master..9a14186 · typeable/oauth2-proxy

git.iko.soy/typeable/oauth2-proxy

53 files changed+389−1240

unifiedsplit

.devcontainer/Dockerfile+1−1

@@ -1,4 +1,4 @@

1−FROM mcr.microsoft.com/vscode/devcontainers/go:1-1.26

1+FROM mcr.microsoft.com/vscode/devcontainers/go:1-1.25

33SHELL ["/bin/bash", "-o", "pipefail", "-c"]

.github/ISSUE_TEMPLATE/config.yml+2−2

@@ -1,6 +1,6 @@

11blank_issues_enabled: false

22contact_links:

3− - name: OAuth2 Proxy Slack

4− url: https://cloud-native.slack.com/archives/C098Y5URZ2N

3+ - name: OAuth2-Proxy Slack

4+ url: https://gophers.slack.com/messages/CM2RSS25N

55 about: Feel free to ask any questions here.

.github/renovate.json5−9

@@ -46,15 +46,6 @@

4646 depNameTemplate: "alpine",

4747 datasourceTemplate: "docker",

4848 },

49− {

50− customType: "regex",

51− fileMatch: [

52− "^Makefile",

53− ],

54− matchStrings: [

55− "# renovate: datasource=(?<datasource>.*?) depName=(?<depName>.*?)\\s+?GOLANGCILINT_VERSION \\?= (?<currentValue>.*)\\s",

56− ],

57− },

5849 {

5950 customType: "regex",

6051 fileMatch: ["(^|/)\\.github/workflows/[^/]+\\.ya?ml$"],

.github/workflows/ci.yml+14−8

@@ -19,7 +19,7 @@ jobs:

1919 runs-on: ubuntu-latest

2020 steps:

2121 - name: Check out code

22− uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

22+ uses: actions/checkout@v6

2323 with:

2424 fetch-depth: 0

2525

@@ -30,11 +30,17 @@ jobs:

3030 id: go-version

3131

3232 - name: Set up Go

33− uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0

33+ uses: actions/setup-go@v6

3434 with:

3535 go-version: ${{ steps.go-version.outputs.version }}

3636 check-latest: true

3737

38+ - name: Install golangci-lint

39+ uses: golangci/golangci-lint-action@v9

40+ with:

41+ install-only: true

42+ version: v2.11.4 # renovate: datasource=github-tags depName=golangci/golangci-lint

43+

3844 - name: Verify Code Generation

3945 run: |

4046 make verify-generate

@@ -68,14 +74,14 @@ jobs:

6874

6975 - name: Upload Coverage Report

7076 if: github.event_name == 'push'

71− uses: qltysh/qlty-action/coverage@08a0a862c159eae9b9003081da6663d96efef637 # v2.3.0

77+ uses: qltysh/qlty-action/coverage@v2

7278 with:

7379 oidc: true

7480 files: lcov.info

7581

7682 - name: Run Trivy vulnerability scanner

7783 if: (!startsWith(github.head_ref, 'release'))

78− uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0

84+ uses: aquasecurity/trivy-action@0.35.0

7985 with:

8086 scan-type: 'rootfs'

8187 scan-ref: './oauth2-proxy'

@@ -87,7 +93,7 @@ jobs:

8793

8894 - name: Upload Trivy scan results

8995 if: (!startsWith(github.head_ref, 'release'))

90− uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7

96+ uses: github/codeql-action/upload-sarif@v4

9197 with:

9298 sarif_file: 'trivy-results.sarif'

9399

@@ -95,16 +101,16 @@ jobs:

95101 runs-on: ubuntu-latest

96102 steps:

97103 - name: Check out code

98− uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

104+ uses: actions/checkout@v6

99105 with:

100106 fetch-depth: 0

101107

102108 - name: Set up QEMU

103− uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0

109+ uses: docker/setup-qemu-action@v3

104110

105111 - name: Set up Docker Buildx

106112 id: buildx

107− uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0

113+ uses: docker/setup-buildx-action@v3

108114

109115 - name: Docker Build

110116 if: (!startsWith(github.head_ref, 'release'))

.github/workflows/codeql.yml+4−4

@@ -32,18 +32,18 @@ jobs:

3232

3333 steps:

3434 - name: Checkout repository

35− uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

35+ uses: actions/checkout@v6

3636

3737 # Initializes the CodeQL tools for scanning.

3838 - name: Initialize CodeQL

39− uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7

39+ uses: github/codeql-action/init@v3

4040 with:

4141 languages: go

4242

4343 # Autobuild attempts to build any compiled languages (C/C++, C#, or Java).

4444 # If this step fails, then you should remove it and run the build manually (see below)

4545 - name: Autobuild

46− uses: github/codeql-action/autobuild@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7

46+ uses: github/codeql-action/autobuild@v3

4747

4848 # ℹ️ Command-line programs to run using the OS shell.

4949 # 📚 https://git.io/JvXDl

@@ -57,4 +57,4 @@ jobs:

5757 # make release

5858

5959 - name: Perform CodeQL Analysis

60− uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7

60+ uses: github/codeql-action/analyze@v3

.github/workflows/create-release.yml+2−2

@@ -17,7 +17,7 @@ jobs:

1717 runs-on: ubuntu-latest

1818 steps:

1919 - name: Check out code

20− uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

20+ uses: actions/checkout@v6

2121 with:

2222 ref: master

2323 fetch-depth: 0

@@ -54,7 +54,7 @@ jobs:

5454 git config --local user.email "41898282+github-actions[bot]@users.noreply.github.com"

5555

5656 - name: Setup node

57− uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0

57+ uses: actions/setup-node@v6

5858 with:

5959 node-version-file: docs/package.json

6060

.github/workflows/docs.yml+7−7

@@ -14,13 +14,13 @@ jobs:

1414 if: github.event_name == 'pull_request'

1515 runs-on: ubuntu-latest

1616 steps:

17− - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

17+ - uses: actions/checkout@v6

1818

1919 - name: Setup Pages

2020 id: pages

21− uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0

21+ uses: actions/configure-pages@v5

2222

23− - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0

23+ - uses: actions/setup-node@v6

2424 with:

2525 # renovate: datasource=node-version depName=node

2626 node-version: 24

@@ -35,9 +35,9 @@ jobs:

3535 if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'

3636 runs-on: ubuntu-latest

3737 steps:

38− - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

38+ - uses: actions/checkout@v6

3939

40− - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0

40+ - uses: actions/setup-node@v6

4141 with:

4242 # renovate: datasource=node-version depName=node

4343 node-version: 24

@@ -49,7 +49,7 @@ jobs:

4949 npm run build

5050

5151 - name: Upload artifact

52− uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0

52+ uses: actions/upload-pages-artifact@v3

5353 with:

5454 path: ./docs/build

5555

@@ -65,4 +65,4 @@ jobs:

6565 steps:

6666 - name: Deploy to GitHub Pages

6767 id: deployment

68− uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0

68+ uses: actions/deploy-pages@v4

.github/workflows/labeler.yml+1−1

@@ -9,7 +9,7 @@ jobs:

99 pull-requests: write

1010 runs-on: ubuntu-latest

1111 steps:

12− - uses: actions/labeler@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13 # v7.0.0

12+ - uses: actions/labeler@v6

1313 with:

1414 sync-labels: true

1515 dot: true

.github/workflows/nightly.yml+4−4

@@ -12,21 +12,21 @@ jobs:

1212 if: github.repository == 'oauth2-proxy/oauth2-proxy'

1313 steps:

1414 - name: Check out code

15− uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

15+ uses: actions/checkout@v6

1616 with:

1717 ref: master

1818 fetch-depth: 0

1919 fetch-tags: true

2020

2121 - name: Set up QEMU

22− uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0

22+ uses: docker/setup-qemu-action@v3

2323

2424 - name: Set up Docker Buildx

2525 id: buildx

26− uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0

26+ uses: docker/setup-buildx-action@v3

2727

2828 - name: Login to quay.io

29− uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0

29+ uses: docker/login-action@v3

3030 with:

3131 registry: quay.io/oauth2-proxy

3232 username: ${{ secrets.REGISTRY_USERNAME_NIGHTLY }}

.github/workflows/publish-release.yml+13−7

@@ -20,7 +20,7 @@ jobs:

2020 tag: ${{ steps.tag.outputs.version }}

2121 steps:

2222 - name: Check out code

23− uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

23+ uses: actions/checkout@v6

2424 with:

2525 ref: ${{ github.event.pull_request.merge_commit_sha }}

2626 fetch-depth: 0

@@ -50,11 +50,17 @@ jobs:

5050 id: go-version

5151

5252 - name: Set up Go

53− uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0

53+ uses: actions/setup-go@v6

5454 with:

5555 go-version: ${{ steps.go-version.outputs.version }}

5656 check-latest: true

5757

58+ - name: Install golangci-lint

59+ uses: golangci/golangci-lint-action@v9

60+ with:

61+ install-only: true

62+ version: v2.11.4 # renovate: datasource=github-tags depName=golangci/golangci-lint

63+

5864 - name: Get go dependencies

5965 run: |

6066 go mod download

@@ -64,7 +70,7 @@ jobs:

6470

6571 # Upload artifacts in case of workflow failure

6672 - name: Upload Artifacts

67− uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1

73+ uses: actions/upload-artifact@v7

6874 with:

6975 name: oauth2-proxy-artifacts

7076 path: |

@@ -100,21 +106,21 @@ jobs:

100106 runs-on: ubuntu-latest

101107 steps:

102108 - name: Check out code

103− uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

109+ uses: actions/checkout@v6

104110 with:

105111 ref: ${{ needs.publish.outputs.tag }}

106112 fetch-depth: 0

107113 fetch-tags: true

108114

109115 - name: Set up QEMU

110− uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0

116+ uses: docker/setup-qemu-action@v3

111117

112118 - name: Set up Docker Buildx

113119 id: buildx

114− uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0

120+ uses: docker/setup-buildx-action@v3

115121

116122 - name: Login to quay.io

117− uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0

123+ uses: docker/login-action@v3

118124 with:

119125 registry: quay.io/oauth2-proxy

120126 username: ${{ secrets.REGISTRY_USERNAME }}

.github/workflows/stale.yml+1−1

@@ -10,7 +10,7 @@ jobs:

1010 runs-on: ubuntu-latest

1111

1212 steps:

13− - uses: actions/stale@4391f3da665fdf50b6810c1a66712fb9ba21aa93 # v11.0.0

13+ - uses: actions/stale@v10

1414 with:

1515 repo-token: ${{ secrets.GITHUB_TOKEN }}

1616 days-before-stale: 180

CHANGELOG.md−54

@@ -6,62 +6,8 @@

77## Breaking Changes

9−## Changes since v7.15.4

10−

11−# V7.15.4

12−

13−## Release Highlights

14−

15−- 🔵 Golang version upgrade to v1.26.7

16− - Upgrade of all dependencies to their latest versions

17−- 🕵️‍♀️ Vulnerabilities have been addressed

18− - [CVE-2026-33818](https://nvd.nist.gov/vuln/detail/CVE-2026-33818)

19− - [CVE-2026-39821](https://nvd.nist.gov/vuln/detail/CVE-2026-39821)

20− - [CVE-2026-39822](https://nvd.nist.gov/vuln/detail/CVE-2026-39822)

21− - [CVE-2026-42505](https://nvd.nist.gov/vuln/detail/CVE-2026-42505)

22− - [CVE-2026-46600](https://nvd.nist.gov/vuln/detail/CVE-2026-46600)

23− - [CVE-2026-56852](https://nvd.nist.gov/vuln/detail/CVE-2026-56852)

24− - [CVE-2026-56853](https://nvd.nist.gov/vuln/detail/CVE-2026-56853)

25− - [CVE-2026-56858](https://nvd.nist.gov/vuln/detail/CVE-2026-56858)

26− - [CVE-2026-56859](https://nvd.nist.gov/vuln/detail/CVE-2026-56859)

27− - [CVE-2026-56860](https://nvd.nist.gov/vuln/detail/CVE-2026-56860)

28− - [CVE-2026-56862](https://nvd.nist.gov/vuln/detail/CVE-2026-56862)

29−

30−## Important Notes

31−

32−## Breaking Changes

33−

34−## Changes since v7.15.3

35−

36−- [#3493](https://github.com/oauth2-proxy/oauth2-proxy/pull/3493) chore(deps): update gomod @tuunit

37−

38−# V7.15.3

39−

40−## Release Highlights

41−

42−- 🔵 Golang version upgrade to v1.26.4

43− - Upgrade of all dependencies to their latest versions

44−- 🕵️‍♀️ Vulnerabilities have ben addressed

45− - [CVE-2026-33811](https://nvd.nist.gov/vuln/detail/)

46− - [CVE-2026-33814](https://nvd.nist.gov/vuln/detail/)

47− - [CVE-2026-39820](https://nvd.nist.gov/vuln/detail/)

48− - [CVE-2026-39836](https://nvd.nist.gov/vuln/detail/)

49− - [CVE-2026-42499](https://nvd.nist.gov/vuln/detail/)

50− - [CVE-2026-42504](https://nvd.nist.gov/vuln/detail/)

51− - [CVE-2026-39823](https://nvd.nist.gov/vuln/detail/)

52− - [CVE-2026-39826](https://nvd.nist.gov/vuln/detail/)

53− - [CVE-2026-39825](https://nvd.nist.gov/vuln/detail/)

54− - [CVE-2026-27145](https://nvd.nist.gov/vuln/detail/)

55− - [CVE-2026-42507](https://nvd.nist.gov/vuln/detail/)

56−

57−## Important Notes

58−

59−## Breaking Changes

60−

619## Changes since v7.15.2

6210

63−- [#3477](https://github.com/oauth2-proxy/oauth2-proxy/pull/3477) chore(dep): bump go to 1.26 and migrate of reverse proxy handling

64−

6511# V7.15.2

6612

6713## Release Highlights

Makefile+4−9

@@ -25,8 +25,7 @@ help: ## Display this help

2525

2626

2727GO ?= go

28−# renovate: datasource=github-tags depName=golangci/golangci-lint

29−GOLANGCILINT_VERSION ?= v2.11.4

28+GOLANGCILINT ?= golangci-lint

3029

3130BINARY := oauth2-proxy

3231VERSION ?= $(shell git describe --always --dirty --tags 2>/dev/null || echo "undefined")

