From 3025f079b898665b928f84a0a50c79127e82148e Mon Sep 17 00:00:00 2001
From: Tristan Robert <tristan.robert.44@gmail.com>
Date: Mon, 6 Jan 2025 14:12:10 +0100
Subject: [PATCH 01/13] OIDC issuer behind a proxy cannot be accessed Fixes
 #942

---
 app/server/lib/OIDCConfig.ts | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/app/server/lib/OIDCConfig.ts b/app/server/lib/OIDCConfig.ts
index b14a269350..74fcf1761c 100644
--- a/app/server/lib/OIDCConfig.ts
+++ b/app/server/lib/OIDCConfig.ts
@@ -80,6 +80,7 @@ import { StringUnionError } from 'app/common/StringUnion';
 import { EnabledProtection, EnabledProtectionString, ProtectionsManager } from './oidc/Protections';
 import { SessionObj } from './BrowserSession';
 import { getOriginUrl } from './requestUtils';
+import { proxyAgent } from './ProxyAgent';
 
 const CALLBACK_URL = '/oauth2/callback';
 
@@ -181,6 +182,7 @@ export class OIDCConfig {
 
     this._redirectUrl = new URL(CALLBACK_URL, spHost).href;
     custom.setHttpOptionsDefaults({
+      agent: issuerUrl !== undefined ? proxyAgent(new URL(issuerUrl)) : undefined,
       ...(httpTimeout !== undefined ? {timeout: httpTimeout} : {}),
     });
     await this._initClient({ issuerUrl, clientId, clientSecret, extraMetadata });

From 337859a2e1f038f04e8ef1d271965ca083f5979e Mon Sep 17 00:00:00 2001
From: Tristan Robert <tristan.robert.44@gmail.com>
Date: Mon, 6 Jan 2025 14:55:53 +0100
Subject: [PATCH 02/13] fixes oidc config test

---
 app/server/lib/OIDCConfig.ts  | 2 +-
 test/server/lib/OIDCConfig.ts | 4 +++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/app/server/lib/OIDCConfig.ts b/app/server/lib/OIDCConfig.ts
index 74fcf1761c..68132962a7 100644
--- a/app/server/lib/OIDCConfig.ts
+++ b/app/server/lib/OIDCConfig.ts
@@ -182,7 +182,7 @@ export class OIDCConfig {
 
     this._redirectUrl = new URL(CALLBACK_URL, spHost).href;
     custom.setHttpOptionsDefaults({
-      agent: issuerUrl !== undefined ? proxyAgent(new URL(issuerUrl)) : undefined,
+      ...(issuerUrl !== undefined ? {agent: proxyAgent(new URL(issuerUrl))} : {}),
       ...(httpTimeout !== undefined ? {timeout: httpTimeout} : {}),
     });
     await this._initClient({ issuerUrl, clientId, clientSecret, extraMetadata });
diff --git a/test/server/lib/OIDCConfig.ts b/test/server/lib/OIDCConfig.ts
index d7f46814d2..f3422b1609 100644
--- a/test/server/lib/OIDCConfig.ts
+++ b/test/server/lib/OIDCConfig.ts
@@ -197,7 +197,7 @@ describe('OIDCConfig', () => {
       [
         {
           itMsg: 'when omitted should not override openid-client default value',
-          expectedUserDefinedHttpOptions: {}
+          expectedUserDefinedHttpOptions: { agent: undefined }
         },
         {
           itMsg: 'should reject when the provided value is not a number',
@@ -213,6 +213,7 @@ describe('OIDCConfig', () => {
           },
           shouldSetTimeout: true,
           expectedUserDefinedHttpOptions: {
+            agent: undefined,
             timeout: 10000
           }
         },
@@ -222,6 +223,7 @@ describe('OIDCConfig', () => {
             GRIST_OIDC_SP_HTTP_TIMEOUT: '0',
           },
           expectedUserDefinedHttpOptions: {
+            agent: undefined,
             timeout: 0
           }
         }

From e15d5e59f37e2a044b67cd74f39e016d35863310 Mon Sep 17 00:00:00 2001
From: Tristan Robert <tristan.robert.44@gmail.com>
Date: Wed, 8 Jan 2025 14:02:13 +0100
Subject: [PATCH 03/13] OIDC issuer behind a proxy cannot be accessed Fixes
 #942

---
 app/server/lib/OIDCConfig.ts  |  3 ++-
 test/server/lib/OIDCConfig.ts | 35 ++++++++++++++++++++++++++++++++---
 2 files changed, 34 insertions(+), 4 deletions(-)

diff --git a/app/server/lib/OIDCConfig.ts b/app/server/lib/OIDCConfig.ts
index 68132962a7..6cc65cf77e 100644
--- a/app/server/lib/OIDCConfig.ts
+++ b/app/server/lib/OIDCConfig.ts
@@ -181,8 +181,9 @@ export class OIDCConfig {
     this._protectionManager = new ProtectionsManager(enabledProtections);
 
     this._redirectUrl = new URL(CALLBACK_URL, spHost).href;
+    const agent = issuerUrl !== undefined ? proxyAgent(new URL(issuerUrl)) : undefined;
     custom.setHttpOptionsDefaults({
-      ...(issuerUrl !== undefined ? {agent: proxyAgent(new URL(issuerUrl))} : {}),
+      ...(agent !== undefined ? {agent} : {}),
       ...(httpTimeout !== undefined ? {timeout: httpTimeout} : {}),
     });
     await this._initClient({ issuerUrl, clientId, clientSecret, extraMetadata });
diff --git a/test/server/lib/OIDCConfig.ts b/test/server/lib/OIDCConfig.ts
index f3422b1609..8e7559878b 100644
--- a/test/server/lib/OIDCConfig.ts
+++ b/test/server/lib/OIDCConfig.ts
@@ -10,6 +10,7 @@ import express from "express";
 import _ from "lodash";
 import {RequestWithLogin} from "app/server/lib/Authorizer";
 import { SendAppPageFunction } from "app/server/lib/sendAppPage";
+import {HttpProxyAgent} from "http-proxy-agent";
 
 const NOOPED_SEND_APP_PAGE: SendAppPageFunction = () => Promise.resolve();
 
