Splitting code into multiple files with reasonable testing coverage.

``` ok github.com/lukaszraczylo/traefikoidc 117.017s coverage: 72.6% of statements ok github.com/lukaszraczylo/traefikoidc/auth 0.505s coverage: 87.1% of statements ok github.com/lukaszraczylo/traefikoidc/circuit_breaker 0.283s coverage: 99.0% of statements github.com/lukaszraczylo/traefikoidc/config coverage: 0.0% of statements ok github.com/lukaszraczylo/traefikoidc/handlers 0.349s coverage: 98.2% of statements ok github.com/lukaszraczylo/traefikoidc/internal/providers (cached) coverage: 94.3% of statements ok github.com/lukaszraczylo/traefikoidc/middleware 0.808s coverage: 78.0% of statements ok github.com/lukaszraczylo/traefikoidc/recovery 0.653s coverage: 100.0% of statements ok github.com/lukaszraczylo/traefikoidc/session/chunking (cached) coverage: 87.8% of statements ok github.com/lukaszraczylo/traefikoidc/session/core (cached) coverage: 85.6% of statements ok github.com/lukaszraczylo/traefikoidc/session/crypto (cached) coverage: 81.8% of statements ok github.com/lukaszraczylo/traefikoidc/session/storage (cached) coverage: 93.5% of statements ok github.com/lukaszraczylo/traefikoidc/session/validators (cached) coverage: 98.8% of statements ````
2026-10-14 04:07:46 +00:00 · 2025-09-07 12:57:18 +01:00
parent c9a23dc6c0
commit 4371f9fffd
26 changed files with 15091 additions and 243 deletions
@@ -0,0 +1,113 @@
+// Package traefikoidc provides OIDC authentication middleware for Traefik.
+package traefikoidc
+
+import (
+	"context"
+	"net/http"
+	"sync"
+	"text/template"
+	"time"
+
+	"golang.org/x/time/rate"
+)
+
+// CacheInterface defines the common cache operations
+type CacheInterface interface {
+	Set(key string, value interface{}, ttl time.Duration)
+	Get(key string) (interface{}, bool)
+	Delete(key string)
+	SetMaxSize(size int)
+	Cleanup()
+	Close()
+}
+
+// TokenVerifier interface defines token verification capabilities.
+// Implementations should validate token format, signature, and claims.
+type TokenVerifier interface {
+	VerifyToken(token string) error
+}
+
+// JWTVerifier interface defines JWT-specific verification capabilities.
+// Implementations should validate JWT structure, signature using JWKs, and standard claims.
+type JWTVerifier interface {
+	VerifyJWTSignatureAndClaims(jwt *JWT, token string) error
+}
+
+// TokenExchanger interface defines OAuth 2.0 and OpenID Connect token exchange capabilities.
+// Implementations should handle authorization code exchange, refresh tokens, and revocation
+// according to the OAuth 2.0 and OpenID Connect specifications.
+type TokenExchanger interface {
+	ExchangeCodeForToken(ctx context.Context, grantType string, codeOrToken string, redirectURL string, codeVerifier string) (*TokenResponse, error)
+	GetNewTokenWithRefreshToken(refreshToken string) (*TokenResponse, error)
+	RevokeTokenWithProvider(token, tokenType string) error
+}
+
+// ProviderMetadata represents OIDC provider configuration data.
+// This data is typically retrieved from the provider's .well-known/openid-configuration endpoint
+// and contains essential URLs for authentication, token exchange, and key retrieval.
+type ProviderMetadata struct {
+	Issuer        string `json:"issuer"`
+	AuthURL       string `json:"authorization_endpoint"`
+	TokenURL      string `json:"token_endpoint"`
+	JWKSURL       string `json:"jwks_uri"`
+	RevokeURL     string `json:"revocation_endpoint"`
+	EndSessionURL string `json:"end_session_endpoint"`
+}
+
+// TraefikOidc is the main middleware struct that implements OIDC authentication for Traefik.
+// It integrates with various OIDC providers, manages sessions, caches tokens, and handles
+// the complete authentication flow. It's designed to work seamlessly with Traefik's
+// plugin system and provides flexible configuration options.
+type TraefikOidc struct {
+	jwkCache                   JWKCacheInterface
+	jwtVerifier                JWTVerifier
+	ctx                        context.Context
+	tokenVerifier              TokenVerifier
+	next                       http.Handler
+	tokenExchanger             TokenExchanger
+	initComplete               chan struct{}
+	limiter                    *rate.Limiter
+	tokenBlacklist             CacheInterface
+	headerTemplates            map[string]*template.Template
+	sessionManager             *SessionManager
+	tokenCleanupStopChan       chan struct{}
+	excludedURLs               map[string]struct{}
+	extractClaimsFunc          func(tokenString string) (map[string]interface{}, error)
+	initiateAuthenticationFunc func(rw http.ResponseWriter, req *http.Request, session *SessionData, redirectURL string)
+	metadataCache              *MetadataCache
+	allowedRolesAndGroups      map[string]struct{}
+	allowedUsers               map[string]struct{}
+	allowedUserDomains         map[string]struct{}
+	tokenCache                 *TokenCache
+	httpClient                 *http.Client
+	tokenHTTPClient            *http.Client
+	logger                     *Logger
+	metadataRefreshStopChan    chan struct{}
+	cancelFunc                 context.CancelFunc
+	errorRecoveryManager       *ErrorRecoveryManager
+	goroutineWG                *sync.WaitGroup
+	clientSecret               string
+	clientID                   string
+	name                       string
+	redirURLPath               string
+	logoutURLPath              string
+	tokenURL                   string
+	authURL                    string
+	endSessionURL              string
+	postLogoutRedirectURI      string
+	scheme                     string
+	jwksURL                    string
+	issuerURL                  string
+	revocationURL              string
+	providerURL                string
+	scopes                     []string
+	refreshGracePeriod         time.Duration
+	shutdownOnce               sync.Once
+	firstRequestMutex          sync.Mutex
+	forceHTTPS                 bool
+	enablePKCE                 bool
+	overrideScopes             bool
+	suppressDiagnosticLogs     bool
+	firstRequestReceived       bool
+	metadataRefreshStarted     bool
+}