@@ -67,7 +66,7 @@ DOCKER_BUILDX_PUSH := $(DOCKER_BUILDX) --push

6766DOCKER_BUILDX_PUSH_X_PLATFORM := $(DOCKER_BUILDX_PUSH) --platform ${DOCKER_BUILD_PLATFORM}

6867

6968DOCKER_BUILD_PLATFORM_ALPINE ?= linux/amd64,linux/arm64,linux/ppc64le,linux/arm/v6,linux/arm/v7,linux/s390x

70−DOCKER_BUILD_RUNTIME_IMAGE_ALPINE ?= alpine:3.24.1

69+DOCKER_BUILD_RUNTIME_IMAGE_ALPINE ?= alpine:3.23.3

7170DOCKER_BUILDX_ARGS_ALPINE ?= --build-arg RUNTIME_IMAGE=${DOCKER_BUILD_RUNTIME_IMAGE_ALPINE} ${DOCKER_BUILDX_COMMON_ARGS}

7271DOCKER_BUILDX_X_PLATFORM_ALPINE := docker buildx build ${DOCKER_BUILDX_ARGS_ALPINE} --platform ${DOCKER_BUILD_PLATFORM_ALPINE}

7372DOCKER_BUILDX_PUSH_X_PLATFORM_ALPINE := $(DOCKER_BUILDX_X_PLATFORM_ALPINE) --push

@@ -144,7 +143,7 @@ verify-generate: generate ## Verify command to check if alpha config docs are in

144143##@ Miscellaneous

145144

146145.PHONY: test

147−test: ## Run all Go tests

146+test: lint ## Run all Go tests

148147 GO111MODULE=on $(GO) test $(TESTCOVER) -v -race ./...

149148

150149.PHONY: release

@@ -158,11 +157,7 @@ clean: ## Cleanup release and build files

158157

159158.PHONY: lint

160159lint: validate-go-version ## Lint all files using golangci-lint

161− GO111MODULE=on $(GO) run github.com/golangci/golangci-lint/v2/cmd/golangci-lint@$(GOLANGCILINT_VERSION) run --timeout 10m

162−

163−.PHONY: lint-fix

164−lint-fix: validate-go-version ## Lint all files and apply fixes using golangci-lint

165− GO111MODULE=on $(GO) run github.com/golangci/golangci-lint/v2/cmd/golangci-lint@$(GOLANGCILINT_VERSION) run --timeout 10m --fix

160+ GO111MODULE=on $(GOLANGCILINT) run

166161

167162.PHONY: validate-go-version

168163validate-go-version: ## Validate Go environment requirements

README.md+4−4

@@ -12,7 +12,7 @@

1212

1313OAuth2 Proxy is a flexible, open-source tool that can act as either a standalone reverse proxy or a middleware component integrated into existing reverse proxy or load balancer setups. It provides a simple and secure way to protect your web applications with OAuth2 / OIDC authentication. As a reverse proxy, it intercepts requests to your application and redirects users to an OAuth2 provider for authentication. As a middleware, it can be seamlessly integrated into your existing infrastructure to handle authentication for multiple applications.

1414

15−OAuth2 Proxy supports a lot of OAuth2 as well as OIDC providers. Either through a generic OIDC client or a specific implementation for Google, Microsoft Entra ID, GitHub, login.gov and others. Through specialised provider implementations OAuth2 Proxy can extract more details about the user like preferred usernames and groups. Those details can then be forwarded as HTTP headers to your upstream applications.

15+OAuth2 Proxy supports a lot of OAuth2 as well as OIDC providers. Either through a generic OIDC client or a specific implementation for Google, Microsoft Entra ID, GitHub, login.gov and others. Through specialised provider implementations oauth2-proxy can extract more details about the user like preferred usernames and groups. Those details can then be forwarded as HTTP headers to your upstream applications.

1616

1717![Simplified Architecture](docs/static/img/simplified-architecture.svg)

1818

@@ -23,7 +23,7 @@ OAuth2 Proxy's [Installation Docs](https://oauth2-proxy.github.io/oauth2-proxy/i

2323## Releases

2424

2525### Binaries

26−We publish OAuth2 Proxy as compiled binaries on GitHub for all major architectures as well as more exotic ones like `ppc64le` as well as `s390x`.

26+We publish oauth2-proxy as compiled binaries on GitHub for all major architectures as well as more exotic ones like `ppc64le` as well as `s390x`.

2727

2828Check out the [latest release](https://github.com/oauth2-proxy/oauth2-proxy/releases/latest).

2929

@@ -49,9 +49,9 @@ SAP Open Source Program

4949Microsoft Azure credits for open source projects

5050

5151## Getting Involved

52−[![Slack](https://img.shields.io/badge/slack-CNCF_%23oauth2--proxy-blue?logo=slack)](https://cloud-native.slack.com/archives/C098Y5URZ2N)

52+[![Slack](https://img.shields.io/badge/slack-Gopher_%23oauth2--proxy-red?logo=slack)](https://gophers.slack.com/archives/CM2RSS25N)

5353

54−Join the #oauth2-proxy [Slack channel](https://cloud-native.slack.com/archives/C098Y5URZ2N) to chat with other users of OAuth2 Proxy or reach out to the maintainers directly. Use the [public invite link](https://slack.cncf.io/) to get an invite for the CNCF space.

54+Join the #oauth2-proxy [Slack channel](https://gophers.slack.com/archives/CM2RSS25N) to chat with other users of oauth2-proxy or reach out to the maintainers directly. Use the [public invite link](https://invite.slack.golangbridge.org/) to get an invite for the Gopher Slack space.

5555

5656OAuth2 Proxy is a community-driven project. We rely on the contribut️ions of our users to continually improve it. While review times can vary, we appreciate your patience and understanding. As a volunteer-driven project, we strive to keep this project stable and might take longer to merge changes.

5757

contrib/local-environment/Makefile+2−2

@@ -49,8 +49,8 @@ kubernetes-down:

4949

5050.PHONY: traefik-up

5151traefik-up:

52− docker compose -f docker-compose-traefik.yaml up -d

52+ docker compose -f docker-compose.yaml -f docker-compose-traefik.yaml up -d

5353

5454.PHONY: traefik-%

5555traefik-%:

56− docker compose -f docker-compose-traefik.yaml $*

56+ docker compose -f docker-compose.yaml -f docker-compose-traefik.yaml $*

contrib/local-environment/dex-traefik.yamldeleted−25

@@ -1,25 +0,0 @@

1−# This configuration is intended to be used with the Traefik local environment.

2−# Dex uses in-memory storage because this environment is disposable.

3−issuer: http://dex.localtest.me/dex

4−storage:

5− type: memory

6−web:

7− http: 0.0.0.0:5556

8−oauth2:

9− skipApprovalScreen: true

10−expiry:

11− signingKeys: "4h"

12− idTokens: "1h"

13−staticClients:

14− - id: oauth2-proxy

15− redirectURIs:

16− - "http://oauth2-proxy.localtest.me/oauth2/callback"

17− name: "OAuth2 Proxy"

18− secret: b2F1dGgyLXByb3h5LWNsaWVudC1zZWNyZXQK

19−enablePasswordDB: true

20−staticPasswords:

21− - email: "admin@example.com"

22− # bcrypt hash of the string "password"

23− hash: "$2a$10$2b2cU8CPhOTaGrs1HRQuAueS7JTT5ZHsHSzYiFPm1leZck7Mc8T4W"

24− username: "admin"

25− userID: "08a8684b-db88-4b73-90a9-3cd1661f5466"

contrib/local-environment/dex.yaml+6−1

@@ -3,7 +3,11 @@

33# This should configure Dex to run on port 5556 and provides a static login

44issuer: http://dex.localtest.me:5556/dex

55storage:

6− type: memory

6+ type: etcd

7+ config:

8+ endpoints:

9+ - http://etcd:2379

10+ namespace: dex/

711web:

812 http: 0.0.0.0:5556

913oauth2:

@@ -17,6 +21,7 @@ staticClients:

1721 # These redirect URIs point to the `--redirect-url` for OAuth2 proxy.

1822 - "http://oauth2-proxy.localtest.me:4180/oauth2/callback" # For basic proxy example.

1923 - "http://oauth2-proxy.localtest.me:8080/oauth2/callback" # For nginx example.

24+ - "http://oauth2-proxy.oauth2-proxy.localhost/oauth2/callback" # For traefik example.

2025 name: "OAuth2 Proxy"

2126 secret: b2F1dGgyLXByb3h5LWNsaWVudC1zZWNyZXQK

2227enablePasswordDB: true

contrib/local-environment/docker-compose-alpha-config.yaml+15−2

@@ -1,7 +1,7 @@

11# This docker-compose file can be used to bring up an example instance of oauth2-proxy

22# for manual testing and exploration of features.

33# Alongside OAuth2-Proxy, this file also starts Dex to act as the identity provider,

4−# HTTPBin as an example upstream.

4+# etcd for storage for Dex and HTTPBin as an example upstream.

55# This file also uses alpha configuration when configuring OAuth2 Proxy.

66#

77# This file is an extension of the main compose file and must be used with it

@@ -14,7 +14,7 @@ version: "3.0"

1414services:

1515 oauth2-proxy:

1616 container_name: oauth2-proxy

17− image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.4

17+ image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.2

1818 command: --config /oauth2-proxy.cfg --alpha-config /oauth2-proxy-alpha-config.yaml

1919 hostname: oauth2-proxy

2020 volumes:

@@ -43,12 +43,25 @@ services:

4343 dex:

4444 aliases:

4545 - dex.localtest.me

46+ etcd: {}

47+ depends_on:

48+ - etcd

4649 httpbin:

4750 container_name: httpbin

4851 image: kennethreitz/httpbin

4952 ports: []

5053 networks:

5154 httpbin: {}

55+ etcd:

56+ container_name: etcd

57+ image: gcr.io/etcd-development/etcd:v3.6.8

58+ entrypoint: /usr/local/bin/etcd

59+ command:

60+ - --listen-client-urls=http://0.0.0.0:2379

61+ - --advertise-client-urls=http://etcd:2379

62+ networks:

63+ etcd: {}

5264networks:

5365 dex: {}

66+ etcd: {}

5467 httpbin: {}

contrib/local-environment/docker-compose-gitea.yaml+2−2

@@ -14,7 +14,7 @@ version: '3.0'

1414services:

1515 oauth2-proxy:

1616 container_name: oauth2-proxy

17− image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.4

17+ image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.2

1818 command: --config /oauth2-proxy.cfg

1919 hostname: oauth2-proxy

2020 volumes:

@@ -39,7 +39,7 @@ services:

3939 httpbin: {}

4040

4141 gitea:

42− image: gitea/gitea:1.27.2

42+ image: gitea/gitea:1.25.5

4343 container_name: gitea

4444 environment:

4545 - USER_UID=1000

contrib/local-environment/docker-compose-keycloak.yaml+2−2

@@ -14,7 +14,7 @@ version: "3.0"

1414services:

1515 oauth2-proxy:

1616 container_name: oauth2-proxy

17− image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.4

17+ image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.2

1818 command: --config /oauth2-proxy.cfg

1919 hostname: oauth2-proxy

2020 volumes:

@@ -40,7 +40,7 @@ services:

4040

4141 keycloak:

4242 container_name: keycloak

43− image: keycloak/keycloak:26.7

43+ image: keycloak/keycloak:25.0

4444 hostname: keycloak

4545 command:

4646 - "start-dev"

contrib/local-environment/docker-compose-nginx.yaml+29−4

@@ -1,18 +1,28 @@

11# This docker-compose file can be used to bring up an example instance of oauth2-proxy

22# for manual testing and exploration of features.

33# Alongside OAuth2-Proxy, this file also starts Dex to act as the identity provider,

4−# nginx as a reverse proxy and other HTTP services for upstreams.

4+# etcd for storage for Dex, nginx as a reverse proxy and other http services for upstreams

55#

66# This file is an extension of the main compose file and must be used with it

77# docker-compose -f docker-compose.yaml -f docker-compose-nginx.yaml <command>

88# Alternatively:

99# make nginx-<command> (eg make nginx-up, make nginx-down)

1010#

11−# Access http://oauth2-proxy.localtest.me:8080 to initiate a login flow.

11+# Access one of the following URLs to initiate a login flow:

12+# - http://oauth2-proxy.localhost

13+# - http://httpbin.oauth2-proxy.localhost

14+#

15+# The OAuth2 Proxy itself is hosted at http://oauth2-proxy.oauth2-proxy.localhost

16+#

17+# Note, the above URLs should work with Chrome, but you may need to add hosts

18+# entries for other browsers

19+# 127.0.0.1 oauth2-proxy.localhost

20+# 127.0.0.1 httpbin.oauth2-proxy.localhost

21+# 127.0.0.1 oauth2-proxy.oauth2-proxy.localhost

1222version: "3.0"

1323services:

1424 oauth2-proxy:

15− image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.4

25+ image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.2

1626 ports: []

1727 hostname: oauth2-proxy

1828 container_name: oauth2-proxy

@@ -23,6 +33,7 @@ services:

2333 networks:

2434 oauth2-proxy: {}

2535 dex: {}

36+ etcd: {}

2637 httpbin: {}

2738 depends_on:

2839 - dex

@@ -31,7 +42,7 @@ services:

3142 depends_on:

3243 - oauth2-proxy

3344 container_name: nginx

34− image: nginx:1.31

45+ image: nginx:1.29

3546 restart: unless-stopped

3647 ports:

3748 - 8080:8080/tcp

@@ -41,6 +52,7 @@ services:

4152 networks:

4253 oauth2-proxy: {}

4354 dex: {}

55+ etcd: {}

4456 httpbin: {}

4557 dex:

4658 container_name: dex

@@ -56,13 +68,26 @@ services:

5668 dex:

5769 aliases:

5870 - dex.localtest.me

71+ etcd: {}

72+ depends_on:

73+ - etcd

5974 httpbin:

6075 container_name: httpbin

6176 image: kennethreitz/httpbin

6277 ports: []

6378 networks:

6479 httpbin: {}

80+ etcd:

81+ container_name: etcd

82+ image: gcr.io/etcd-development/etcd:v3.6.8

83+ entrypoint: /usr/local/bin/etcd

84+ command:

85+ - --listen-client-urls=http://0.0.0.0:2379

86+ - --advertise-client-urls=http://etcd:2379

87+ networks:

88+ etcd: {}

6589networks:

6690 dex: {}

91+ etcd: {}

6792 httpbin: {}

6893 oauth2-proxy: {}

contrib/local-environment/docker-compose-traefik.yaml+18−42

@@ -1,7 +1,7 @@

11# This docker-compose file can be used to bring up an example instance of oauth2-proxy

22# for manual testing and exploration of features.