@@ -197,7 +198,7 @@ describe('OIDCConfig', () => {
       [
         {
           itMsg: 'when omitted should not override openid-client default value',
-          expectedUserDefinedHttpOptions: { agent: undefined }
+          expectedUserDefinedHttpOptions: { }
         },
         {
           itMsg: 'should reject when the provided value is not a number',
@@ -213,7 +214,6 @@ describe('OIDCConfig', () => {
           },
           shouldSetTimeout: true,
           expectedUserDefinedHttpOptions: {
-            agent: undefined,
             timeout: 10000
           }
         },
@@ -223,7 +223,6 @@ describe('OIDCConfig', () => {
             GRIST_OIDC_SP_HTTP_TIMEOUT: '0',
           },
           expectedUserDefinedHttpOptions: {
-            agent: undefined,
             timeout: 0
           }
         }
@@ -243,6 +242,36 @@ describe('OIDCConfig', () => {
         });
       });
     });
+
+  describe('GRIST_HTTPS_PROXY', function () {
+    const proxyURL = 'http://localhost-proxy8080';
+    const httpAgent = new HttpProxyAgent(proxyURL);
+    [
+        {
+          itMsg: 'when omitted should not set proxyAgent to oidc-client',
+          expectedUserDefinedHttpOptions: { }
+        },
+        {
+          itMsg: 'should add proxyAgent to openid-client',
+          env: {
+            GRIST_HTTPS_PROXY: proxyURL,
+          },
+          expectedUserDefinedHttpOptions: {
+            agent: httpAgent
+          }
+        }
+      ].forEach(ctx => {
+        it(ctx.itMsg, async () => {
+          const setHttpOptionsDefaultsStub = sandbox.stub(custom, 'setHttpOptionsDefaults');
+          setEnvVars();
+          Object.assign(process.env, ctx.env);
+          const promise = OIDCConfigStubbed.buildWithStub();
+          await assert.isFulfilled(promise, 'initOIDC should have been fulfilled');
+          assert.isTrue(setHttpOptionsDefaultsStub.calledOnce, 'Should have called custom.setHttpOptionsDefaults');
+          Sinon.assert.match(setHttpOptionsDefaultsStub.firstCall.args[0], ctx.expectedUserDefinedHttpOptions);
+        });
+      });
+  });
   });
 
   describe('GRIST_OIDC_IDP_ENABLED_PROTECTIONS', () => {

From 0584b854787b9515bec33063dbecb818c917f838 Mon Sep 17 00:00:00 2001
From: Tristan Robert <tristan.robert.44@gmail.com>
Date: Fri, 10 Jan 2025 08:31:24 +0100
Subject: [PATCH 04/13] Update app/server/lib/OIDCConfig.ts

Co-authored-by: Florent <florent.git@zeteo.me>
---
 app/server/lib/OIDCConfig.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app/server/lib/OIDCConfig.ts b/app/server/lib/OIDCConfig.ts
index 6cc65cf77e..44c562bdf1 100644
--- a/app/server/lib/OIDCConfig.ts
+++ b/app/server/lib/OIDCConfig.ts
@@ -181,7 +181,7 @@ export class OIDCConfig {
     this._protectionManager = new ProtectionsManager(enabledProtections);
 
     this._redirectUrl = new URL(CALLBACK_URL, spHost).href;
-    const agent = issuerUrl !== undefined ? proxyAgent(new URL(issuerUrl)) : undefined;
+    const agent = proxyAgent(new URL(issuerUrl));
     custom.setHttpOptionsDefaults({
       ...(agent !== undefined ? {agent} : {}),
       ...(httpTimeout !== undefined ? {timeout: httpTimeout} : {}),

From b4e0a4eb8e5ca41ed5ba7acd5d77a98030ad7a4c Mon Sep 17 00:00:00 2001
From: Tristan Robert <tristan.robert.44@gmail.com>
Date: Fri, 10 Jan 2025 08:32:32 +0100
Subject: [PATCH 05/13] Update test/server/lib/OIDCConfig.ts

Co-authored-by: Florent <florent.git@zeteo.me>
---
 test/server/lib/OIDCConfig.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/test/server/lib/OIDCConfig.ts b/test/server/lib/OIDCConfig.ts
index 8e7559878b..8880e46c31 100644
--- a/test/server/lib/OIDCConfig.ts
+++ b/test/server/lib/OIDCConfig.ts
@@ -244,7 +244,7 @@ describe('OIDCConfig', () => {
     });
 
   describe('GRIST_HTTPS_PROXY', function () {
-    const proxyURL = 'http://localhost-proxy8080';
+    const proxyURL = 'http://localhost-proxy:8080';
     const httpAgent = new HttpProxyAgent(proxyURL);
     [
         {

From 0b45e5c1c96892b4e18ee66838ce376fed83c444 Mon Sep 17 00:00:00 2001
From: Tristan Robert <tristan.robert.44@gmail.com>
Date: Fri, 10 Jan 2025 09:38:00 +0100
Subject: [PATCH 06/13] Update test/server/lib/OIDCConfig.ts

Co-authored-by: Florent <florent.git@zeteo.me>
---
 test/server/lib/OIDCConfig.ts | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/test/server/lib/OIDCConfig.ts b/test/server/lib/OIDCConfig.ts
index 8880e46c31..b4cb08cd18 100644
--- a/test/server/lib/OIDCConfig.ts
+++ b/test/server/lib/OIDCConfig.ts
@@ -268,7 +268,8 @@ describe('OIDCConfig', () => {
           const promise = OIDCConfigStubbed.buildWithStub();
           await assert.isFulfilled(promise, 'initOIDC should have been fulfilled');
           assert.isTrue(setHttpOptionsDefaultsStub.calledOnce, 'Should have called custom.setHttpOptionsDefaults');
-          Sinon.assert.match(setHttpOptionsDefaultsStub.firstCall.args[0], ctx.expectedUserDefinedHttpOptions);
+          const actualHttpOptions = _.omit(setHttpOptionsDefaultsStub.firstCall.args[0], 'agent.callback');
+          assert.deepEqual(actualHttpOptions, ctx.expectedUserDefinedHttpOptions);
         });
       });
   });

From 19f556de17beb96f9f8d7a4628151fb53aa425ed Mon Sep 17 00:00:00 2001
From: Tristan Robert <Tristan.Robert@developpement-durable.gouv.fr>
Date: Fri, 10 Jan 2025 11:35:05 +0100
Subject: [PATCH 07/13] OIDC issuer behind a proxy cannot be accessed Fixes
 #942

---
 test/server/lib/OIDCConfig.ts | 54 +++++++++++++++++------------------
 1 file changed, 27 insertions(+), 27 deletions(-)

diff --git a/test/server/lib/OIDCConfig.ts b/test/server/lib/OIDCConfig.ts
index b4cb08cd18..2fde13e284 100644
--- a/test/server/lib/OIDCConfig.ts
+++ b/test/server/lib/OIDCConfig.ts
@@ -243,36 +243,36 @@ describe('OIDCConfig', () => {
       });
     });
 
