fixup! Cleanup tests.

README.md

@@ -377,22 +377,17 @@ spec:
       scopes:
         - roles  # Appended to defaults: ["openid", "profile", "email", "roles"]
       headers:
-        # Using YAML literal style to prevent Traefik from pre-evaluating templates
+        # Using double curly braces to escape template expressions
         - name: "X-User-Email"
-          value: |
-            {{.Claims.email}}
+          value: "{{{{.Claims.email}}}}"
         - name: "X-User-ID"
-          value: |
-            {{.Claims.sub}}
+          value: "{{{{.Claims.sub}}}}"
         - name: "Authorization"
-          value: |
-            Bearer {{.AccessToken}}
+          value: "Bearer {{{{.AccessToken}}}}"
         - name: "X-User-Roles"
-          value: |
-            {{range $i, $e := .Claims.roles}}{{if $i}},{{end}}{{$e}}{{end}}
+          value: "{{{{range $i, $e := .Claims.roles}}}}{{{{if $i}}}},{{{{end}}}}{{{{$e}}}}{{{{end}}}}"
         - name: "X-Is-Admin"
-          value: |
-            {{if eq .Claims.role "admin"}}true{{else}}false{{end}}
+          value: "{{{{if eq .Claims.role \"admin\"}}}}true{{{{else}}}}false{{{{end}}}}"
 ```
 
 ### With PKCE Enabled
@@ -664,45 +659,35 @@ Templates can access the following variables:
 
 If you encounter the error `can't evaluate field AccessToken in type bool` when starting Traefik, this indicates that Traefik is attempting to evaluate the template expressions before passing them to the plugin. This is a known issue when using template syntax in Traefik plugin configurations.
 
-**Solution:** Use one of these escaping methods:
+**Solution:** You must escape the template expressions using double curly braces:
 
-1. **Use YAML literal style (recommended):**
 ```yaml
 headers:
   - name: "Authorization"
-    value: |
-      Bearer {{.AccessToken}}
+    value: "Bearer {{{{.AccessToken}}}}"
 ```
 
-2. **Use single quotes:**
-```yaml
-headers:
-  - name: "Authorization"
-    value: 'Bearer {{.AccessToken}}'
-```
+This is the only reliable method that works consistently. Here's why:
 
-3. **Escape the template braces (for inline double quotes):**
-```yaml
-headers:
-  - name: "Authorization"
-    value: "Bearer {{"{{.AccessToken}}"}}"
-```
+- **Double curly braces (`{{{{.AccessToken}}}}`)** ✅
+  - The YAML parser converts `{{{{` → `{{` and `}}}}` → `}}`
+  - Result: `Bearer {{.AccessToken}}` reaches the Go template engine correctly
+
+- **Other methods (YAML literal style, single quotes) do NOT work** ❌
+  - These methods don't prevent Traefik's YAML parser from interpreting the curly braces
+  - The template syntax gets processed incorrectly before reaching the plugin
 
 **Working example configuration:**
 ```yaml
 headers:
   - name: "X-User-Email"
-    value: |
-      {{.Claims.email}}
+    value: "{{{{.Claims.email}}}}"
   - name: "X-User-ID"
-    value: |
-      {{.Claims.sub}}
+    value: "{{{{.Claims.sub}}}}"
   - name: "Authorization"
-    value: |
-      Bearer {{.AccessToken}}
+    value: "Bearer {{{{.AccessToken}}}}"
   - name: "X-User-Name"
-    value: |
-      {{.Claims.given_name}} {{.Claims.family_name}}
+    value: "{{{{.Claims.given_name}}}} {{{{.Claims.family_name}}}}"
 ```
 
 **Advanced template examples:**
@@ -711,23 +696,21 @@ Conditional logic:
 ```yaml
 headers:
   - name: "X-Is-Admin"
-    value: |
-      {{if eq .Claims.role "admin"}}true{{else}}false{{end}}
+    value: "{{{{if eq .Claims.role \"admin\"}}}}true{{{{else}}}}false{{{{end}}}}"
 ```
 
 Array handling:
 ```yaml
 headers:
   - name: "X-User-Roles"
-    value: |
-      {{range $i, $e := .Claims.roles}}{{if $i}},{{end}}{{$e}}{{end}}
+    value: "{{{{range $i, $e := .Claims.roles}}}}{{{{if $i}}}},{{{{end}}}}{{{{$e}}}}{{{{end}}}}"
 ```
 
 **Notes:**
 - Variable names are case-sensitive (use `.Claims`, not `.claims`)
 - Missing claims will result in `<no value>` in the header value
 - The middleware validates templates during startup and logs errors for invalid templates
-- If templates are not properly escaped, Traefik may attempt to evaluate them during configuration parsing, leading to errors
+- Always use double curly braces (`{{{{` and `}}}}`) to escape template expressions in YAML configuration files
 
 ### Default Headers Set for Downstream Services
 
@@ -851,8 +834,8 @@ logLevel: debug
 4. **Access denied: Your email domain is not allowed**: The user's email domain is not in the `allowedUserDomains` list.
 5. **Access denied: You do not have any of the allowed roles or groups**: The user doesn't have any of the roles or groups specified in `allowedRolesAndGroups`.
 6. **"can't evaluate field AccessToken in type bool" error**: This error occurs when Traefik attempts to evaluate template expressions in the headers configuration before passing them to the plugin. To fix this:
-   - Use YAML literal style for header values: `value: |` followed by the template on the next line
-   - Or use single quotes: `value: 'Bearer {{.AccessToken}}'`
+   - Use double curly braces to escape template expressions: `value: "Bearer {{{{.AccessToken}}}}"`
+   - This is the only reliable method that works with Traefik's YAML parsing
    - See the [Templated Headers](#templated-headers) section for complete examples
 7. **Google sessions expire after ~1 hour**: If using Google as the OIDC provider and sessions expire prematurely (around 1 hour instead of longer), ensure:
    - Do NOT manually add the `offline_access` scope. Google rejects this scope as invalid.