3−# Alongside OAuth2-Proxy, this file also starts Dex to act as the identity provider

4−# and HTTPBin as an example upstream.

3+# Alongside OAuth2-Proxy, this file also starts Dex to act as the identity provider,

4+# HTTPBin as an example upstream.

55#

66# This can either be created using docker-compose

77# docker-compose -f docker-compose-traefik.yaml <command>

@@ -9,51 +9,32 @@

99# make traefik-<command> (eg. make traefik-up, make traefik-down)

1010#

1111# Access one of the following URLs to initiate a login flow:

12−# - http://oauth2-proxy.localtest.me

13−# - http://httpbin.localtest.me

14−# - http://dex.localtest.me/dex

12+# - http://oauth2-proxy.localhost

13+# - http://httpbin.oauth2-proxy.localhost

1514#

16−# The OAuth2 Proxy itself is hosted at http://oauth2-proxy.localtest.me

15+# The OAuth2 Proxy itself is hosted at http://oauth2-proxy.oauth2-proxy.localhost

16+#

17+# Note, the above URLs should work with Chrome, but you may need to add hosts

18+# entries for other browsers

19+# 127.0.0.1 oauth2-proxy.localhost

20+# 127.0.0.1 httpbin.oauth2-proxy.localhost

21+# 127.0.0.1 oauth2-proxy.oauth2-proxy.localhost

22+version: '3.0'

1723services:

1824

1925 oauth2-proxy:

20− container_name: oauth2-proxy

21− image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.4

22− command: --config /oauth2-proxy.cfg

26+ image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.2

2327 ports: []

2428 hostname: oauth2-proxy

2529 volumes:

2630 - "./oauth2-proxy-traefik.cfg:/oauth2-proxy.cfg"

27− restart: unless-stopped

28− networks:

29− oauth2-proxy: {}

30− dex: {}

31− depends_on:

32− - dex

33− - httpbin

34−

35− dex:

36− container_name: dex

37− image: ghcr.io/dexidp/dex:v2.45.1

38− command: dex serve /dex.yaml

39− hostname: dex

40− volumes:

41− - "./dex-traefik.yaml:/dex.yaml"

42− restart: unless-stopped

4331 networks:

44− dex: {}

45−

46− httpbin:

47− container_name: httpbin

48− image: kennethreitz/httpbin

49− ports: []

50− networks:

51− httpbin: {}

32+ oauth2-proxy:

5233

5334 # Reverse proxy

5435 gateway:

5536 container_name: traefik

56− image: traefik:v3.7.10

37+ image: traefik:v2.11.40

5738 volumes:

5839 - "./traefik:/etc/traefik"

5940 ports:

@@ -62,13 +43,8 @@ services:

6243 depends_on:

6344 - oauth2-proxy

6445 networks:

65− oauth2-proxy: {}

66− httpbin: {}

67− dex:

68− aliases:

69− - dex.localtest.me

46+ oauth2-proxy:

47+ httpbin:

7048

7149networks:

72− dex: {}

73− httpbin: {}

74− oauth2-proxy: {}

50+ oauth2-proxy:

contrib/local-environment/docker-compose.yaml+15−2

@@ -1,7 +1,7 @@

11# This docker-compose file can be used to bring up an example instance of oauth2-proxy

22# for manual testing and exploration of features.

33# Alongside OAuth2-Proxy, this file also starts Dex to act as the identity provider,

4−# HTTPBin as an example upstream.

4+# etcd for storage for Dex and HTTPBin as an example upstream.

55#

66# This can either be created using docker-compose

77# docker-compose -f docker-compose.yaml <command>

@@ -13,7 +13,7 @@ version: "3.0"

1313services:

1414 oauth2-proxy:

1515 container_name: oauth2-proxy

16− image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.4

16+ image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.2

1717 command: --config /oauth2-proxy.cfg

1818 hostname: oauth2-proxy

1919 volumes:

@@ -41,12 +41,25 @@ services:

4141 dex:

4242 aliases:

4343 - dex.localtest.me

44+ etcd: {}

45+ depends_on:

46+ - etcd

4447 httpbin:

4548 container_name: httpbin

4649 image: kennethreitz/httpbin

4750 ports: []

4851 networks:

4952 httpbin: {}

53+ etcd:

54+ container_name: etcd

55+ image: gcr.io/etcd-development/etcd:v3.6.8

56+ entrypoint: /usr/local/bin/etcd

57+ command:

58+ - --listen-client-urls=http://0.0.0.0:2379

59+ - --advertise-client-urls=http://etcd:2379

60+ networks:

61+ etcd: {}

5062networks:

5163 dex: {}

64+ etcd: {}

5265 httpbin: {}

contrib/local-environment/kubernetes/Chart.lock+3−3

@@ -1,7 +1,7 @@

11dependencies:

22- name: dex

33 repository: https://charts.dexidp.io

4− version: 0.24.1

4+ version: 0.24.0

55- name: oauth2-proxy

66 repository: https://oauth2-proxy.github.io/manifests

77 version: 7.18.0

@@ -11,5 +11,5 @@ dependencies:

1111- name: hello-world

1212 repository: https://conservis.github.io/helm-charts

1313 version: 1.1.0

14−digest: sha256:3fff8bf99cebcd20a73c984423d5f1c2dfa1e5a394f82a5dc60d9aaffe5361b7

15−generated: "2026-08-18T07:33:03.791274914Z"

14+digest: sha256:fee913531bfb67e5555e995d8fb040c330e6eb4b5a8c777ceb9841135ea9bb84

15+generated: "2025-10-28T06:46:35.38300324Z"

contrib/local-environment/kubernetes/Chart.yaml+1−1

@@ -3,7 +3,7 @@ description: K8S example based on https://kind.sigs.k8s.io

33name: kubernetes

44dependencies:

55 - name: dex

6− version: 0.24.1

6+ version: 0.24.0

77 repository: https://charts.dexidp.io

88 - name: oauth2-proxy

99 version: &chartVersion 7.18.0

contrib/local-environment/oauth2-proxy-traefik.cfg+4−4

@@ -2,14 +2,14 @@ http_address="0.0.0.0:4180"

22cookie_secret="OQINaROshtE9TcZkNAm-5Zs2Pv3xaWytBmc5W7sPX7w="

33provider="oidc"

44email_domains=["example.com"]

5−oidc_issuer_url="http://dex.localtest.me/dex"

5+oidc_issuer_url="http://dex.localhost:5556/dex"

66client_secret="b2F1dGgyLXByb3h5LWNsaWVudC1zZWNyZXQK"

77client_id="oauth2-proxy"

88cookie_secure="false"

10−redirect_url="http://oauth2-proxy.localtest.me/oauth2/callback"

11−cookie_domains=".localtest.me" # Required so cookie can be read on all subdomains.

12−whitelist_domains=".localtest.me" # Required to allow redirection back to original requested target.

10+redirect_url="http://oauth2-proxy.oauth2-proxy.localhost/oauth2/callback"

11+cookie_domains=".oauth2-proxy.localhost" # Required so cookie can be read on all subdomains.

12+whitelist_domains=".oauth2-proxy.localhost" # Required to allow redirection back to original requested target.

1313

1414# Mandatory option when using oauth2-proxy with traefik

1515reverse_proxy="true"

contrib/local-environment/traefik/dynamic.yaml+4−11

@@ -1,25 +1,22 @@

11http:

22 routers:

33 oauth2-proxy-route:

4− rule: "Host(`oauth2-proxy.localtest.me`)"

4+ rule: "Host(`oauth2-proxy.oauth2-proxy.localhost`)"

55 middlewares:

66 - auth-headers

77 service: oauth-backend

8− dex-route:

9− rule: "Host(`dex.localtest.me`)"

10− service: dex-service

118 httpbin-route:

12− rule: "Host(`httpbin.localtest.me`)"

9+ rule: "Host(`httpbin.oauth2-proxy.localhost`)"

1310 service: httpbin-service

1411 middlewares:

1512 - oauth-auth-redirect # redirects all unauthenticated to oauth2 signin

1613 httpbin-route-2:

17− rule: "Host(`httpbin.localtest.me`) && PathPrefix(`/no-auto-redirect`)"

14+ rule: "Host(`httpbin.oauth2-proxy.localhost`) && PathPrefix(`/no-auto-redirect`)"

1815 service: httpbin-service

1916 middlewares:

2017 - oauth-auth-wo-redirect # unauthenticated session will return a 401

2118 services-oauth2-route:

22− rule: "Host(`httpbin.localtest.me`) && PathPrefix(`/oauth2/`)"

19+ rule: "Host(`httpbin.oauth2-proxy.localhost`) && PathPrefix(`/oauth2/`)"

2320 middlewares:

2421 - auth-headers

2522 service: oauth-backend

@@ -33,10 +30,6 @@ http:

3330 loadBalancer:

3431 servers:

3532 - url: http://oauth2-proxy:4180

36− dex-service:

37− loadBalancer:

38− servers:

39− - url: http://dex:5556

4033

4134 middlewares:

4235 auth-headers:

contrib/local-environment/traefik/traefik.yaml−2

@@ -5,5 +5,3 @@ log:

55providers:

66 file:

77 filename: /etc/traefik/dynamic.yaml

8− # Routes are static for this example; disabling watch avoids host inotify limits.

9− watch: false

docs/docs/configuration/alpha_config.md+1−12

@@ -167,17 +167,6 @@ injectResponseHeaders:

167167* `claimSource` - `claim` (session claims either from id token or from profile URL)

168168* `secretSource` - `value` (base64), `fromFile` (file path)

169169

170−#### Claim value serialization

171−

172−`claimSource` converts the selected claim into one or more string header values. Scalars

173−produce one value, while arrays produce one value per element. Values that cannot be

174−converted directly to strings, such as objects, are JSON-encoded individually.

175−

176−Each non-empty value is added separately under the configured header name. An array of

177−objects therefore produces multiple header values containing one JSON object each, not a

178−single JSON array. HTTP libraries and intermediaries may expose repeated values as a

179−comma-joined string, so consumers should retrieve and parse each header value separately.

180−

181170**Request option:** `preserveRequestValue: true` retains existing header values

182171

183172**Incompatibility:** Remove legacy flags `pass-user-headers`, `set-xauthrequest`

@@ -689,7 +678,7 @@ Requests will be proxied to this upstream if the path matches the request path.

689678| Field | Type | Description |

690679| ----- | ---- | ----------- |

691680| `id` | _string_ | ID should be a unique identifier for the upstream. This value is required for all upstreams. |

692−| `path` | _string_ | Path is used to map requests to the upstream server. The closest match will take precedence and all Paths must be unique. Without RewriteTarget, Path follows gorilla/mux route syntax. Eg: - `/foo`: Match only the explicit path `/foo` - `/bar/`: Match any path prefixed with `/bar/` - `/baz/{path:.*}`: Match any path prefixed with `/baz/` When RewriteTarget is set, Path is treated as a regular expression. Eg: `^/baz/(.*)$` matches any path prefixed with `/baz` and captures the remaining path for use with RewriteTarget. |

681+| `path` | _string_ | Path is used to map requests to the upstream server. The closest match will take precedence and all Paths must be unique. Path can also take a pattern when used with RewriteTarget. Path segments can be captured and matched using regular experessions. Eg: - `^/foo$`: Match only the explicit path `/foo` - `^/bar/$`: Match any path prefixed with `/bar/` - `^/baz/(.*)$`: Match any path prefixed with `/baz` and capture the remaining path for use with RewriteTarget |

693682| `rewriteTarget` | _string_ | RewriteTarget allows users to rewrite the request path before it is sent to the upstream server (for an HTTP/HTTPS upstream) or mapped to the filesystem (for a `file:` upstream). Use the Path to capture segments for reuse within the rewrite target. Eg: With a Path of `^/baz/(.*)`, a RewriteTarget of `/foo/$1` would rewrite the request `/baz/abc/123` to `/foo/abc/123` before proxying to the upstream server. Or if the upstream were `file:///app`, a request for `/baz/info.html` would return the contents of the file `/app/foo/info.html`. |

694683| `uri` | _string_ | The URI of the upstream server. This may be an HTTP(S) server of a File based URL. It may include a path, in which case all requests will be served under that path. Eg: - http://localhost:8080 - https://service.localhost - https://service.localhost/path - file://host/path If the URI's path is "/base" and the incoming request was for "/dir", the upstream request will be for "/base/dir". |

695684| `insecureSkipTLSVerify` | _bool_ | InsecureSkipTLSVerify will skip TLS verification of upstream HTTPS hosts. This option is insecure and will allow potential Man-In-The-Middle attacks between OAuth2 Proxy and the upstream server. Defaults to false. |

docs/docs/configuration/alpha_config.md.tmpl−11

@@ -167,17 +167,6 @@ injectResponseHeaders:

167167* `claimSource` - `claim` (session claims either from id token or from profile URL)

168168* `secretSource` - `value` (base64), `fromFile` (file path)

169169

170−#### Claim value serialization

171−

172−`claimSource` converts the selected claim into one or more string header values. Scalars

173−produce one value, while arrays produce one value per element. Values that cannot be

174−converted directly to strings, such as objects, are JSON-encoded individually.

175−

176−Each non-empty value is added separately under the configured header name. An array of

177−objects therefore produces multiple header values containing one JSON object each, not a

178−single JSON array. HTTP libraries and intermediaries may expose repeated values as a

179−comma-joined string, so consumers should retrieve and parse each header value separately.

180−

181170**Request option:** `preserveRequestValue: true` retains existing header values

182171

183172**Incompatibility:** Remove legacy flags `pass-user-headers`, `set-xauthrequest`

docs/docs/configuration/integrations/nginx.md+11−27

@@ -60,23 +60,23 @@ server {

6060 auth_request_set $auth_cookie $upstream_http_set_cookie;

6161 add_header Set-Cookie $auth_cookie;

6262

63− # Large OIDC tokens can make the session cookie exceed the 4KB limit,

64− # causing OAuth2 Proxy to split the cookie into multiple parts.

63+ # When using the --set-authorization-header flag, some provider's cookies can exceed the 4kb

64+ # limit and so the OAuth2 Proxy splits these into multiple parts.