-  describe('GRIST_HTTPS_PROXY', function () {
-    const proxyURL = 'http://localhost-proxy:8080';
-    const httpAgent = new HttpProxyAgent(proxyURL);
-    [
-        {
-          itMsg: 'when omitted should not set proxyAgent to oidc-client',
-          expectedUserDefinedHttpOptions: { }
-        },
-        {
-          itMsg: 'should add proxyAgent to openid-client',
-          env: {
-            GRIST_HTTPS_PROXY: proxyURL,
+    describe('GRIST_HTTPS_PROXY', function () {
+      const proxyURL = 'http://localhost-proxy:8080';
+      const httpAgent = new HttpProxyAgent(proxyURL);
+      [
+          {
+            itMsg: 'when omitted should not set proxyAgent to oidc-client',
+            expectedUserDefinedHttpOptions: { }
           },
-          expectedUserDefinedHttpOptions: {
-            agent: httpAgent
+          {
+            itMsg: 'should add proxyAgent to openid-client',
+            env: {
+              GRIST_HTTPS_PROXY: proxyURL,
+            },
+            expectedUserDefinedHttpOptions: {
+              agent: httpAgent
+            }
           }
-        }
-      ].forEach(ctx => {
-        it(ctx.itMsg, async () => {
-          const setHttpOptionsDefaultsStub = sandbox.stub(custom, 'setHttpOptionsDefaults');
-          setEnvVars();
-          Object.assign(process.env, ctx.env);
-          const promise = OIDCConfigStubbed.buildWithStub();
-          await assert.isFulfilled(promise, 'initOIDC should have been fulfilled');
-          assert.isTrue(setHttpOptionsDefaultsStub.calledOnce, 'Should have called custom.setHttpOptionsDefaults');
-          const actualHttpOptions = _.omit(setHttpOptionsDefaultsStub.firstCall.args[0], 'agent.callback');
-          assert.deepEqual(actualHttpOptions, ctx.expectedUserDefinedHttpOptions);
+        ].forEach(ctx => {
+          it(ctx.itMsg, async () => {
+            const setHttpOptionsDefaultsStub = sandbox.stub(custom, 'setHttpOptionsDefaults');
+            setEnvVars();
+            Object.assign(process.env, ctx.env);
+            const promise = OIDCConfigStubbed.buildWithStub();
+            await assert.isFulfilled(promise, 'initOIDC should have been fulfilled');
+            assert.isTrue(setHttpOptionsDefaultsStub.calledOnce, 'Should have called custom.setHttpOptionsDefaults');
+            const actualHttpOptions = _.omit(setHttpOptionsDefaultsStub.firstCall.args[0], 'agent.callback');
+            assert.deepEqual(actualHttpOptions, ctx.expectedUserDefinedHttpOptions);
+          });
         });
-      });
-  });
+    });
   });
 
   describe('GRIST_OIDC_IDP_ENABLED_PROTECTIONS', () => {

From cf4a060991ee3d3be746eb2a2c1cb2e2ccbdefc6 Mon Sep 17 00:00:00 2001
From: Tristan Robert <tristan.robert.44@gmail.com>
Date: Mon, 20 Jan 2025 13:37:45 +0100
Subject: [PATCH 08/13] refactor: :recycle: refactors proxyAgent in two trusted
 and unstrusted agents

As discussed in https://github.com/gristlabs/grist-core/pull/1363#issuecomment-2596076325
---
 README.md                          |  3 +-
 app/server/lib/OIDCConfig.ts       |  4 +-
 app/server/lib/ProxyAgent.ts       | 33 +++++++++--
 app/server/lib/Requests.ts         |  4 +-
 app/server/lib/Triggers.ts         |  4 +-
 app/server/lib/WidgetRepository.ts |  6 +-
 test/server/lib/OIDCConfig.ts      |  4 +-
 test/server/lib/ProxyAgent.ts      | 92 +++++++++++++++++++++++++-----
 8 files changed, 121 insertions(+), 29 deletions(-)

diff --git a/README.md b/README.md
index 607e934e3e..4461290b9c 100644
--- a/README.md
+++ b/README.md
@@ -278,7 +278,8 @@ Grist can be configured in many ways. Here are the main environment variables it
 | GRIST_ENABLE_REQUEST_FUNCTION      | enables the REQUEST function. This function performs HTTP requests in a similar way to `requests.request`. This function presents a significant security risk, since it can let users call internal endpoints when Grist is available publicly. This function can also cause performance issues. Unset by default.                                            |
 | GRIST_HIDE_UI_ELEMENTS             | comma-separated list of UI features to disable. Allowed names of parts: `helpCenter,billing,templates,createSite,multiSite,multiAccounts,sendToDrive,tutorials,supportGrist`. If a part also exists in GRIST_UI_FEATURES, it will still be disabled.                                                                                                          |
 | GRIST_HOST                         | hostname to use when listening on a port.                                                                                                                                                                                                                                                                                                                     |
-| GRIST_HTTPS_PROXY                  | if set, use this proxy for webhook payload delivery or fetching custom widgets repository from url.                                                                                                                                                                                                                                                                                                          |
+| GRIST_HTTPS_PROXY                  | if set with url, use this proxy for webhook payload delivery; if not set or set to direct it call direct webhook payload.                                                                                                                                                                                                                                                                                                          |
+| HTTPS_PROXY or https_proxy         | if set, use this reverse web proxy (corporate proxy) for fetching custom widgets repository from url or OIDC config from issuer url outside the grist stack.                                                                                                                                                                                                                                                                                                          |
 | GRIST_ID_PREFIX                    | for subdomains of form o-*, expect or produce o-${GRIST_ID_PREFIX}*.                                                                                                                                                                                                                                                                                          |
 | GRIST_IGNORE_SESSION               | if set, Grist will not use a session for authentication.                                                                                                                                                                                                                                                                                                      |
 | GRIST_INCLUDE_CUSTOM_SCRIPT_URL    | if set, will load the referenced URL in a `<script>` tag on all app pages.                                                                                                                                                                                                                                                                                    |
diff --git a/app/server/lib/OIDCConfig.ts b/app/server/lib/OIDCConfig.ts
index 44c562bdf1..1e1d91d270 100644
--- a/app/server/lib/OIDCConfig.ts
+++ b/app/server/lib/OIDCConfig.ts
@@ -80,7 +80,7 @@ import { StringUnionError } from 'app/common/StringUnion';
 import { EnabledProtection, EnabledProtectionString, ProtectionsManager } from './oidc/Protections';
 import { SessionObj } from './BrowserSession';
 import { getOriginUrl } from './requestUtils';
-import { proxyAgent } from './ProxyAgent';
+import { proxyAgentForTrustedRequests } from './ProxyAgent';
 
 const CALLBACK_URL = '/oauth2/callback';
 
@@ -181,7 +181,7 @@ export class OIDCConfig {
     this._protectionManager = new ProtectionsManager(enabledProtections);
 
     this._redirectUrl = new URL(CALLBACK_URL, spHost).href;
-    const agent = proxyAgent(new URL(issuerUrl));
+    const agent = proxyAgentForTrustedRequests(new URL(issuerUrl));
     custom.setHttpOptionsDefaults({
       ...(agent !== undefined ? {agent} : {}),
       ...(httpTimeout !== undefined ? {timeout: httpTimeout} : {}),
diff --git a/app/server/lib/ProxyAgent.ts b/app/server/lib/ProxyAgent.ts
index e587cf158c..451adec2d7 100644
--- a/app/server/lib/ProxyAgent.ts
+++ b/app/server/lib/ProxyAgent.ts
@@ -2,13 +2,13 @@ import {HttpsProxyAgent} from "https-proxy-agent";
 import {HttpProxyAgent} from "http-proxy-agent";
 import log from 'app/server/lib/log';
 
