fix: clean request path before acls

[steveiliop56]

Summary by CodeRabbit

• Security

  • Improved path validation and normalization to prevent authentication bypasses using malformed paths, query parameters, encoded characters, or dot-segment variations.
  • Strengthened path-based allow and block rules across supported proxy integrations.

• Documentation

  • Clarified that path rules use regular expressions to enable or disable authentication for matching paths.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: fb4609f3-d4a0-41fe-b9c9-a51079fdda04

📥 Commits

Reviewing files that changed from the base of the PR and between cbd92a1 and 1f1b0f6.

📒 Files selected for processing (5)

• .env.example
• internal/controller/proxy_controller.go
• internal/controller/proxy_controller_test.go
• internal/model/config.go
• internal/test/test.go

---

📝 Walkthrough

Walkthrough

Path-based authentication configuration is documented as regex-driven. Proxy request paths are parsed, validated, and normalized before authorization decisions, with tests covering bypass attempts across Traefik, Nginx, and Envoy integrations.

Changes

Path ACL enforcement

Layer / File(s)	Summary
Regex-based path ACL configuration internal/model/config.go, internal/test/test.go, .env.example	Path allow and block descriptions now specify regex-based authentication behavior, and the allow test configuration uses the anchored ^/allowed$ pattern.
Request path sanitization and ACL validation internal/controller/proxy_controller.go, internal/controller/proxy_controller_test.go	getProxyContext rejects invalid or host-containing paths and normalizes valid paths before ACL processing; tests cover query, slash, dot-segment, encoding, and forwarded-URI bypass cases across Traefik, Nginx, and Envoy.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

• tinyauthapp/tinyauth#714: Both modify proxy context path handling in getProxyContext.
• tinyauthapp/tinyauth#1044: Both update forward-auth path handling and path ACL bypass tests.

Suggested reviewers: copilot, rycochet

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: sanitizing request paths before ACL checks.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/query-params-forward-auth

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

❌ Patch coverage is 26.66667% with 11 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
internal/test/test.go	0.00%	9 Missing ⚠️
internal/controller/proxy_controller.go	66.66%	1 Missing and 1 partial ⚠️

📢 Thoughts on this report? Let us know!

[Copilot]

Pull request overview

This PR aims to prevent path-based ACL bypasses by normalizing/cleaning the incoming request path (e.g., removing query parameters and dot segments) before ACL regex evaluation, and by updating related docs and tests.

Changes:

• Normalize ProxyContext.Path before ACL evaluation in getProxyContext.
• Update AppPath documentation/env comments to describe regex-based allow/block semantics.
• Expand proxy controller tests to cover query params, trailing slashes, dot segments, and encoding-related bypass attempts; update test configs accordingly.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
internal/controller/proxy_controller.go	Adds request-path normalization prior to ACL evaluation.
internal/controller/proxy_controller_test.go	Adds tests covering path allow/block behavior and bypass vectors.
internal/test/test.go	Updates/extends test app configs for regex-based allow/block path ACLs.
internal/model/config.go	Updates AppPath field descriptions to reflect regex semantics.
.env.example	Updates env var comments to reflect regex semantics for path ACLs.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.