6565 # Nginx normally only copies the first `Set-Cookie` header from the auth_request to the response,

66− # so extract the second part when using the default cookie name, `_oauth2_proxy`.

67− auth_request_set $auth_cookie_upstream_1 $upstream_cookie__oauth2_proxy_1;

66+ # so if your cookies are larger than 4kb, you will need to extract additional cookies manually.

67+ auth_request_set $auth_cookie_name_upstream_1 $upstream_cookie_auth_cookie_name_1;

6868

6969 # Extract the Cookie attributes from the first Set-Cookie header and append them

7070 # to the second part ($upstream_cookie_* variables only contain the raw cookie content)

7171 if ($auth_cookie ~* "(; .*)") {

72− set $auth_cookie_0 $auth_cookie;

73− set $auth_cookie_1 "_oauth2_proxy_1=$auth_cookie_upstream_1$1";

72+ set $auth_cookie_name_0 $auth_cookie;

73+ set $auth_cookie_name_1 "auth_cookie_name_1=$auth_cookie_name_upstream_1$1";

7474 }

7575

7676 # Send both Set-Cookie headers now if there was a second part

77− if ($auth_cookie_upstream_1) {

78− add_header Set-Cookie $auth_cookie_0;

79− add_header Set-Cookie $auth_cookie_1;

77+ if ($auth_cookie_name_upstream_1) {

78+ add_header Set-Cookie $auth_cookie_name_0;

79+ add_header Set-Cookie $auth_cookie_name_1;

8080 }

8181

8282 proxy_pass http://backend/;

@@ -91,24 +91,6 @@ server {

9191}

9292```

9393

94−### Multi-part session cookies

95−

96−The example above is ready to use with the default `--cookie-name=_oauth2_proxy` setting and handles a session split into two cookies. If you configure a custom cookie name, update both references to the second cookie part:

97−

98−| Cookie configuration | Nginx upstream cookie variable | `Set-Cookie` name |

99−| --- | --- | --- |

100−| Default (`_oauth2_proxy`) | `$upstream_cookie__oauth2_proxy_1` | `_oauth2_proxy_1=` |

101−| `--cookie-name=my_cookie` | `$upstream_cookie_my_cookie_1` | `my_cookie_1=` |

102−

103−For example, with `--cookie-name=my_cookie`, change the relevant lines to:

104−

105−```nginx

106−auth_request_set $auth_cookie_upstream_1 $upstream_cookie_my_cookie_1;

107−set $auth_cookie_1 "my_cookie_1=$auth_cookie_upstream_1$1";

108−```

109−

110−If a session is split into more than two cookies, repeat the extraction for each additional numeric suffix. For consistently large sessions, prefer `--session-store-type=redis` so only a small session ticket is stored in the browser cookie.

111−

11294### Understanding the `error_page` redirect pattern

11395

11496The `auth_request` directive expects the authentication endpoint (`/oauth2/auth`) to return:

@@ -185,6 +167,8 @@ It is recommended to use `--session-store-type=redis` when expecting large sessi

185167For a complete example of integrating oauth2-proxy with Kubernetes Dashboard on AKS using Azure Entra ID, including RBAC configuration and troubleshooting, see the [Kubernetes Dashboard on AKS](../providers/ms_entra_id.md#kubernetes-dashboard-on-aks) section in the Microsoft Entra ID provider documentation.

186168:::

187169

170+You have to substitute *name* with the actual cookie name you configured via --cookie-name parameter. If you don't set a custom cookie name the variable should be "$upstream_cookie__oauth2_proxy_1" instead of "$upstream_cookie_name_1" and the new cookie-name should be "_oauth2_proxy_1=" instead of "name_1=".

171+

188172:::note

189173If you set up your OAuth2 provider to rotate your client secret, you can use the `client-secret-file` option to reload the secret when it is updated.

190174:::

docs/docs/configuration/providers/atlassian.mddeleted−26

@@ -1,26 +0,0 @@

1−---

2−id: atlassian

3−title: Atlassian Cloud

4−---

5−

6−1. Create an OAuth 2.0 integration in the [Atlassian developer console](https://developer.atlassian.com/console/myapps/).

7−2. Under **Permissions**, add the User identity API with the `read:me` scope.

8−3. Under **Authorization**, set the callback URL to `https://<proxy_host>/oauth2/callback`.

9−4. Copy the client ID and secret from **Settings**.

10−5. Run the proxy with:

11−

12−```shell

13− --provider=atlassian

14− --client-id=<client ID>

15− --client-secret=<secret>

16− --redirect-url=https://<proxy_host>/oauth2/callback

17− --cookie-secret=<cookie secret>

18−```

19−

20−A new app works only for the account that created it. Enable sharing under **Distribution** to let other users sign in.

21−Atlassian then admits only accounts with access to the Atlassian site the app is installed on; others are refused at

22−the consent screen.

23−

24−The proxy reads the user's email from `https://api.atlassian.com/me`. Restricting access further is supported by

25−[email](index.md#email-authentication). With `--cookie-refresh` set, the proxy re-validates the token against `/me` on

26−that interval.

docs/docs/configuration/providers/dtt_sso.mddeleted−45

@@ -1,45 +0,0 @@

1−---

2−id: dtt_sso

3−title: DTT SSO

4−---

5−

6−Signs users in with the DTT SSO (auth-server) using the authorization code flow and its HS256 id_token.

7−

8−1. Register a client in the auth-server config, one per protected service, with the proxy's callback as its

9− only redirect URI:

10−

11− ```yaml

12− clients:

13− redash-gate:

14− secret: <random secret>

15− redirect_uri: https://redash.example.com/oauth2/callback

16− display_name: Redash

17− ```

18−

19−2. Run the proxy with:

20−

21− ```shell

22− --provider=dtt-sso

23− --client-id=redash-gate

24− --client-secret-file=/run/secrets/client_secret

25− --redirect-url=https://redash.example.com/oauth2/callback

26− --cookie-secret-file=/run/secrets/cookie_secret

27− --cookie-name=_dtt_sso_redash

28− --cookie-refresh=5m

29− ```

30−

31− Give each instance its own `--cookie-name`: another oauth2-proxy setting its cookie on a parent domain

32− (the Atlassian proxy uses `_oauth2_proxy` on `.thebestagent.pro`) would otherwise shadow this one.

33−

34−The endpoints default to `https://auth.thebestagent.pro`. For another SSO host set `--login-url`, `--redeem-url`

35−and `--validate-url` to its `/oauth/authorize`, `/oauth/token` and `/oauth/check_token`; the id_token issuer must

36−equal the login URL's origin (the SSO's `site_host`).

37−

38−The scope must stay `openid`, the only scope the SSO accepts.

39−

40−The session carries the SSO `email`, the user UUID as the user, and the SSO `role` as the only group, so

41−`--allowed-group=dtt_admin` restricts access by role. `--authenticated-emails-file` and `--email-domain` restrict

42−by email as usual.

43−

44−With `--cookie-refresh` set, the proxy refreshes the tokens on that interval and re-reads the email and role; a user

45−deleted or signed out in the SSO loses access at the next refresh.

docs/docs/configuration/providers/index.md−2

@@ -9,12 +9,10 @@ with Redirect URI(s) for the domain you intend to run `oauth2-proxy` on.

99Valid providers are :

1010

1111- [ADFS](adfs.md)

12−- [Atlassian Cloud](atlassian.md)

1312- [Bitbucket](bitbucket.md)

1413- [Cidaas](cidaas.md)

1514- [CiscoDuo](cisco_duo.md)

1615- [DigitalOcean](digitalocean.md)

17−- [DTT SSO](dtt_sso.md)

1816- [Facebook](facebook.md)

1917- [Gitea](gitea.md)

2018- [GitHub](github.md)

docs/docs/installation.md+1−1

@@ -5,7 +5,7 @@ title: Installation

661. Choose how to deploy:

8− a. Using a [Prebuilt Binary](https://github.com/oauth2-proxy/oauth2-proxy/releases) (current release is `v7.15.4`)

8+ a. Using a [Prebuilt Binary](https://github.com/oauth2-proxy/oauth2-proxy/releases) (current release is `v7.15.2`)

1010 b. Using Go to install the latest release

1111 ```bash

docs/docusaurus.config.js+1−1

@@ -105,7 +105,7 @@ const config = {

105105 dropdownActiveClassDisabled: true,

106106 },

107107 {

108− href: 'https://cloud-native.slack.com/archives/C098Y5URZ2N',

108+ href: 'https://gophers.slack.com/messages/CM2RSS25N',

109109 label: 'Slack',

110110 position: 'right',

111111 },

docs/sidebars.js−2

@@ -46,13 +46,11 @@ const sidebars = {

4646 },

4747 items: [

4848 "configuration/providers/adfs",

49− "configuration/providers/atlassian",

5049 "configuration/providers/azure",

5150 "configuration/providers/bitbucket",

5251 "configuration/providers/cidaas",

5352 "configuration/providers/cisco_duo",

5453 "configuration/providers/digitalocean",

55− "configuration/providers/dtt_sso",

5654 "configuration/providers/facebook",

5755 "configuration/providers/gitea",

5856 "configuration/providers/github",

docs/versioned_docs/version-7.15.x/installation.md+1−1

@@ -5,7 +5,7 @@ title: Installation

661. Choose how to deploy:

8− a. Using a [Prebuilt Binary](https://github.com/oauth2-proxy/oauth2-proxy/releases) (current release is `v7.15.4`)

8+ a. Using a [Prebuilt Binary](https://github.com/oauth2-proxy/oauth2-proxy/releases) (current release is `v7.15.2`)

1010 b. Using Go to install the latest release

1111 ```bash

go.mod+43−39

@@ -1,17 +1,17 @@

11module github.com/oauth2-proxy/oauth2-proxy/v7

3−go 1.26.0

3+go 1.25.0

55require (

66 cloud.google.com/go/compute/metadata v0.9.0

77 github.com/Bose/minisentinel v0.0.0-20200130220412-917c5a9223bb

88 github.com/a8m/envsubst v1.4.3

9− github.com/alicebob/miniredis/v2 v2.38.0

9+ github.com/alicebob/miniredis/v2 v2.37.0

1010 github.com/bitly/go-simplejson v0.5.1

11− github.com/bsm/redislock v0.10.0

12− github.com/coreos/go-oidc/v3 v3.20.0

11+ github.com/bsm/redislock v0.9.4

12+ github.com/coreos/go-oidc/v3 v3.18.0

1313 github.com/coreos/go-systemd v0.0.0-20191104093116-d3cd4ed1dbcf

14− github.com/fsnotify/fsnotify v1.10.1

14+ github.com/fsnotify/fsnotify v1.9.0

1515 github.com/go-jose/go-jose/v3 v3.0.5

1616 github.com/go-jose/go-jose/v4 v4.1.4

1717 github.com/go-viper/mapstructure/v2 v2.5.0

@@ -21,63 +21,67 @@ require (

2121 github.com/gorilla/mux v1.8.1

2222 github.com/justinas/alice v1.2.0

2323 github.com/oauth2-proxy/mockoidc v0.0.0-20240214162133-caebfff84d25

24− github.com/onsi/ginkgo/v2 v2.32.1

25− github.com/onsi/gomega v1.42.1

26− github.com/pierrec/lz4/v4 v4.1.28

27− github.com/prometheus/client_golang v1.24.1

28− github.com/redis/go-redis/v9 v9.22.0

24+ github.com/onsi/ginkgo/v2 v2.28.1

25+ github.com/onsi/gomega v1.39.1

26+ github.com/pierrec/lz4/v4 v4.1.26

27+ github.com/prometheus/client_golang v1.23.2

28+ github.com/redis/go-redis/v9 v9.18.0

2929 github.com/spf13/cast v1.10.0

3030 github.com/spf13/pflag v1.0.10

3131 github.com/spf13/viper v1.21.0

32− github.com/stretchr/testify v1.12.0

32+ github.com/stretchr/testify v1.11.1

3333 github.com/vmihailenco/msgpack/v5 v5.4.1

34− go.yaml.in/yaml/v3 v3.0.5

35− golang.org/x/crypto v0.55.0

36− golang.org/x/net v0.58.0

34+ go.yaml.in/yaml/v3 v3.0.4

35+ golang.org/x/crypto v0.50.0

36+ golang.org/x/net v0.53.0

3737 golang.org/x/oauth2 v0.36.0

38− golang.org/x/sync v0.22.0

39− google.golang.org/api v0.293.0

38+ golang.org/x/sync v0.20.0

39+ google.golang.org/api v0.275.0

4040 gopkg.in/natefinch/lumberjack.v2 v2.2.1

41− k8s.io/apimachinery v0.36.3

41+ k8s.io/apimachinery v0.35.3

4242)

4343

4444require (

45− cloud.google.com/go/auth v0.23.1 // indirect

45+ cloud.google.com/go/auth v0.20.0 // indirect

4646 cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect

47− github.com/Masterminds/semver/v3 v3.5.0 // indirect

47+ github.com/Masterminds/semver/v3 v3.4.0 // indirect

4848 github.com/beorn7/perks v1.0.1 // indirect

4949 github.com/cespare/xxhash/v2 v2.3.0 // indirect

50− github.com/felixge/httpsnoop v1.1.0 // indirect

51− github.com/go-logr/logr v1.4.4 // indirect

50+ github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect

51+ github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f // indirect

52+ github.com/felixge/httpsnoop v1.0.4 // indirect

53+ github.com/go-logr/logr v1.4.3 // indirect

5254 github.com/go-logr/stdr v1.2.2 // indirect

5355 github.com/go-task/slim-sprig/v3 v3.0.0 // indirect

54− github.com/google/pprof v0.0.0-20260802141513-ef3492d7dac3 // indirect

56+ github.com/google/pprof v0.0.0-20260402051712-545e8a4df936 // indirect

5557 github.com/google/s2a-go v0.1.9 // indirect

56− github.com/googleapis/enterprise-certificate-proxy v0.3.21 // indirect

57− github.com/googleapis/gax-go/v2 v2.23.0 // indirect

58+ github.com/googleapis/enterprise-certificate-proxy v0.3.14 // indirect

59+ github.com/googleapis/gax-go/v2 v2.21.0 // indirect

5860 github.com/kylelemons/godebug v1.1.0 // indirect

5961 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect

60− github.com/pelletier/go-toml/v2 v2.4.3 // indirect

62+ github.com/pelletier/go-toml/v2 v2.3.0 // indirect

63+ github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect

6164 github.com/prometheus/client_model v0.6.2 // indirect

62− github.com/prometheus/common v0.70.1 // indirect

63− github.com/prometheus/procfs v0.21.1 // indirect

65+ github.com/prometheus/common v0.67.5 // indirect

66+ github.com/prometheus/procfs v0.20.1 // indirect

6467 github.com/sagikazarmark/locafero v0.12.0 // indirect

6568 github.com/spf13/afero v1.15.0 // indirect

6669 github.com/subosito/gotenv v1.6.0 // indirect

6770 github.com/vmihailenco/tagparser/v2 v2.0.0 // indirect

68− github.com/yuin/gopher-lua v1.1.2 // indirect

71+ github.com/yuin/gopher-lua v1.1.1 // indirect

6972 go.opentelemetry.io/auto/sdk v1.2.1 // indirect

70− go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.70.0 // indirect

71− go.opentelemetry.io/otel v1.45.0 // indirect

72− go.opentelemetry.io/otel/metric v1.45.0 // indirect

73− go.opentelemetry.io/otel/trace v1.45.0 // indirect

73+ go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.68.0 // indirect

74+ go.opentelemetry.io/otel v1.43.0 // indirect

75+ go.opentelemetry.io/otel/metric v1.43.0 // indirect

76+ go.opentelemetry.io/otel/trace v1.43.0 // indirect

7477 go.uber.org/atomic v1.11.0 // indirect

75− golang.org/x/mod v0.40.0 // indirect

76− golang.org/x/sys v0.47.0 // indirect

77− golang.org/x/text v0.41.0 // indirect

78− golang.org/x/tools v0.49.0 // indirect

79− google.golang.org/genproto/googleapis/rpc v0.0.0-20260817212433-ac3dfec99bb1 // indirect