-export function proxyAgent(requestUrl: URL): HttpProxyAgent | HttpsProxyAgent | undefined {
-  const proxy = process.env.GRIST_HTTPS_PROXY;
-  if (!proxy) {
+export function proxyAgentForTrustedRequests(requestUrl: URL): HttpProxyAgent | HttpsProxyAgent | undefined {
+  const httpsProxy = process.env.HTTPS_PROXY ? process.env.HTTPS_PROXY : process.env.https_proxy;
+  if (!httpsProxy) {
     return undefined;
   }
   const ProxyAgent = requestUrl.protocol === "https:" ? HttpsProxyAgent : HttpProxyAgent;
-  const agent = new ProxyAgent(proxy);
+  const agent = new ProxyAgent(httpsProxy);
 
   // Wrap the main method of ProxyAgent into a wrapper that logs errors.
   const callback = agent.callback;
@@ -18,7 +18,30 @@ export function proxyAgent(requestUrl: URL): HttpProxyAgent | HttpsProxyAgent |
     } catch (e) {
       // Include info helpful for diagnosing issues (but not the potentially sensitive full requestUrl).
       log.rawWarn(`ProxyAgent error ${e}`,
-        {proxy, reqProtocol: requestUrl.protocol, requestOrigin: requestUrl.origin});
+        {proxy: httpsProxy, reqProtocol: requestUrl.protocol, requestOrigin: requestUrl.origin});
+      throw e;
+    }
+  };
+  return agent;
+}
+
+export function proxyAgentForUntrustedRequests(requestUrl: URL): HttpProxyAgent | HttpsProxyAgent | undefined {
+  const gristProxy = process.env.GRIST_HTTPS_PROXY;
+  if (gristProxy === "direct" || !gristProxy) {
+    return undefined;
+  }
+  const ProxyAgent = requestUrl.protocol === "https:" ? HttpsProxyAgent : HttpProxyAgent;
+  const agent = new ProxyAgent(gristProxy);
+
+  // Wrap the main method of ProxyAgent into a wrapper that logs errors.
+  const callback = agent.callback;
+  agent.callback = async function () {
+    try {
+      return await callback.apply(this, arguments as any);
+    } catch (e) {
+      // Include info helpful for diagnosing issues (but not the potentially sensitive full requestUrl).
+      log.rawWarn(`ProxyAgent error ${e}`,
+        {proxy: gristProxy, reqProtocol: requestUrl.protocol, requestOrigin: requestUrl.origin});
       throw e;
     }
   };
diff --git a/app/server/lib/Requests.ts b/app/server/lib/Requests.ts
index 69f5dd9e9d..910af14950 100644
--- a/app/server/lib/Requests.ts
+++ b/app/server/lib/Requests.ts
@@ -7,7 +7,7 @@ import * as path from 'path';
 import * as tmp from 'tmp';
 import * as fse from 'fs-extra';
 import log from 'app/server/lib/log';
-import {proxyAgent} from "app/server/lib/ProxyAgent";
+import {proxyAgentForTrustedRequests} from "app/server/lib/ProxyAgent";
 import chunk = require('lodash/chunk');
 import fromPairs = require('lodash/fromPairs');
 import zipObject = require('lodash/zipObject');
@@ -91,7 +91,7 @@ export class DocRequests {
       }
       const response = await fetch(urlObj.toString(), {
         headers: headers || {},
-        agent: proxyAgent(urlObj),
+        agent: proxyAgentForTrustedRequests(urlObj),
         method,
         body
       });
diff --git a/app/server/lib/Triggers.ts b/app/server/lib/Triggers.ts
index 81af4c428e..371b58ba47 100644
--- a/app/server/lib/Triggers.ts
+++ b/app/server/lib/Triggers.ts
@@ -19,7 +19,7 @@ import {decodeObject} from 'app/plugin/objtypes';
 import {ActiveDoc} from 'app/server/lib/ActiveDoc';
 import {makeExceptionalDocSession} from 'app/server/lib/DocSession';
 import log from 'app/server/lib/log';
-import {proxyAgent} from 'app/server/lib/ProxyAgent';
+import {proxyAgentForUntrustedRequests} from 'app/server/lib/ProxyAgent';
 import {matchesBaseDomain} from 'app/server/lib/requestUtils';
 import {delayAbort} from 'app/server/lib/serverUtils';
 import {LogSanitizer} from "app/server/utils/LogSanitizer";
@@ -814,7 +814,7 @@ export class DocTriggers {
             ...(authorization ? {'Authorization': authorization} : {}),
           },
           signal,
-          agent: proxyAgent(new URL(url)),
+          agent: proxyAgentForUntrustedRequests(new URL(url)),
         });
         if (response.status === 200) {
           await this._stats.logBatch(id, 'success', { size, httpStatus: 200, error: null, attempts: attempt + 1 });
diff --git a/app/server/lib/WidgetRepository.ts b/app/server/lib/WidgetRepository.ts
index b4fd71998e..df3d782e47 100644
--- a/app/server/lib/WidgetRepository.ts
+++ b/app/server/lib/WidgetRepository.ts
@@ -9,7 +9,7 @@ import {GristServer} from 'app/server/lib/GristServer';
 import LRUCache from 'lru-cache';
 import * as url from 'url';
 import { AsyncCreate } from 'app/common/AsyncCreate';
-import { proxyAgent } from 'app/server/lib/ProxyAgent';
+import { proxyAgentForTrustedRequests } from 'app/server/lib/ProxyAgent';
 
 // Static url for UrlWidgetRepository
 const STATIC_URL = process.env.GRIST_WIDGET_LIST_URL;
@@ -110,7 +110,9 @@ export class UrlWidgetRepository implements IWidgetRepository {
       return [];
     }
     try {
-      const response = await fetch(this._staticUrl, { agent: proxyAgent(new URL(this._staticUrl)) });
+      const response = await fetch(this._staticUrl, {
+        agent: proxyAgentForTrustedRequests(new URL(this._staticUrl))
+      });
       if (!response.ok) {
         if (response.status === 404) {
           throw new ApiError('WidgetRepository: Remote widget list not found', 404);
diff --git a/test/server/lib/OIDCConfig.ts b/test/server/lib/OIDCConfig.ts
index 2fde13e284..a74798ef5a 100644
--- a/test/server/lib/OIDCConfig.ts
+++ b/test/server/lib/OIDCConfig.ts
@@ -243,7 +243,7 @@ describe('OIDCConfig', () => {
       });
     });
 
-    describe('GRIST_HTTPS_PROXY', function () {
+    describe('HTTPS_PROXY trusted proxy', function () {
       const proxyURL = 'http://localhost-proxy:8080';
       const httpAgent = new HttpProxyAgent(proxyURL);
       [
@@ -254,7 +254,7 @@ describe('OIDCConfig', () => {
           {
             itMsg: 'should add proxyAgent to openid-client',
             env: {
-              GRIST_HTTPS_PROXY: proxyURL,
+              HTTPS_PROXY: proxyURL,
             },
             expectedUserDefinedHttpOptions: {
               agent: httpAgent
diff --git a/test/server/lib/ProxyAgent.ts b/test/server/lib/ProxyAgent.ts
index 6cb18b2301..a9ec6c4b30 100644
--- a/test/server/lib/ProxyAgent.ts
+++ b/test/server/lib/ProxyAgent.ts
@@ -1,4 +1,4 @@
-import {proxyAgent} from "app/server/lib/ProxyAgent";
+import {proxyAgentForTrustedRequests, proxyAgentForUntrustedRequests} from "app/server/lib/ProxyAgent";
 import {getAvailablePort} from "app/server/lib/serverUtils";
 import {assert} from "chai";
 import {HttpsProxyAgent} from "https-proxy-agent";
@@ -19,25 +19,89 @@ describe("ProxyAgent", function () {
     oldEnv.restore();
   });
 
