (p *StringBuilderPool) FormatString(format func(*strings.Builder)) string {
+	sb := p.Get()
+	defer p.Put(sb)
+	format(sb)
+	return sb.String()
+}
+
+// BuildSessionName efficiently builds session names
+func BuildSessionName(baseName string, index int) string {
+	pool := GetGlobalStringBuilderPool()
+	return pool.FormatString(func(sb *strings.Builder) {
+		sb.WriteString(baseName)
+		sb.WriteRune('_')
+		// Efficient int to string conversion
+		if index < 10 {
+			sb.WriteRune('0' + rune(index))
+		} else {
+			sb.WriteString(sbIntToString(index))
+		}
+	})
+}
+
+// BuildCacheKey efficiently builds cache keys
+func BuildCacheKey(parts ...string) string {
+	pool := GetGlobalStringBuilderPool()
+	return pool.FormatString(func(sb *strings.Builder) {
+		for i, part := range parts {
+			if i > 0 {
+				sb.WriteRune(':')
+			}
+			sb.WriteString(part)
+		}
+	})
+}
+
+// sbIntToString converts int to string without allocation (for small numbers)
+func sbIntToString(n int) string {
+	if n < 0 {
+		return "-" + sbIntToString(-n)
+	}
+	if n < 10 {
+		return string(rune('0' + n))
+	}
+	if n < 100 {
+		return string(rune('0'+n/10)) + string(rune('0'+n%10))
+	}
+	// Fall back to standard conversion for larger numbers
+	buf := make([]byte, 0, 20)
+	for n > 0 {
+		buf = append(buf, byte('0'+n%10))
+		n /= 10
+	}
+	// Reverse the buffer
+	for i, j := 0, len(buf)-1; i < j; i, j = i+1, j-1 {
+		buf[i], buf[j] = buf[j], buf[i]
+	}
+	return string(buf)
+}