80− google.golang.org/grpc v1.83.0 // indirect

81− google.golang.org/protobuf v1.36.12 // indirect

78+ go.yaml.in/yaml/v2 v2.4.4 // indirect

79+ golang.org/x/mod v0.35.0 // indirect

80+ golang.org/x/sys v0.43.0 // indirect

81+ golang.org/x/text v0.36.0 // indirect

82+ golang.org/x/tools v0.44.0 // indirect

83+ google.golang.org/genproto/googleapis/rpc v0.0.0-20260406210006-6f92a3bedf2d // indirect

84+ google.golang.org/grpc v1.80.0 // indirect

85+ google.golang.org/protobuf v1.36.11 // indirect

8286 gopkg.in/yaml.v3 v3.0.1 // indirect

8387)

go.sum+143−91

@@ -1,5 +1,7 @@

1−cloud.google.com/go/auth v0.23.1 h1:1tPpBPG02lQHmoiAvs9egyCASqXP0xgobptjZzov/Jg=

2−cloud.google.com/go/auth v0.23.1/go.mod h1:4DhBRcqvtljQN3dJ57qtqbib5ZGCYE5f2crfiiC2EM0=

1+cloud.google.com/go/auth v0.18.2 h1:+Nbt5Ev0xEqxlNjd6c+yYUeosQ5TtEUaNcN/3FozlaM=

2+cloud.google.com/go/auth v0.18.2/go.mod h1:xD+oY7gcahcu7G2SG2DsBerfFxgPAJz17zz2joOFF3M=

3+cloud.google.com/go/auth v0.20.0 h1:kXTssoVb4azsVDoUiF8KvxAqrsQcQtB53DcSgta74CA=

4+cloud.google.com/go/auth v0.20.0/go.mod h1:942/yi/itH1SsmpyrbnTMDgGfdy2BUqIKyd0cyYLc5Q=

35cloud.google.com/go/auth/oauth2adapt v0.2.8 h1:keo8NaayQZ6wimpNSmW5OPc283g65QNIiLpZnkHRbnc=

46cloud.google.com/go/auth/oauth2adapt v0.2.8/go.mod h1:XQ9y31RkqZCcwJWNSx2Xvric3RrU88hAYYbjDWYDL+c=

57cloud.google.com/go/compute/metadata v0.9.0 h1:pDUj4QMoPejqq20dK0Pg2N4yG9zIkYGdBtwLoEkH9Zs=

@@ -8,14 +10,14 @@ github.com/Bose/minisentinel v0.0.0-20200130220412-917c5a9223bb h1:ZVN4Iat3runWO

810github.com/Bose/minisentinel v0.0.0-20200130220412-917c5a9223bb/go.mod h1:WsAABbY4HQBgd3mGuG4KMNTbHJCPvx9IVBHzysbknss=

911github.com/FZambia/sentinel v1.0.0 h1:KJ0ryjKTZk5WMp0dXvSdNqp3lFaW1fNFuEYfrkLOYIc=

1012github.com/FZambia/sentinel v1.0.0/go.mod h1:ytL1Am/RLlAoAXG6Kj5LNuw/TRRQrv2rt2FT26vP5gI=

11−github.com/Masterminds/semver/v3 v3.5.0 h1:kQceYJfbupGfZOKZQg0kou0DgAKhzDg2NZPAwZ/2OOE=

12−github.com/Masterminds/semver/v3 v3.5.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=

13+github.com/Masterminds/semver/v3 v3.4.0 h1:Zog+i5UMtVoCU8oKka5P7i9q9HgrJeGzI9SA1Xbatp0=

14+github.com/Masterminds/semver/v3 v3.4.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=

1315github.com/a8m/envsubst v1.4.3 h1:kDF7paGK8QACWYaQo6KtyYBozY2jhQrTuNNuUxQkhJY=

1416github.com/a8m/envsubst v1.4.3/go.mod h1:4jjHWQlZoaXPoLQUb7H2qT4iLkZDdmEQiOUogdUmqVU=

1517github.com/alicebob/gopher-json v0.0.0-20180125190556-5a6b3ba71ee6/go.mod h1:SGnFV6hVsYE877CKEZ6tDNTjaSXYUk6QqoIK6PrAtcc=

1618github.com/alicebob/miniredis/v2 v2.11.1/go.mod h1:UA48pmi7aSazcGAvcdKcBB49z521IC9VjTTRz2nIaJE=

17−github.com/alicebob/miniredis/v2 v2.38.0 h1:nZAzCR+Lj+Vxk4ZXzm2NuKq2O33RXj1XxJ2e2uP9jiw=

18−github.com/alicebob/miniredis/v2 v2.38.0/go.mod h1:TcL7YfarKPGDAthEtl5NBeHZfeUQj6OXMm/+iu5cLMM=

19+github.com/alicebob/miniredis/v2 v2.37.0 h1:RheObYW32G1aiJIj81XVt78ZHJpHonHLHW7OLIshq68=

20+github.com/alicebob/miniredis/v2 v2.37.0/go.mod h1:TcL7YfarKPGDAthEtl5NBeHZfeUQj6OXMm/+iu5cLMM=

1921github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=

2022github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=

2123github.com/bitly/go-simplejson v0.5.1 h1:xgwPbetQScXt1gh9BmoJ6j9JMr3TElvuIyjR8pgdoow=

@@ -24,41 +26,51 @@ github.com/bsm/ginkgo/v2 v2.12.0 h1:Ny8MWAHyOepLGlLKYmXG4IEkioBysk6GpaRTLC8zwWs=

2426github.com/bsm/ginkgo/v2 v2.12.0/go.mod h1:SwYbGRRDovPVboqFv0tPTcG1sN61LM1Z4ARdbAV9g4c=

2527github.com/bsm/gomega v1.27.10 h1:yeMWxP2pV2fG3FgAODIY8EiRE3dy0aeFYt4l7wh6yKA=

2628github.com/bsm/gomega v1.27.10/go.mod h1:JyEr/xRbxbtgWNi8tIEVPUYZ5Dzef52k01W3YH0H+O0=

27−github.com/bsm/redislock v0.10.0 h1:NAe1OHDnwPmWEzD+LpWBZXAdZrWld/xj/wmqEcQednQ=

28−github.com/bsm/redislock v0.10.0/go.mod h1:M05WZGjPbX/8ne7LmB7AbOsa2kv7Jzx4fqkLpDFZvJs=

29+github.com/bsm/redislock v0.9.4 h1:X/Wse1DPpiQgHbVYRE9zv6m070UcKoOGekgvpNhiSvw=

30+github.com/bsm/redislock v0.9.4/go.mod h1:Epf7AJLiSFwLCiZcfi6pWFO/8eAYrYpQXFxEDPoDeAk=

2931github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=

3032github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=

3133github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI=

3234github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI=

3335github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=

34−github.com/coreos/go-oidc/v3 v3.20.0 h1:EtE0WIBHk03N+DqGkY4+UONzzZHk7amKt6IyNd7OsZE=

35−github.com/coreos/go-oidc/v3 v3.20.0/go.mod h1:DYCf24+ncYi+XkIH97GY1+dqoRlbaSI26KVTCI9SrY4=

36+github.com/coreos/go-oidc/v3 v3.17.0 h1:hWBGaQfbi0iVviX4ibC7bk8OKT5qNr4klBaCHVNvehc=

37+github.com/coreos/go-oidc/v3 v3.17.0/go.mod h1:wqPbKFrVnE90vty060SB40FCJ8fTHTxSwyXJqZH+sI8=

38+github.com/coreos/go-oidc/v3 v3.18.0 h1:V9orjXynvu5wiC9SemFTWnG4F45v403aIcjWo0d41+A=

39+github.com/coreos/go-oidc/v3 v3.18.0/go.mod h1:DYCf24+ncYi+XkIH97GY1+dqoRlbaSI26KVTCI9SrY4=

3640github.com/coreos/go-systemd v0.0.0-20191104093116-d3cd4ed1dbcf h1:iW4rZ826su+pqaw19uhpSCzhj44qo35pNgKFGqzDKkU=

3741github.com/coreos/go-systemd v0.0.0-20191104093116-d3cd4ed1dbcf/go.mod h1:F5haX7vjVVG0kc13fIWeqUViNPyEJxv/OmvnBo0Yme4=

3842github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=

39−github.com/felixge/httpsnoop v1.1.0 h1:3YtUj32ZZkqZtt3sZZsClsymw/QDuVfpNhoA31zeORc=

40−github.com/felixge/httpsnoop v1.1.0/go.mod h1:Zqxgdd+1Rkcz8euOqdr7lqgCRJztwr5hp9vDSi5UZCE=

43+github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=

44+github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=

45+github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f h1:lO4WD4F/rVNCu3HqELle0jiPLLBs70cWOduZpkS1E78=

46+github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f/go.mod h1:cuUVRXasLTGF7a8hSLbxyZXjz+1KgoB3wDUb6vlszIc=

47+github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=

48+github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=

4149github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHkI4W8=

4250github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7zb5vbUoiM6w0=

43−github.com/fsnotify/fsnotify v1.10.1 h1:b0/UzAf9yR5rhf3RPm9gf3ehBPpf0oZKIjtpKrx59Ho=

44−github.com/fsnotify/fsnotify v1.10.1/go.mod h1:TLheqan6HD6GBK6PrDWyDPBaEV8LspOxvPSjC+bVfgo=

51+github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S9k=

52+github.com/fsnotify/fsnotify v1.9.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=

4553github.com/gkampitakis/ciinfo v0.3.2 h1:JcuOPk8ZU7nZQjdUhctuhQofk7BGHuIy0c9Ez8BNhXs=

4654github.com/gkampitakis/ciinfo v0.3.2/go.mod h1:1NIwaOcFChN4fa/B0hEBdAb6npDlFL8Bwx4dfRLRqAo=

4755github.com/gkampitakis/go-diff v1.3.2 h1:Qyn0J9XJSDTgnsgHRdz9Zp24RaJeKMUHg2+PDZZdC4M=

4856github.com/gkampitakis/go-diff v1.3.2/go.mod h1:LLgOrpqleQe26cte8s36HTWcTmMEur6OPYerdAAS9tk=

4957github.com/gkampitakis/go-snaps v0.5.15 h1:amyJrvM1D33cPHwVrjo9jQxX8g/7E2wYdZ+01KS3zGE=

5058github.com/gkampitakis/go-snaps v0.5.15/go.mod h1:HNpx/9GoKisdhw9AFOBT1N7DBs9DiHo/hGheFGBZ+mc=

59+github.com/go-jose/go-jose/v3 v3.0.4 h1:Wp5HA7bLQcKnf6YYao/4kpRpVMp/yf6+pJKV8WFSaNY=

60+github.com/go-jose/go-jose/v3 v3.0.4/go.mod h1:5b+7YgP7ZICgJDBdfjZaIt+H/9L9T/YQrVfLAMboGkQ=

5161github.com/go-jose/go-jose/v3 v3.0.5 h1:BLLJWbC4nMZOfuPVxoZIxeYsn6Nl2r1fITaJ78UQlVQ=

5262github.com/go-jose/go-jose/v3 v3.0.5/go.mod h1:5b+7YgP7ZICgJDBdfjZaIt+H/9L9T/YQrVfLAMboGkQ=

5363github.com/go-jose/go-jose/v4 v4.1.4 h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA=

5464github.com/go-jose/go-jose/v4 v4.1.4/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=

5565github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=

56−github.com/go-logr/logr v1.4.4 h1:tG4xh9yMsRCAiodLVTxyrkzSZ9+o0L1Kg/+cPVcbP/8=

57−github.com/go-logr/logr v1.4.4/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=

66+github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=

67+github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=

5868github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=

5969github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=

6070github.com/go-task/slim-sprig/v3 v3.0.0 h1:sUs3vkvUymDpBKi3qH1YSqBQk9+9D/8M2mN1vB6EwHI=

6171github.com/go-task/slim-sprig/v3 v3.0.0/go.mod h1:W848ghGpv3Qj3dhTPRyJypKRiqCdHZiAzKg9hl15HA8=

72+github.com/go-viper/mapstructure/v2 v2.4.0 h1:EBsztssimR/CONLSZZ04E8qAkxNYq4Qp9LvH92wZUgs=

73+github.com/go-viper/mapstructure/v2 v2.4.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=

6274github.com/go-viper/mapstructure/v2 v2.5.0 h1:vM5IJoUAy3d7zRSVtIwQgBj7BiWtMPfmPEgAXnvj1Ro=

6375github.com/go-viper/mapstructure/v2 v2.5.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=

6476github.com/goccy/go-yaml v1.18.0 h1:8W7wMFS12Pcas7KU+VVkaiCng+kG8QiFeFwzFb+rwuw=