-  it("should be undefined if no proxy is configured", async function () {
+  it("trusted and untrusted should be undefined if not configured", async function () {
+    delete process.env.HTTPS_PROXY;
+    delete process.env.https_proxy;
     delete process.env.GRIST_HTTPS_PROXY;
-    const httpProxy = proxyAgent(new URL("http://localhost:3000"));
-    const httpsProxy = proxyAgent(new URL("https://localhost:3000"));
+    const trustedHttpProxy = proxyAgentForTrustedRequests(new URL("http://localhost:3000"));
+    const trustedHttpsProxy = proxyAgentForTrustedRequests(new URL("https://localhost:3000"));
+    const untrustedHttpProxy = proxyAgentForUntrustedRequests(new URL("http://localhost:3000"));
+    const untrustedHttpsProxy = proxyAgentForUntrustedRequests(new URL("https://localhost:3000"));
 
-    assert.equal(httpProxy, undefined);
-    assert.equal(httpsProxy, undefined);
+    assert.equal(trustedHttpProxy, undefined);
+    assert.equal(trustedHttpsProxy, undefined);
+    assert.equal(untrustedHttpProxy, undefined);
+    assert.equal(untrustedHttpsProxy, undefined);
   });
 
-  it("should be https proxy if proxy is configured and address is https", async function () {
+  it("untrusted should be undefined if no proxy and trusted should be proxied if configured", async function () {
+    delete process.env.GRIST_HTTPS_PROXY;
+    process.env.HTTPS_PROXY = "https://localhost:8080";
+    process.env.https_proxy = "https://localhost:8080";
+    const trustedHttpProxy = proxyAgentForTrustedRequests(new URL("http://localhost:3000"));
+    const trustedHttpsProxy = proxyAgentForTrustedRequests(new URL("https://localhost:3000"));
+    const untrustedHttpProxy = proxyAgentForUntrustedRequests(new URL("http://localhost:3000"));
+    const untrustedHttpsProxy = proxyAgentForUntrustedRequests(new URL("https://localhost:3000"));
+
+    assert.equal(untrustedHttpProxy, undefined);
+    assert.equal(untrustedHttpsProxy, undefined);
+    assert.instanceOf(trustedHttpProxy, HttpProxyAgent);
+    assert.instanceOf(trustedHttpsProxy, HttpsProxyAgent);
+  });
+
+  it("untrusted should be undefined if direct proxy and trusted should be proxied if configured", async function () {
+    process.env.GRIST_HTTPS_PROXY = "direct";
+    process.env.HTTPS_PROXY = "https://localhost:8080";
+    process.env.https_proxy = "https://localhost:8080";
+    const trustedHttpProxy = proxyAgentForTrustedRequests(new URL("http://localhost:3000"));
+    const trustedHttpsProxy = proxyAgentForTrustedRequests(new URL("https://localhost:3000"));
+    const untrustedHttpProxy = proxyAgentForUntrustedRequests(new URL("http://localhost:3000"));
+    const untrustedHttpsProxy = proxyAgentForUntrustedRequests(new URL("https://localhost:3000"));
+
+    assert.equal(untrustedHttpProxy, undefined);
+    assert.equal(untrustedHttpsProxy, undefined);
+    assert.instanceOf(trustedHttpProxy, HttpProxyAgent);
+    assert.instanceOf(trustedHttpsProxy, HttpsProxyAgent);
+  });
+
+  it("should be https proxy if grist proxy is configured and trusted undefined if no proxy", async function () {
+    process.env.GRIST_HTTPS_PROXY = "https://localhost:9000";
+    delete process.env.HTTPS_PROXY;
+    delete process.env.https_proxy;
+    const trustedHttpsProxy = proxyAgentForTrustedRequests(new URL("https://localhost:3000"));
+    assert.equal(trustedHttpsProxy, undefined);
+    const untrustedHttpsProxy = proxyAgentForUntrustedRequests(new URL("https://localhost:3000"));
+    assert.instanceOf(untrustedHttpsProxy, HttpsProxyAgent);
+  });
+
+  it("should be http proxy if grist proxy is configured and trusted undefined if no proxy", async function () {
+    process.env.GRIST_HTTPS_PROXY = "https://localhost:9000";
+    delete process.env.HTTPS_PROXY;
+    delete process.env.https_proxy;
+    const trustedHttpsProxy = proxyAgentForTrustedRequests(new URL("http://localhost:3000"));
+    assert.equal(trustedHttpsProxy, undefined);
+    const untrustedHttpsProxy = proxyAgentForUntrustedRequests(new URL("http://localhost:3000"));
+    assert.instanceOf(untrustedHttpsProxy, HttpProxyAgent);
+  });
+
+  it("should be https proxy if trusted and untrusted proxy are configured and address is https", async function () {
     process.env.GRIST_HTTPS_PROXY = "https://localhost:9000";
-    const httpsProxy = proxyAgent(new URL("https://localhost:3000"));
-    assert.instanceOf(httpsProxy, HttpsProxyAgent);
+    process.env.HTTPS_PROXY = "https://localhost:8080";
+    process.env.https_proxy = "https://localhost:8080";
+    const trustedHttpsProxy = proxyAgentForTrustedRequests(new URL("https://localhost:3000"));
+    assert.instanceOf(trustedHttpsProxy, HttpsProxyAgent);
+    const untrustedHttpsProxy = proxyAgentForUntrustedRequests(new URL("https://localhost:3000"));
+    assert.instanceOf(untrustedHttpsProxy, HttpsProxyAgent);
   });
 
-  it("should be https proxy if proxy is configured and address is https", async function () {
+  it("should be https proxy if trusted and untrusted proxy are configured and address is http", async function () {
     process.env.GRIST_HTTPS_PROXY = "https://localhost:9000";
-    const httpsProxy = proxyAgent(new URL("http://localhost:3000"));
-    assert.instanceOf(httpsProxy, HttpProxyAgent);
+    process.env.HTTPS_PROXY = "https://localhost:8080";
+    process.env.https_proxy = "https://localhost:8080";
+    const trustedHttpProxy = proxyAgentForTrustedRequests(new URL("http://localhost:3000"));
+    assert.instanceOf(trustedHttpProxy, HttpProxyAgent);
+    const untrustedHttpProxy = proxyAgentForUntrustedRequests(new URL("http://localhost:3000"));
+    assert.instanceOf(untrustedHttpProxy, HttpProxyAgent);
   });
 
   describe('proxy error handling', async function() {
@@ -52,7 +116,7 @@ describe("ProxyAgent", function () {
       return fetch(url, {
         method: 'POST',
         headers: {'Content-Type': 'application/json'},
-        agent: proxyAgent(new URL(url)),
+        agent: proxyAgentForTrustedRequests(new URL(url)),
       });
     }
 