@@ -72,27 +84,31 @@ github.com/gomodule/redigo v1.7.1-0.20190322064113-39e2c31b7ca3/go.mod h1:B4C85q

7284github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=

7385github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=

7486github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=

75−github.com/google/pprof v0.0.0-20260802141513-ef3492d7dac3 h1:LMLX+LgTNWpfvCBdFebv6EsYotImrt/Ppc5cXIriCSo=

76−github.com/google/pprof v0.0.0-20260802141513-ef3492d7dac3/go.mod h1:jl5iWTm0/hd5PjEYEOuwAJ57L/CibdZfrqZ5XA5GrCk=

87+github.com/google/pprof v0.0.0-20260302011040-a15ffb7f9dcc h1:VBbFa1lDYWEeV5FZKUiYKYT0VxCp9twUmmaq9eb8sXw=

88+github.com/google/pprof v0.0.0-20260302011040-a15ffb7f9dcc/go.mod h1:MxpfABSjhmINe3F1It9d+8exIHFvUqtLIRCdOGNXqiI=

89+github.com/google/pprof v0.0.0-20260402051712-545e8a4df936 h1:EwtI+Al+DeppwYX2oXJCETMO23COyaKGP6fHVpkpWpg=

90+github.com/google/pprof v0.0.0-20260402051712-545e8a4df936/go.mod h1:MxpfABSjhmINe3F1It9d+8exIHFvUqtLIRCdOGNXqiI=

7791github.com/google/s2a-go v0.1.9 h1:LGD7gtMgezd8a/Xak7mEWL0PjoTQFvpRudN895yqKW0=

7892github.com/google/s2a-go v0.1.9/go.mod h1:YA0Ei2ZQL3acow2O62kdp9UlnvMmU7kA6Eutn0dXayM=

7993github.com/google/uuid v1.1.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=

8094github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=

8195github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=

82−github.com/googleapis/enterprise-certificate-proxy v0.3.21 h1:OFdQ3tnCX/zaQ0Cedur3D3z7kI6HiLX9g3TiAN4/DFU=

83−github.com/googleapis/enterprise-certificate-proxy v0.3.21/go.mod h1:L3D/IQExI6LqEjBdXcZQ1WluSgigQmSwBboFstVPM4w=

84−github.com/googleapis/gax-go/v2 v2.23.0 h1:Tchl7qkvE7Ip3y+ztvNufYFvkfqTe7NfLTYGIdJRLuE=

85−github.com/googleapis/gax-go/v2 v2.23.0/go.mod h1:rBQKOVJCdb8IFEzg+FCwlt1LP/xMDGuqUXhUG+XMXEg=

96+github.com/googleapis/enterprise-certificate-proxy v0.3.14 h1:yh8ncqsbUY4shRD5dA6RlzjJaT4hi3kII+zYw8wmLb8=

97+github.com/googleapis/enterprise-certificate-proxy v0.3.14/go.mod h1:vqVt9yG9480NtzREnTlmGSBmFrA+bzb0yl0TxoBQXOg=

98+github.com/googleapis/gax-go/v2 v2.19.0 h1:fYQaUOiGwll0cGj7jmHT/0nPlcrZDFPrZRhTsoCr8hE=

99+github.com/googleapis/gax-go/v2 v2.19.0/go.mod h1:w2ROXVdfGEVFXzmlciUU4EdjHgWvB5h2n6x/8XSTTJA=

100+github.com/googleapis/gax-go/v2 v2.21.0 h1:h45NjjzEO3faG9Lg/cFrBh2PgegVVgzqKzuZl/wMbiI=

101+github.com/googleapis/gax-go/v2 v2.21.0/go.mod h1:But/NJU6TnZsrLai/xBAQLLz+Hc7fHZJt/hsCz3Fih4=

86102github.com/gorilla/mux v1.8.1 h1:TuBL49tXwgrFYWhqrNgrUNEY92u81SPhu7sTdzQEiWY=

87103github.com/gorilla/mux v1.8.1/go.mod h1:AKf9I4AEqPTmMytcMc0KkNouC66V3BtZ4qD5fmWSiMQ=

88104github.com/joshdk/go-junit v1.0.0 h1:S86cUKIdwBHWwA6xCmFlf3RTLfVXYQfvanM5Uh+K6GE=

89105github.com/joshdk/go-junit v1.0.0/go.mod h1:TiiV0PqkaNfFXjEiyjWM3XXrhVyCa1K4Zfga6W52ung=

90106github.com/justinas/alice v1.2.0 h1:+MHSA/vccVCF4Uq37S42jwlkvI2Xzl7zTPCN5BnZNVo=

91107github.com/justinas/alice v1.2.0/go.mod h1:fN5HRH/reO/zrUflLfTN43t3vXvKzvZIENsNEe7i7qA=

92−github.com/klauspost/compress v1.19.1 h1:VsB4HPswih7mmZ8WleSFQ75c/Ui1M4trX5oAsJnhSlk=

93−github.com/klauspost/compress v1.19.1/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=

94−github.com/klauspost/cpuid/v2 v2.2.10 h1:tBs3QSyvjDyFTq3uoc/9xFpCuOsJQFNPiAhYdw2skhE=

95−github.com/klauspost/cpuid/v2 v2.2.10/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0=

108+github.com/klauspost/compress v1.18.0 h1:c/Cqfb0r+Yi+JtIEq73FWXVkRonBlf0CRNYc8Zttxdo=

109+github.com/klauspost/compress v1.18.0/go.mod h1:2Pp+KzxcywXVXMr50+X0Q/Lsb43OQHYWRCY2AiWywWQ=

110+github.com/klauspost/cpuid/v2 v2.0.9 h1:lgaqFMSdTdQYdZ04uHyN2d/eKdOMyi2YLSvlQIBFYa4=

111+github.com/klauspost/cpuid/v2 v2.0.9/go.mod h1:FInQzS24/EEf25PyTYn52gqo7WaD8xa0213Md/qVLRg=

96112github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=

97113github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=

98114github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=

@@ -109,25 +125,29 @@ github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq

109125github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=

110126github.com/oauth2-proxy/mockoidc v0.0.0-20240214162133-caebfff84d25 h1:9bCMuD3TcnjeqjPT2gSlha4asp8NvgcFRYExCaikCxk=

111127github.com/oauth2-proxy/mockoidc v0.0.0-20240214162133-caebfff84d25/go.mod h1:eDjgYHYDJbPLBLsyZ6qRaugP0mX8vePOhZ5id1fdzJw=

112−github.com/onsi/ginkgo/v2 v2.32.1 h1:6tlvcDm/3sE8lGJbZ4+d4mO3RLy24/tQWOFzVSQNIfw=

113−github.com/onsi/ginkgo/v2 v2.32.1/go.mod h1:+aXOY+vzZ5mu2iI2HpTZUPmM//oQfsNFX6gU9kNcA44=

114−github.com/onsi/gomega v1.42.1 h1:iN1rCUX+44NZ1Dc97MPoeFYbFR0vh8zxoxMFwKdyZ6I=

115−github.com/onsi/gomega v1.42.1/go.mod h1:REff/hsDsodHoKlWsP2mAPhu1+5/6hVYNf9rIEBpeSg=

116−github.com/pelletier/go-toml/v2 v2.4.3 h1:GTRvJQutkOSftxIFD5xw9aepkYNuPWmVJpffdDPYVpY=

117−github.com/pelletier/go-toml/v2 v2.4.3/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=

118−github.com/pierrec/lz4/v4 v4.1.28 h1:pPEPwRJ4kybBTfGt28q7lQsRJQHhC08axprdLD5Ppio=

119−github.com/pierrec/lz4/v4 v4.1.28/go.mod h1:EoQMVJgeeEOMsCqCzqFm2O0cJvljX2nGZjcRIPL34O4=

128+github.com/onsi/ginkgo/v2 v2.28.1 h1:S4hj+HbZp40fNKuLUQOYLDgZLwNUVn19N3Atb98NCyI=

129+github.com/onsi/ginkgo/v2 v2.28.1/go.mod h1:CLtbVInNckU3/+gC8LzkGUb9oF+e8W8TdUsxPwvdOgE=

130+github.com/onsi/gomega v1.39.1 h1:1IJLAad4zjPn2PsnhH70V4DKRFlrCzGBNrNaru+Vf28=

131+github.com/onsi/gomega v1.39.1/go.mod h1:hL6yVALoTOxeWudERyfppUcZXjMwIMLnuSfruD2lcfg=

132+github.com/pelletier/go-toml/v2 v2.2.4 h1:mye9XuhQ6gvn5h28+VilKrrPoQVanw5PMw/TB0t5Ec4=

133+github.com/pelletier/go-toml/v2 v2.2.4/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=

134+github.com/pelletier/go-toml/v2 v2.3.0 h1:k59bC/lIZREW0/iVaQR8nDHxVq8OVlIzYCOJf421CaM=

135+github.com/pelletier/go-toml/v2 v2.3.0/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=

136+github.com/pierrec/lz4/v4 v4.1.26 h1:GrpZw1gZttORinvzBdXPUXATeqlJjqUG/D87TKMnhjY=

137+github.com/pierrec/lz4/v4 v4.1.26/go.mod h1:EoQMVJgeeEOMsCqCzqFm2O0cJvljX2nGZjcRIPL34O4=

120138github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=

121−github.com/prometheus/client_golang v1.24.1 h1:JnJkREXzWxUdCuPFpIWZiPispT9xVV59uiuyR2bPlnU=

122−github.com/prometheus/client_golang v1.24.1/go.mod h1:F+oSRECHg4sse5ucfYpYDeIv/hu68Zo0uoHKetWnzcE=

139+github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=

140+github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=

141+github.com/prometheus/client_golang v1.23.2 h1:Je96obch5RDVy3FDMndoUsjAhG5Edi49h0RJWRi/o0o=

142+github.com/prometheus/client_golang v1.23.2/go.mod h1:Tb1a6LWHB3/SPIzCoaDXI4I8UHKeFTEQ1YCr+0Gyqmg=

123143github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk=

124144github.com/prometheus/client_model v0.6.2/go.mod h1:y3m2F6Gdpfy6Ut/GBsUqTWZqCUvMVzSfMLjcu6wAwpE=

125−github.com/prometheus/common v0.70.1 h1:1HvjP4D5oL3t8RsPlwxA9onvvStjtIHYE5XuuwOi/PY=

126−github.com/prometheus/common v0.70.1/go.mod h1:VdFUQDMZK3VLkurFUVhia6uys/0suUp86TJz5qbJRhc=

127−github.com/prometheus/procfs v0.21.1 h1:GljZCt+zSTS+NZq88cyQ1LjZ+RCHp3uVuabBWA5+OJI=

128−github.com/prometheus/procfs v0.21.1/go.mod h1:aB55Cww9pdSJVHk0hUf0inxWyyjPogFIjmHKYgMKmtY=

129−github.com/redis/go-redis/v9 v9.22.0 h1:laDvpYXTJtZLloinw1fA5Kqd6HAEH2XKxOkG/PDq2F0=

130−github.com/redis/go-redis/v9 v9.22.0/go.mod h1:y2g0Wj8rQvuK0ELM+oxSudcLtC09JScs98I/X9gRWY4=

145+github.com/prometheus/common v0.67.5 h1:pIgK94WWlQt1WLwAC5j2ynLaBRDiinoAb86HZHTUGI4=

146+github.com/prometheus/common v0.67.5/go.mod h1:SjE/0MzDEEAyrdr5Gqc6G+sXI67maCxzaT3A2+HqjUw=

147+github.com/prometheus/procfs v0.20.1 h1:XwbrGOIplXW/AU3YhIhLODXMJYyC1isLFfYCsTEycfc=

148+github.com/prometheus/procfs v0.20.1/go.mod h1:o9EMBZGRyvDrSPH1RqdxhojkuXstoe4UlK79eF5TGGo=

149+github.com/redis/go-redis/v9 v9.18.0 h1:pMkxYPkEbMPwRdenAzUNyFNrDgHx9U+DrBabWNfSRQs=

150+github.com/redis/go-redis/v9 v9.18.0/go.mod h1:k3ufPphLU5YXwNTUcCRXGxUoF1fqxnhFQmscfkCoDA0=

131151github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=

132152github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=

133153github.com/sagikazarmark/locafero v0.12.0 h1:/NQhBAkUb4+fH1jivKHWusDYFjMOOKU88eegjfxfHb4=

@@ -142,8 +162,8 @@ github.com/spf13/viper v1.21.0 h1:x5S+0EU27Lbphp4UKm1C+1oQO+rKx36vfCoaVebLFSU=

142162github.com/spf13/viper v1.21.0/go.mod h1:P0lhsswPGWD/1lZJ9ny3fYnVqxiegrlNrEmgLjbTCAY=

143163github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=

144164github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=

145−github.com/stretchr/testify v1.12.0 h1:K6Mr6jO9JICuend/5xzTM03ydSV3vdNRYAdPSukj8uI=

146−github.com/stretchr/testify v1.12.0/go.mod h1:bOYBZb5qJ00vPzWfIqBUZPaxK8jWiXc6d3ErP4Ca9Gw=

165+github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=

166+github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=

147167github.com/subosito/gotenv v1.6.0 h1:9NlTDc1FTs4qu0DDq7AEtTPNw6SVm7uBMsUCUjABIf8=

148168github.com/subosito/gotenv v1.6.0/go.mod h1:Dk4QP5c2W3ibzajGcXpNraDfq2IrhjMIvMSWPKKo0FU=

149169github.com/tidwall/gjson v1.18.0 h1:FIDeeyB800efLX89e5a8Y0BNH+LOngJyGrIWxG2FKQY=

@@ -161,57 +181,74 @@ github.com/vmihailenco/tagparser/v2 v2.0.0/go.mod h1:Wri+At7QHww0WTrCBeu4J6bNtoV

161181github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=

162182github.com/yuin/gopher-lua v0.0.0-20190206043414-8bfc7677f583/go.mod h1:gqRgreBUhTSL0GeU64rtZ3Uq3wtjOa/TB2YfrtkCbVQ=

163183github.com/yuin/gopher-lua v0.0.0-20191213034115-f46add6fdb5c/go.mod h1:gqRgreBUhTSL0GeU64rtZ3Uq3wtjOa/TB2YfrtkCbVQ=

164−github.com/yuin/gopher-lua v1.1.2 h1:yF/FjE3hD65tBbt0VXLE13HWS9h34fdzJmrWRXwobGA=

165−github.com/yuin/gopher-lua v1.1.2/go.mod h1:7aRmXIWl37SqRf0koeyylBEzJ+aPt8A+mmkQ4f1ntR8=

166−github.com/zeebo/xxh3 v1.1.0 h1:s7DLGDK45Dyfg7++yxI0khrfwq9661w9EN78eP/UZVs=

167−github.com/zeebo/xxh3 v1.1.0/go.mod h1:IisAie1LELR4xhVinxWS5+zf1lA4p0MW4T+w+W07F5s=

184+github.com/yuin/gopher-lua v1.1.1 h1:kYKnWBjvbNP4XLT3+bPEwAXJx262OhaHDWDVOPjL46M=

185+github.com/yuin/gopher-lua v1.1.1/go.mod h1:GBR0iDaNXjAgGg9zfCvksxSRnQx76gclCIb7kdAd1Pw=

186+github.com/zeebo/xxh3 v1.0.2 h1:xZmwmqxHZA8AI603jOQ0tMqmBr9lPeFwGg6d+xy9DC0=

187+github.com/zeebo/xxh3 v1.0.2/go.mod h1:5NWz9Sef7zIDm2JHfFlcQvNekmcEl9ekUZQQKCYaDcA=

168188go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=

169189go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=

190+go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0 h1:q4XOmH/0opmeuJtPsbFNivyl7bCt7yRBbeEm2sC/XtQ=

191+go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0/go.mod h1:snMWehoOh2wsEwnvvwtDyFCxVeDAODenXHtn5vzrKjo=

170192go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.67.0 h1:yI1/OhfEPy7J9eoa6Sj051C7n5dvpj0QX8g4sRchg04=

171−go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.67.0/go.mod h1:NoUCKYWK+3ecatC4HjkRktREheMeEtrXoQxrqYFeHSc=

172−go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.70.0 h1:LMuyCAyfalSjDyjdC65nK6N0zoTT63+E/u95X0JovZI=

173−go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.70.0/go.mod h1:085m8qbm4hgc8rZWGDEa4vmyyo2c3nPxUslYUKUIU04=

174−go.opentelemetry.io/otel v1.45.0 h1:pdrWmLHofpubmArBv1LgFSv1Z0Ie/ppdZzu+kUN5EeU=

175−go.opentelemetry.io/otel v1.45.0/go.mod h1:XZxIqPapzEYnhNSScF5DIqXhm/rYi0FzCe2XddAwZfQ=

176−go.opentelemetry.io/otel/metric v1.45.0 h1:7Eg1uH7CJ5cXv9is6tnBe1FI6rj1nwUdbFypRm3br/M=

177−go.opentelemetry.io/otel/metric v1.45.0/go.mod h1:HAPbm1nd3p1PmFH7v2dR+6BjXxw+Lq4a2+pndMAm08s=

178−go.opentelemetry.io/otel/sdk v1.45.0 h1:4VVSMgQ83dUgW2aoX5f6JgLvHwIvzcuLnF9lUdCSpCw=

179−go.opentelemetry.io/otel/sdk v1.45.0/go.mod h1:Sr40LgXV7DsKMMJMKOhUWOgMWTfAaqvm2kF0g7ilwuA=

180−go.opentelemetry.io/otel/sdk/metric v1.45.0 h1:oVFszMfyj1Am6s24Vtc7wBb8BKLcwepJjNEYILuiE3o=

181−go.opentelemetry.io/otel/sdk/metric v1.45.0/go.mod h1:vUWUxDZvu1WVRj8JA8S0AdhsPrZoDpA2DdZauIh4mDA=

182−go.opentelemetry.io/otel/trace v1.45.0 h1:l/mP6Uv7oNO7/TblbhpbgMidxhq1uO/rPsikOyVhxag=

183−go.opentelemetry.io/otel/trace v1.45.0/go.mod h1:qoJJA2xNMnxRrdISU/kLtfUH2wNeQbiv+jhs/CxI8bc=

193+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0 h1:OyrsyzuttWTSur2qN/Lm0m2a8yqyIjUVBZcxFPuXq2o=

194+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0/go.mod h1:C2NGBr+kAB4bk3xtMXfZ94gqFDtg/GkI7e9zqGh5Beg=

195+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.68.0 h1:CqXxU8VOmDefoh0+ztfGaymYbhdB/tT3zs79QaZTNGY=

196+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.68.0/go.mod h1:BuhAPThV8PBHBvg8ZzZ/Ok3idOdhWIodywz2xEcRbJo=

197+go.opentelemetry.io/otel v1.42.0 h1:lSQGzTgVR3+sgJDAU/7/ZMjN9Z+vUip7leaqBKy4sho=

198+go.opentelemetry.io/otel v1.42.0/go.mod h1:lJNsdRMxCUIWuMlVJWzecSMuNjE7dOYyWlqOXWkdqCc=

199+go.opentelemetry.io/otel v1.43.0 h1:mYIM03dnh5zfN7HautFE4ieIig9amkNANT+xcVxAj9I=

200+go.opentelemetry.io/otel v1.43.0/go.mod h1:JuG+u74mvjvcm8vj8pI5XiHy1zDeoCS2LB1spIq7Ay0=

201+go.opentelemetry.io/otel/metric v1.42.0 h1:2jXG+3oZLNXEPfNmnpxKDeZsFI5o4J+nz6xUlaFdF/4=

202+go.opentelemetry.io/otel/metric v1.42.0/go.mod h1:RlUN/7vTU7Ao/diDkEpQpnz3/92J9ko05BIwxYa2SSI=

203+go.opentelemetry.io/otel/metric v1.43.0 h1:d7638QeInOnuwOONPp4JAOGfbCEpYb+K6DVWvdxGzgM=

204+go.opentelemetry.io/otel/metric v1.43.0/go.mod h1:RDnPtIxvqlgO8GRW18W6Z/4P462ldprJtfxHxyKd2PY=

205+go.opentelemetry.io/otel/sdk v1.42.0 h1:LyC8+jqk6UJwdrI/8VydAq/hvkFKNHZVIWuslJXYsDo=

206+go.opentelemetry.io/otel/sdk v1.42.0/go.mod h1:rGHCAxd9DAph0joO4W6OPwxjNTYWghRWmkHuGbayMts=

207+go.opentelemetry.io/otel/sdk v1.43.0 h1:pi5mE86i5rTeLXqoF/hhiBtUNcrAGHLKQdhg4h4V9Dg=

208+go.opentelemetry.io/otel/sdk/metric v1.42.0 h1:D/1QR46Clz6ajyZ3G8SgNlTJKBdGp84q9RKCAZ3YGuA=

209+go.opentelemetry.io/otel/sdk/metric v1.42.0/go.mod h1:Ua6AAlDKdZ7tdvaQKfSmnFTdHx37+J4ba8MwVCYM5hc=

210+go.opentelemetry.io/otel/sdk/metric v1.43.0 h1:S88dyqXjJkuBNLeMcVPRFXpRw2fuwdvfCGLEo89fDkw=

211+go.opentelemetry.io/otel/trace v1.42.0 h1:OUCgIPt+mzOnaUTpOQcBiM/PLQ/Op7oq6g4LenLmOYY=

212+go.opentelemetry.io/otel/trace v1.42.0/go.mod h1:f3K9S+IFqnumBkKhRJMeaZeNk9epyhnCmQh/EysQCdc=

213+go.opentelemetry.io/otel/trace v1.43.0 h1:BkNrHpup+4k4w+ZZ86CZoHHEkohws8AY+WTX09nk+3A=

214+go.opentelemetry.io/otel/trace v1.43.0/go.mod h1:/QJhyVBUUswCphDVxq+8mld+AvhXZLhe+8WVFxiFff0=

184215go.uber.org/atomic v1.11.0 h1:ZvwS0R+56ePWxUNi+Atn9dWONBPp/AUETXlHW0DxSjE=

185216go.uber.org/atomic v1.11.0/go.mod h1:LUxbIzbOniOlMKjJjyPfpl4v+PKK2cNJn91OQbhoJI0=

186217go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=

187218go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=

188219go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ=

189220go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ=

190−go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=

191−go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=

221+go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=

222+go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=

192223golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=

193224golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=

194225golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=

195−golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M=

196−golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis=

226+golang.org/x/crypto v0.49.0 h1:+Ng2ULVvLHnJ/ZFEq4KdcDd/cfjrrjjNSXNzxg0Y4U4=

227+golang.org/x/crypto v0.49.0/go.mod h1:ErX4dUh2UM+CFYiXZRTcMpEcN8b/1gxEuv3nODoYtCA=

228+golang.org/x/crypto v0.50.0 h1:zO47/JPrL6vsNkINmLoo/PH1gcxpls50DNogFvB5ZGI=

229+golang.org/x/crypto v0.50.0/go.mod h1:3muZ7vA7PBCE6xgPX7nkzzjiUq87kRItoJQM1Yo8S+Q=

197230golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=

198231golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=

199−golang.org/x/mod v0.40.0 h1:hUv+3cXcdRHz08UmSiOob7sadHig73uo5bkXxQ/tvUs=

200−golang.org/x/mod v0.40.0/go.mod h1:0/weTWkPWGBikyTWAX3dkjVztMmBA5hM0DH6BElSupE=

232+golang.org/x/mod v0.34.0 h1:xIHgNUUnW6sYkcM5Jleh05DvLOtwc6RitGHbDk4akRI=

233+golang.org/x/mod v0.34.0/go.mod h1:ykgH52iCZe79kzLLMhyCUzhMci+nQj+0XkbXpNYtVjY=

234+golang.org/x/mod v0.35.0 h1:Ww1D637e6Pg+Zb2KrWfHQUnH2dQRLBQyAtpr/haaJeM=

235+golang.org/x/mod v0.35.0/go.mod h1:+GwiRhIInF8wPm+4AoT6L0FA1QWAad3OMdTRx4tFYlU=

201236golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=

202237golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=

203238golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=

204239golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=

205240golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=

206−golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To=

207−golang.org/x/net v0.58.0/go.mod h1:YwCddHnFlT7eLQqVprV19OnhLGtc5xOKgE0RyqgfWAU=

241+golang.org/x/net v0.52.0 h1:He/TN1l0e4mmR3QqHMT2Xab3Aj3L9qjbhRm78/6jrW0=

242+golang.org/x/net v0.52.0/go.mod h1:R1MAz7uMZxVMualyPXb+VaqGSa3LIaUqk0eEt3w36Sw=

243+golang.org/x/net v0.53.0 h1:d+qAbo5L0orcWAr0a9JweQpjXF19LMXJE8Ey7hwOdUA=

244+golang.org/x/net v0.53.0/go.mod h1:JvMuJH7rrdiCfbeHoo3fCQU24Lf5JJwT9W3sJFulfgs=

208245golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=

209246golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=

210247golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=

211248golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=

212249golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=

213−golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=

214−golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=

250+golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=

251+golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=

215252golang.org/x/sys v0.0.0-20190204203706-41f3e6584952/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=

216253golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=

217254golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=

@@ -221,8 +258,10 @@ golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBc

221258golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=

222259golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=

223260golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=

224−golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=

225−golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=

261+golang.org/x/sys v0.42.0 h1:omrd2nAlyT5ESRdCLYdm3+fMfNFE/+Rf4bDIQImRJeo=

262+golang.org/x/sys v0.42.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=

263+golang.org/x/sys v0.43.0 h1:Rlag2XtaFTxp19wS8MXlJwTvoh8ArU6ezoyFsMyCTNI=

264+golang.org/x/sys v0.43.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=

226265golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=

227266golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=

228267golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=

@@ -234,31 +273,44 @@ golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=

234273golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=

235274golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=

236275golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=

237−golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=

238−golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=

276+golang.org/x/text v0.35.0 h1:JOVx6vVDFokkpaq1AEptVzLTpDe9KGpj5tR4/X+ybL8=

277+golang.org/x/text v0.35.0/go.mod h1:khi/HExzZJ2pGnjenulevKNX1W67CUy0AsXcNubPGCA=

278+golang.org/x/text v0.36.0 h1:JfKh3XmcRPqZPKevfXVpI1wXPTqbkE5f7JA92a55Yxg=

279+golang.org/x/text v0.36.0/go.mod h1:NIdBknypM8iqVmPiuco0Dh6P5Jcdk8lJL0CUebqK164=

239280golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=

240281golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=

241282golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=

242283golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=

243284golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=

244285golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=

245−golang.org/x/tools v0.49.0 h1:3NI7VXzL9+1WZD52Dx2ttoPwD5DWrFGpl9mFZDlmisI=

246−golang.org/x/tools v0.49.0/go.mod h1:SJNXV9DBKT0UbdttsQjbfJlAE/q+y36++zo3uL3N0Oo=

286+golang.org/x/tools v0.43.0 h1:12BdW9CeB3Z+J/I/wj34VMl8X+fEXBxVR90JeMX5E7s=

287+golang.org/x/tools v0.43.0/go.mod h1:uHkMso649BX2cZK6+RpuIPXS3ho2hZo4FVwfoy1vIk0=

288+golang.org/x/tools v0.44.0 h1:UP4ajHPIcuMjT1GqzDWRlalUEoY+uzoZKnhOjbIPD2c=

289+golang.org/x/tools v0.44.0/go.mod h1:KA0AfVErSdxRZIsOVipbv3rQhVXTnlU6UhKxHd1seDI=

247290golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=

291+gonum.org/v1/gonum v0.16.0 h1:5+ul4Swaf3ESvrOnidPp4GZbzf0mxVQpDCYUQE7OJfk=

292+gonum.org/v1/gonum v0.16.0/go.mod h1:fef3am4MQ93R2HHpKnLk4/Tbh/s0+wqD5nfa6Pnwy4E=

248293gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4=

249−gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E=

250−google.golang.org/api v0.293.0 h1:p9XIWOf63U4OgYx120ZwVU8+vl4XTPmWfgVPnmOAS9w=

251−google.golang.org/api v0.293.0/go.mod h1:6n5tjEB1gzwniZTepZ0g5u+wM7Bof5GeULCx/zh8ZE0=

294+google.golang.org/api v0.272.0 h1:eLUQZGnAS3OHn31URRf9sAmRk3w2JjMx37d2k8AjJmA=

295+google.golang.org/api v0.272.0/go.mod h1:wKjowi5LNJc5qarNvDCvNQBn3rVK8nSy6jg2SwRwzIA=