@@ -65,6 +129,8 @@ describe("ProxyAgent", function () {
         app.post('/404', (_, res) => { res.sendStatus(404); res.end(); });
       });
       process.env.GRIST_HTTPS_PROXY = `http://localhost:${port}`;
+      process.env.HTTPS_PROXY = `http://localhost:${port}`;
+      process.env.https_proxy = `http://localhost:${port}`;
     });
 
     afterEach(async function() {

From 1f6344c98ac44274afe53741a78cb0f0dac8395f Mon Sep 17 00:00:00 2001
From: Tristan Robert <Tristan.Robert@developpement-durable.gouv.fr>
Date: Tue, 21 Jan 2025 14:21:25 +0100
Subject: [PATCH 09/13] refactor: :recycle: refactor proxyagent functions

---
 app/server/lib/ProxyAgent.ts | 35 ++++++++++++-----------------------
 1 file changed, 12 insertions(+), 23 deletions(-)

diff --git a/app/server/lib/ProxyAgent.ts b/app/server/lib/ProxyAgent.ts
index 451adec2d7..6c832565f0 100644
--- a/app/server/lib/ProxyAgent.ts
+++ b/app/server/lib/ProxyAgent.ts
@@ -2,13 +2,9 @@ import {HttpsProxyAgent} from "https-proxy-agent";
 import {HttpProxyAgent} from "http-proxy-agent";
 import log from 'app/server/lib/log';
 
-export function proxyAgentForTrustedRequests(requestUrl: URL): HttpProxyAgent | HttpsProxyAgent | undefined {
-  const httpsProxy = process.env.HTTPS_PROXY ? process.env.HTTPS_PROXY : process.env.https_proxy;
-  if (!httpsProxy) {
-    return undefined;
-  }
+function proxyAgent(requestUrl: URL, proxy: string): HttpProxyAgent | HttpsProxyAgent | undefined {
   const ProxyAgent = requestUrl.protocol === "https:" ? HttpsProxyAgent : HttpProxyAgent;
-  const agent = new ProxyAgent(httpsProxy);
+  const agent = new ProxyAgent(proxy);
 
   // Wrap the main method of ProxyAgent into a wrapper that logs errors.
   const callback = agent.callback;
@@ -18,32 +14,25 @@ export function proxyAgentForTrustedRequests(requestUrl: URL): HttpProxyAgent |
     } catch (e) {
       // Include info helpful for diagnosing issues (but not the potentially sensitive full requestUrl).
       log.rawWarn(`ProxyAgent error ${e}`,
-        {proxy: httpsProxy, reqProtocol: requestUrl.protocol, requestOrigin: requestUrl.origin});
+        {proxy, reqProtocol: requestUrl.protocol, requestOrigin: requestUrl.origin});
       throw e;
     }
   };
   return agent;
 }
 
+export function proxyAgentForTrustedRequests(requestUrl: URL): HttpProxyAgent | HttpsProxyAgent | undefined {
+  const httpsProxy = process.env.HTTPS_PROXY ? process.env.HTTPS_PROXY : process.env.https_proxy;
+  if (!httpsProxy) {
+    return undefined;
+  }
+  return proxyAgent(requestUrl, httpsProxy);
+}
+
 export function proxyAgentForUntrustedRequests(requestUrl: URL): HttpProxyAgent | HttpsProxyAgent | undefined {
   const gristProxy = process.env.GRIST_HTTPS_PROXY;
   if (gristProxy === "direct" || !gristProxy) {
     return undefined;
   }
-  const ProxyAgent = requestUrl.protocol === "https:" ? HttpsProxyAgent : HttpProxyAgent;
-  const agent = new ProxyAgent(gristProxy);
-
-  // Wrap the main method of ProxyAgent into a wrapper that logs errors.
-  const callback = agent.callback;
-  agent.callback = async function () {
-    try {
-      return await callback.apply(this, arguments as any);
-    } catch (e) {
-      // Include info helpful for diagnosing issues (but not the potentially sensitive full requestUrl).
-      log.rawWarn(`ProxyAgent error ${e}`,
-        {proxy: gristProxy, reqProtocol: requestUrl.protocol, requestOrigin: requestUrl.origin});
-      throw e;
-    }
-  };
-  return agent;
+  return proxyAgent(requestUrl, gristProxy);
 }

From 31c6727fd12e223d8e97954e904c53bad3036bf5 Mon Sep 17 00:00:00 2001
From: Tristan Robert <tristan.robert.44@gmail.com>
Date: Tue, 21 Jan 2025 14:52:21 +0100
Subject: [PATCH 10/13] Update README.md

Co-authored-by: Florent <florent.git@zeteo.me>
---
 README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/README.md b/README.md
index 4461290b9c..5c9a58e2d0 100644
--- a/README.md
+++ b/README.md
@@ -278,7 +278,7 @@ Grist can be configured in many ways. Here are the main environment variables it
 | GRIST_ENABLE_REQUEST_FUNCTION      | enables the REQUEST function. This function performs HTTP requests in a similar way to `requests.request`. This function presents a significant security risk, since it can let users call internal endpoints when Grist is available publicly. This function can also cause performance issues. Unset by default.                                            |
 | GRIST_HIDE_UI_ELEMENTS             | comma-separated list of UI features to disable. Allowed names of parts: `helpCenter,billing,templates,createSite,multiSite,multiAccounts,sendToDrive,tutorials,supportGrist`. If a part also exists in GRIST_UI_FEATURES, it will still be disabled.                                                                                                          |
 | GRIST_HOST                         | hostname to use when listening on a port.                                                                                                                                                                                                                                                                                                                     |
-| GRIST_HTTPS_PROXY                  | if set with url, use this proxy for webhook payload delivery; if not set or set to direct it call direct webhook payload.                                                                                                                                                                                                                                                                                                          |
+| GRIST_HTTPS_PROXY                  | if set with url, use this proxy for webhook payload delivery; if not set or set to direct it call `"direct"` webhook payload.                                                                                                                                                                                                                                                                                                          |
 | HTTPS_PROXY or https_proxy         | if set, use this reverse web proxy (corporate proxy) for fetching custom widgets repository from url or OIDC config from issuer url outside the grist stack.                                                                                                                                                                                                                                                                                                          |
 | GRIST_ID_PREFIX                    | for subdomains of form o-*, expect or produce o-${GRIST_ID_PREFIX}*.                                                                                                                                                                                                                                                                                          |
 | GRIST_IGNORE_SESSION               | if set, Grist will not use a session for authentication.                                                                                                                                                                                                                                                                                                      |

From 9db57aed7573d85b7a42efeea77dc2d6e845396c Mon Sep 17 00:00:00 2001
From: Tristan Robert <Tristan.Robert@developpement-durable.gouv.fr>
Date: Tue, 21 Jan 2025 16:05:10 +0100
Subject: [PATCH 11/13] test: :recycle: rafactoring proxyagent tests

---
 test/server/lib/ProxyAgent.ts | 103 +++++++++++++---------------------
 1 file changed, 39 insertions(+), 64 deletions(-)

diff --git a/test/server/lib/ProxyAgent.ts b/test/server/lib/ProxyAgent.ts
index a9ec6c4b30..2f23a1a9b3 100644
--- a/test/server/lib/ProxyAgent.ts
+++ b/test/server/lib/ProxyAgent.ts
@@ -8,6 +8,7 @@ import {TestProxyServer} from 'test/server/lib/helpers/TestProxyServer';
 import {serveSomething, Serving} from 'test/server/customUtil';
 import {assertMatchArray, captureLog, EnvironmentSnapshot} from "test/server/testUtils";
 
+type CheckProxyVariables = 'trustedHttpProxy' | 'trustedHttpsProxy' | 'untrustedHttpProxy' | 'untrustedHttpsProxy';
 
 describe("ProxyAgent", function () {
   let oldEnv: EnvironmentSnapshot;
@@ -19,89 +20,63 @@ describe("ProxyAgent", function () {
     oldEnv.restore();
   });
 
+  function checkProxy(env: NodeJS.ProcessEnv, expectedProxies: Array<CheckProxyVariables>) {
+    Object.assign(process.env, {
+      // By default, the proxy env variables are unset
+      GRIST_HTTPS_PROXY: '',
+      HTTPS_PROXY: '',
+      https_proxy: '',
+      // inject the env variables passed in argument
+      ...env
+    });
+
+    // Instanciate the Proxies
+    const proxies: Record<CheckProxyVariables, {
+      ctorIfDefined: Function,
+      proxy: HttpProxyAgent|HttpsProxyAgent|undefined
+    }> = {
+      trustedHttpProxy: { ctorIfDefined: HttpProxyAgent, proxy: proxyAgentForTrustedRequests(new URL("http://localhost:3000")) },
+      trustedHttpsProxy: { ctorIfDefined: HttpsProxyAgent, proxy: proxyAgentForTrustedRequests(new URL("https://localhost:3000")) },
+      untrustedHttpProxy: { ctorIfDefined: HttpProxyAgent, proxy: proxyAgentForUntrustedRequests(new URL("http://localhost:3000")) },
+      untrustedHttpsProxy: { ctorIfDefined: HttpsProxyAgent, proxy: proxyAgentForUntrustedRequests(new URL("https://localhost:3000")) }
+    };
+
+    // Test whether the proxies are defined and compare with what is expected
+    for (const [varName, { ctorIfDefined, proxy }] of Object.entries(proxies)) {
+      if (expectedProxies.includes(varName as CheckProxyVariables)) {
+        assert.instanceOf(proxy, ctorIfDefined, `${varName} is not an instance of ${ctorIfDefined.name}`);
+      } else {
+        assert.isUndefined(proxy, `${varName} is defined and it should not be`);
+      }
+    }
+  }
+
   it("trusted and untrusted should be undefined if not configured", async function () {
-    delete process.env.HTTPS_PROXY;
-    delete process.env.https_proxy;
-    delete process.env.GRIST_HTTPS_PROXY;
-    const trustedHttpProxy = proxyAgentForTrustedRequests(new URL("http://localhost:3000"));
-    const trustedHttpsProxy = proxyAgentForTrustedRequests(new URL("https://localhost:3000"));
-    const untrustedHttpProxy = proxyAgentForUntrustedRequests(new URL("http://localhost:3000"));
-    const untrustedHttpsProxy = proxyAgentForUntrustedRequests(new URL("https://localhost:3000"));
-
-    assert.equal(trustedHttpProxy, undefined);
-    assert.equal(trustedHttpsProxy, undefined);
-    assert.equal(untrustedHttpProxy, undefined);
-    assert.equal(untrustedHttpsProxy, undefined);
+    checkProxy({}, []);
   });
 
   it("untrusted should be undefined if no proxy and trusted should be proxied if configured", async function () {
-    delete process.env.GRIST_HTTPS_PROXY;
-    process.env.HTTPS_PROXY = "https://localhost:8080";
-    process.env.https_proxy = "https://localhost:8080";
-    const trustedHttpProxy = proxyAgentForTrustedRequests(new URL("http://localhost:3000"));
-    const trustedHttpsProxy = proxyAgentForTrustedRequests(new URL("https://localhost:3000"));
-    const untrustedHttpProxy = proxyAgentForUntrustedRequests(new URL("http://localhost:3000"));
-    const untrustedHttpsProxy = proxyAgentForUntrustedRequests(new URL("https://localhost:3000"));
-
-    assert.equal(untrustedHttpProxy, undefined);
-    assert.equal(untrustedHttpsProxy, undefined);
-    assert.instanceOf(trustedHttpProxy, HttpProxyAgent);
-    assert.instanceOf(trustedHttpsProxy, HttpsProxyAgent);
+    checkProxy({HTTPS_PROXY: "https://localhost:8080", https_proxy: "https://localhost:8080"}, ['trustedHttpsProxy', 'trustedHttpProxy']);
   });
 
   it("untrusted should be undefined if direct proxy and trusted should be proxied if configured", async function () {
-    process.env.GRIST_HTTPS_PROXY = "direct";
-    process.env.HTTPS_PROXY = "https://localhost:8080";
-    process.env.https_proxy = "https://localhost:8080";
-    const trustedHttpProxy = proxyAgentForTrustedRequests(new URL("http://localhost:3000"));
-    const trustedHttpsProxy = proxyAgentForTrustedRequests(new URL("https://localhost:3000"));
-    const untrustedHttpProxy = proxyAgentForUntrustedRequests(new URL("http://localhost:3000"));
-    const untrustedHttpsProxy = proxyAgentForUntrustedRequests(new URL("https://localhost:3000"));
-
-    assert.equal(untrustedHttpProxy, undefined);
-    assert.equal(untrustedHttpsProxy, undefined);
-    assert.instanceOf(trustedHttpProxy, HttpProxyAgent);
-    assert.instanceOf(trustedHttpsProxy, HttpsProxyAgent);
+    checkProxy({GRIST_HTTPS_PROXY: "direct", HTTPS_PROXY: "https://localhost:8080", https_proxy: "https://localhost:8080"}, ['trustedHttpsProxy', 'trustedHttpProxy']);
   });
 
   it("should be https proxy if grist proxy is configured and trusted undefined if no proxy", async function () {
-    process.env.GRIST_HTTPS_PROXY = "https://localhost:9000";
-    delete process.env.HTTPS_PROXY;
-    delete process.env.https_proxy;
-    const trustedHttpsProxy = proxyAgentForTrustedRequests(new URL("https://localhost:3000"));
-    assert.equal(trustedHttpsProxy, undefined);
-    const untrustedHttpsProxy = proxyAgentForUntrustedRequests(new URL("https://localhost:3000"));
-    assert.instanceOf(untrustedHttpsProxy, HttpsProxyAgent);
+    checkProxy({GRIST_HTTPS_PROXY: "https://localhost:9000"}, ['untrustedHttpsProxy']);
   });
 
   it("should be http proxy if grist proxy is configured and trusted undefined if no proxy", async function () {
-    process.env.GRIST_HTTPS_PROXY = "https://localhost:9000";
-    delete process.env.HTTPS_PROXY;
-    delete process.env.https_proxy;
-    const trustedHttpsProxy = proxyAgentForTrustedRequests(new URL("http://localhost:3000"));
-    assert.equal(trustedHttpsProxy, undefined);
-    const untrustedHttpsProxy = proxyAgentForUntrustedRequests(new URL("http://localhost:3000"));
-    assert.instanceOf(untrustedHttpsProxy, HttpProxyAgent);
+    checkProxy({GRIST_HTTPS_PROXY: "https://localhost:9000"}, ['untrustedHttpProxy']);
   });
 
   it("should be https proxy if trusted and untrusted proxy are configured and address is https", async function () {
-    process.env.GRIST_HTTPS_PROXY = "https://localhost:9000";
-    process.env.HTTPS_PROXY = "https://localhost:8080";
-    process.env.https_proxy = "https://localhost:8080";
-    const trustedHttpsProxy = proxyAgentForTrustedRequests(new URL("https://localhost:3000"));
-    assert.instanceOf(trustedHttpsProxy, HttpsProxyAgent);
-    const untrustedHttpsProxy = proxyAgentForUntrustedRequests(new URL("https://localhost:3000"));
-    assert.instanceOf(untrustedHttpsProxy, HttpsProxyAgent);
+    checkProxy({GRIST_HTTPS_PROXY: "https://localhost:9000", HTTPS_PROXY: "https://localhost:8080", https_proxy: "https://localhost:8080"}, ['trustedHttpsProxy', 'untrustedHttpsProxy']);
   });
 
   it("should be https proxy if trusted and untrusted proxy are configured and address is http", async function () {
-    process.env.GRIST_HTTPS_PROXY = "https://localhost:9000";
-    process.env.HTTPS_PROXY = "https://localhost:8080";
-    process.env.https_proxy = "https://localhost:8080";
-    const trustedHttpProxy = proxyAgentForTrustedRequests(new URL("http://localhost:3000"));
-    assert.instanceOf(trustedHttpProxy, HttpProxyAgent);
-    const untrustedHttpProxy = proxyAgentForUntrustedRequests(new URL("http://localhost:3000"));
-    assert.instanceOf(untrustedHttpProxy, HttpProxyAgent);
+    checkProxy({GRIST_HTTPS_PROXY: "https://localhost:9000", HTTPS_PROXY: "https://localhost:8080", https_proxy: "https://localhost:8080"}, ['trustedHttpProxy', 'untrustedHttpProxy']);
   });
 
   describe('proxy error handling', async function() {

From feeecd1c949cc363abd38ef264ceb49215126ecc Mon Sep 17 00:00:00 2001
From: Tristan Robert <tristan.robert.44@gmail.com>
Date: Wed, 22 Jan 2025 09:20:11 +0100
Subject: [PATCH 12/13] test: :white_check_mark: fixes proxyagent tests

---
 test/server/lib/ProxyAgent.ts | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/test/server/lib/ProxyAgent.ts b/test/server/lib/ProxyAgent.ts
index 2f23a1a9b3..3374aed44d 100644
--- a/test/server/lib/ProxyAgent.ts
+++ b/test/server/lib/ProxyAgent.ts
@@ -64,19 +64,19 @@ describe("ProxyAgent", function () {
   });
 
   it("should be https proxy if grist proxy is configured and trusted undefined if no proxy", async function () {
-    checkProxy({GRIST_HTTPS_PROXY: "https://localhost:9000"}, ['untrustedHttpsProxy']);
+    checkProxy({GRIST_HTTPS_PROXY: "https://localhost:9000"}, ['untrustedHttpsProxy', 'untrustedHttpProxy']);
   });
 
   it("should be http proxy if grist proxy is configured and trusted undefined if no proxy", async function () {
-    checkProxy({GRIST_HTTPS_PROXY: "https://localhost:9000"}, ['untrustedHttpProxy']);
+    checkProxy({GRIST_HTTPS_PROXY: "https://localhost:9000"}, ['untrustedHttpsProxy', 'untrustedHttpProxy']);
   });
 
   it("should be https proxy if trusted and untrusted proxy are configured and address is https", async function () {
-    checkProxy({GRIST_HTTPS_PROXY: "https://localhost:9000", HTTPS_PROXY: "https://localhost:8080", https_proxy: "https://localhost:8080"}, ['trustedHttpsProxy', 'untrustedHttpsProxy']);
+    checkProxy({GRIST_HTTPS_PROXY: "https://localhost:9000", HTTPS_PROXY: "https://localhost:8080", https_proxy: "https://localhost:8080"}, ['trustedHttpsProxy', 'trustedHttpProxy', 'untrustedHttpsProxy', 'untrustedHttpProxy']);
   });
 
   it("should be https proxy if trusted and untrusted proxy are configured and address is http", async function () {
-    checkProxy({GRIST_HTTPS_PROXY: "https://localhost:9000", HTTPS_PROXY: "https://localhost:8080", https_proxy: "https://localhost:8080"}, ['trustedHttpProxy', 'untrustedHttpProxy']);
+    checkProxy({GRIST_HTTPS_PROXY: "https://localhost:9000", HTTPS_PROXY: "https://localhost:8080", https_proxy: "https://localhost:8080"}, ['trustedHttpProxy', 'trustedHttpsProxy', 'untrustedHttpProxy', 'untrustedHttpsProxy']);
   });
 
   describe('proxy error handling', async function() {

From 1c4dcfdb30b62c61e368ab268faf63eb5f85a293 Mon Sep 17 00:00:00 2001
From: Tristan Robert <tristan.robert.44@gmail.com>
Date: Tue, 28 Jan 2025 09:02:38 +0100
Subject: [PATCH 13/13] Update app/server/lib/ProxyAgent.ts

Co-authored-by: Florent <florent.git@zeteo.me>
---
 app/server/lib/ProxyAgent.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app/server/lib/ProxyAgent.ts b/app/server/lib/ProxyAgent.ts
index 6c832565f0..037540b3d3 100644
--- a/app/server/lib/ProxyAgent.ts
+++ b/app/server/lib/ProxyAgent.ts
@@ -22,7 +22,7 @@ function proxyAgent(requestUrl: URL, proxy: string): HttpProxyAgent | HttpsProxy
 }
 
 export function proxyAgentForTrustedRequests(requestUrl: URL): HttpProxyAgent | HttpsProxyAgent | undefined {
-  const httpsProxy = process.env.HTTPS_PROXY ? process.env.HTTPS_PROXY : process.env.https_proxy;
+  const httpsProxy = process.env.HTTPS_PROXY || process.env.https_proxy;
   if (!httpsProxy) {
     return undefined;
   }