296+google.golang.org/api v0.275.0 h1:vfY5d9vFVJeWEZT65QDd9hbndr7FyZ2+6mIzGAh71NI=

297+google.golang.org/api v0.275.0/go.mod h1:Fnag/EWUPIcJXuIkP1pjoTgS5vdxlk3eeemL7Do6bvw=

298+google.golang.org/genproto v0.0.0-20260316180232-0b37fe3546d5 h1:JNfk58HZ8lfmXbYK2vx/UvsqIL59TzByCxPIX4TDmsE=

299+google.golang.org/genproto v0.0.0-20260316180232-0b37fe3546d5/go.mod h1:x5julN69+ED4PcFk/XWayw35O0lf/nGa4aNgODCmNmw=

252300google.golang.org/genproto v0.0.0-20260319201613-d00831a3d3e7 h1:XzmzkmB14QhVhgnawEVsOn6OFsnpyxNPRY9QV01dNB0=

253−google.golang.org/genproto v0.0.0-20260319201613-d00831a3d3e7/go.mod h1:L43LFes82YgSonw6iTXTxXUX1OlULt4AQtkik4ULL/I=

254−google.golang.org/genproto/googleapis/api v0.0.0-20260630182238-925bb5da69e7 h1:jQ9p21COKWjP3VwuFrNRiiOTMh3mPpN45R7SLrH/HUU=

255−google.golang.org/genproto/googleapis/api v0.0.0-20260630182238-925bb5da69e7/go.mod h1:KqHwBx2upmfa1XSi1WuRvC+2VGCLtooKkfmyvRbUmqA=

256−google.golang.org/genproto/googleapis/rpc v0.0.0-20260817212433-ac3dfec99bb1 h1:utmqiUzZAEINbLmRyAt1QjVkMyLQ+lvIwCpLaB1rZfw=

257−google.golang.org/genproto/googleapis/rpc v0.0.0-20260817212433-ac3dfec99bb1/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=

258−google.golang.org/grpc v1.83.0 h1:JeNZEKJFbQxArAMl+hiytHauacDNqJUllNfmIMmpqnQ=

259−google.golang.org/grpc v1.83.0/go.mod h1:kDyl6SKsiHKt0uylY5gtn5cEjkrIOhQOGDgIc4JGwzQ=

260−google.golang.org/protobuf v1.36.12 h1:pJOKDDOyeXErUroCihFAd5LQuwXBSpVnKGrj5o/fwxc=

261−google.golang.org/protobuf v1.36.12/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=

301+google.golang.org/genproto/googleapis/api v0.0.0-20260316180232-0b37fe3546d5 h1:CogIeEXn4qWYzzQU0QqvYBM8yDF9cFYzDq9ojSpv0Js=

302+google.golang.org/genproto/googleapis/api v0.0.0-20260316180232-0b37fe3546d5/go.mod h1:EIQZ5bFCfRQDV4MhRle7+OgjNtZ6P1PiZBgAKuxXu/Y=

303+google.golang.org/genproto/googleapis/api v0.0.0-20260319201613-d00831a3d3e7 h1:41r6JMbpzBMen0R/4TZeeAmGXSJC7DftGINUodzTkPI=

304+google.golang.org/genproto/googleapis/rpc v0.0.0-20260319201613-d00831a3d3e7 h1:ndE4FoJqsIceKP2oYSnUZqhTdYufCYYkqwtFzfrhI7w=

305+google.golang.org/genproto/googleapis/rpc v0.0.0-20260319201613-d00831a3d3e7/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=

306+google.golang.org/genproto/googleapis/rpc v0.0.0-20260406210006-6f92a3bedf2d h1:wT2n40TBqFY6wiwazVK9/iTWbsQrgk5ZfCSVFLO9LQA=

307+google.golang.org/genproto/googleapis/rpc v0.0.0-20260406210006-6f92a3bedf2d/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=

308+google.golang.org/grpc v1.79.3 h1:sybAEdRIEtvcD68Gx7dmnwjZKlyfuc61Dyo9pGXXkKE=

309+google.golang.org/grpc v1.79.3/go.mod h1:KmT0Kjez+0dde/v2j9vzwoAScgEPx/Bw1CYChhHLrHQ=

310+google.golang.org/grpc v1.80.0 h1:Xr6m2WmWZLETvUNvIUmeD5OAagMw3FiKmMlTdViWsHM=

311+google.golang.org/grpc v1.80.0/go.mod h1:ho/dLnxwi3EDJA4Zghp7k2Ec1+c2jqup0bFkw07bwF4=

312+google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=

313+google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=

262314gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=

263315gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=

264316gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=

@@ -267,5 +319,5 @@ gopkg.in/natefinch/lumberjack.v2 v2.2.1/go.mod h1:YD8tP3GAjkrDg1eZH7EGmyESg/lsYs

267319gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=

268320gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=

269321gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=

270−k8s.io/apimachinery v0.36.3 h1:PkzMRBRG8joFD8EhCuQAtNPvJlxb82FwplP26HIzvAM=

271−k8s.io/apimachinery v0.36.3/go.mod h1:cTSjBWgPe/6CQyBKzY/hDIRWCQQQeK0mfLbml0UYFHE=

322+k8s.io/apimachinery v0.35.3 h1:MeaUwQCV3tjKP4bcwWGgZ/cp/vpsRnQzqO6J6tJyoF8=

323+k8s.io/apimachinery v0.35.3/go.mod h1:jQCgFZFR1F4Ik7hvr2g84RTJSZegBc8yHgFWKn//hns=

pkg/apis/options/load_test.go+1−1

@@ -282,7 +282,7 @@ var _ = Describe("Load", func() {

282282 Entry("with an invalid config file", &testOptionsTableInput{

283283 configFile: []byte(`slice_option = foo`),

284284 flagSet: func() *pflag.FlagSet { return testOptionsFlagSet },

285− expectedErr: fmt.Errorf("unable to load config file: While parsing config: toml: expected keyword \"false\""),

285+ expectedErr: fmt.Errorf("unable to load config file: While parsing config: toml: expected 'false'"),

286286 expectedOutput: &TestOptions{},

287287 }),

288288 Entry("with an invalid flagset", &testOptionsTableInput{

pkg/apis/options/providers.go−6

@@ -151,9 +151,6 @@ const (

151151 // ADFSProvider is the provider type for ADFS

152152 ADFSProvider ProviderType = "adfs"

153153

154− // AtlassianProvider is the provider type for Atlassian Cloud

155− AtlassianProvider ProviderType = "atlassian"

156−

157154 // AzureProvider is the provider type for Azure

158155 AzureProvider ProviderType = "azure"

159156

@@ -169,9 +166,6 @@ const (

169166 // DigitalOceanProvider is the provider type for DigitalOcean

170167 DigitalOceanProvider ProviderType = "digitalocean"

171168

172− // DTTSSOProvider is the provider type for the DTT SSO

173− DTTSSOProvider ProviderType = "dtt-sso"

174−

175169 // FacebookProvider is the provider type for Facebook

176170 FacebookProvider ProviderType = "facebook"

177171

pkg/apis/options/upstreams.go+5−7

@@ -62,14 +62,12 @@ type Upstream struct {

6262

6363 // Path is used to map requests to the upstream server.

6464 // The closest match will take precedence and all Paths must be unique.

65− // Without RewriteTarget, Path follows gorilla/mux route syntax.

65+ // Path can also take a pattern when used with RewriteTarget.

66+ // Path segments can be captured and matched using regular experessions.

6667 // Eg:

67− // - `/foo`: Match only the explicit path `/foo`

68− // - `/bar/`: Match any path prefixed with `/bar/`

69− // - `/baz/{path:.*}`: Match any path prefixed with `/baz/`

70− // When RewriteTarget is set, Path is treated as a regular expression.

71− // Eg: `^/baz/(.*)$` matches any path prefixed with `/baz` and captures the

72− // remaining path for use with RewriteTarget.

68+ // - `^/foo$`: Match only the explicit path `/foo`

69+ // - `^/bar/$`: Match any path prefixed with `/bar/`

70+ // - `^/baz/(.*)$`: Match any path prefixed with `/baz` and capture the remaining path for use with RewriteTarget

7371 Path string `yaml:"path,omitempty"`

7472

7573 // RewriteTarget allows users to rewrite the request path before it is sent to

pkg/upstream/http.go+16−55

@@ -123,7 +123,7 @@ func (t *unixRoundTripper) RoundTrip(req *http.Request) (*http.Response, error)

123123// The proxy should render an error page if there are failures connecting to the

124124// upstream server.

125125func newReverseProxy(target *url.URL, upstream options.Upstream, errorHandler ProxyErrorHandler) http.Handler {

126− proxy := newSingleHostReverseProxy(target)

126+ proxy := httputil.NewSingleHostReverseProxy(target)

127127

128128 // Inherit default transport options from Go's stdlib

129129 transport := http.DefaultTransport.(*http.Transport).Clone()

@@ -155,7 +155,7 @@ func newReverseProxy(target *url.URL, upstream options.Upstream, errorHandler Pr

155155 }

156156

157157 // Ensure we always pass the original request path

158− setProxyRewrite(proxy)

158+ setProxyDirector(proxy)

159159

160160 // TODO (@tuunit) - this should be inverted or get a better name in the future to set the upstream host header

161161 // only if PassHostHeader is explicitly set to true. Currently this would be a breaking change.

@@ -179,71 +179,32 @@ func newReverseProxy(target *url.URL, upstream options.Upstream, errorHandler Pr

179179 return proxy

180180}

181181

182−func newSingleHostReverseProxy(target *url.URL) *httputil.ReverseProxy {

183− return &httputil.ReverseProxy{

184− Rewrite: func(proxyReq *httputil.ProxyRequest) {

185− proxyReq.SetURL(target)

186− proxyReq.Out.Host = proxyReq.In.Host

187− setProxyForwardingHeaders(proxyReq)

188− },

189− }

190−}

191−

192−// setProxyUpstreamHostHeader sets the proxy.Rewrite so that upstream requests

182+// setProxyUpstreamHostHeader sets the proxy.Director so that upstream requests

193183// receive a host header matching the target URL.

194184func setProxyUpstreamHostHeader(proxy *httputil.ReverseProxy, target *url.URL) {

195− rewrite := proxy.Rewrite

196− proxy.Rewrite = func(proxyReq *httputil.ProxyRequest) {

197− rewrite(proxyReq)

198− proxyReq.Out.Host = target.Host

185+ director := proxy.Director

186+ proxy.Director = func(req *http.Request) {

187+ director(req)

188+ req.Host = target.Host

199189 }

200190}

201191

202−// setProxyRewrite sets the proxy.Rewrite so that request URIs are escaped

192+// setProxyDirector sets the proxy.Director so that request URIs are escaped

203193// when proxying to usptream servers.

204−func setProxyRewrite(proxy *httputil.ReverseProxy) {

205− rewrite := proxy.Rewrite

206− proxy.Rewrite = func(proxyReq *httputil.ProxyRequest) {

207− rewrite(proxyReq)

194+func setProxyDirector(proxy *httputil.ReverseProxy) {

195+ director := proxy.Director

196+ proxy.Director = func(req *http.Request) {

197+ director(req)

208198 // use RequestURI so that we aren't unescaping encoded slashes in the request path

209− proxyReq.Out.URL.Opaque = proxyReq.In.RequestURI

210− proxyReq.Out.URL.RawQuery = ""

211− proxyReq.Out.URL.ForceQuery = false

212− }

213−}

214−

215−func setProxyForwardingHeaders(proxyReq *httputil.ProxyRequest) {

216− // TODO (@tuunit): Preserve the legacy Director-based forwarding header behavior

217− // for backwards compatibility. Harden this with saner defaults and/or

218− // explicit flags in the future.

219− for _, header := range []string{"Forwarded", "X-Forwarded-Host", "X-Forwarded-Proto"} {

220− if values, ok := proxyReq.In.Header[header]; ok {

221− proxyReq.Out.Header[header] = append([]string(nil), values...)

222− }

223− }

224−

225− prior, ok := proxyReq.In.Header["X-Forwarded-For"]

226− if ok {

227− proxyReq.Out.Header["X-Forwarded-For"] = append([]string(nil), prior...)

228− }

229−

230− clientIP, _, err := net.SplitHostPort(proxyReq.In.RemoteAddr)

231− if err != nil {

232− return

233− }

234−

235− omit := ok && prior == nil

236− if len(prior) > 0 {

237− clientIP = strings.Join(prior, ", ") + ", " + clientIP

238− }

239− if !omit {

240− proxyReq.Out.Header.Set("X-Forwarded-For", clientIP)

199+ req.URL.Opaque = req.RequestURI

200+ req.URL.RawQuery = ""

201+ req.URL.ForceQuery = false

241202 }

242203}

243204

244205// newWebSocketReverseProxy creates a new reverse proxy for proxying websocket connections.

245206func newWebSocketReverseProxy(u *url.URL, skipTLSVerify *bool, passHostHeader *bool) http.Handler {

246− wsProxy := newSingleHostReverseProxy(u)

207+ wsProxy := httputil.NewSingleHostReverseProxy(u)

247208

248209 // Inherit default transport options from Go's stdlib

249210 transport := http.DefaultTransport.(*http.Transport).Clone()

pkg/upstream/http_test.go+1−55

@@ -361,12 +361,7 @@ var _ = Describe("HTTP Upstream Suite", func() {

361361 return http.HandlerFunc(func(_ http.ResponseWriter, req *http.Request) {

362362 proxy, ok := h.(*httputil.ReverseProxy)

363363 Expect(ok).To(BeTrue())

364− outReq := req.Clone(req.Context())

365− proxy.Rewrite(&httputil.ProxyRequest{

366− In: req,

367− Out: outReq,

368− })

369− req.Host = outReq.Host

364+ proxy.Director(req)

370365 })

371366 }

372367 httpUpstream.handler = requestInterceptor(httpUpstream.handler)

@@ -375,54 +370,6 @@ var _ = Describe("HTTP Upstream Suite", func() {

375370 Expect(req.Host).To(Equal(strings.TrimPrefix(serverAddr, "http://")))

376371 })

377372

378− It("ServeHTTP preserves forwarding headers when using Rewrite", func() {

379− req := httptest.NewRequest("", "http://example.localhost/foo", nil)

380− req.RemoteAddr = "192.0.2.10:1234"

381− req.Header.Set("Forwarded", "for=192.0.2.1;proto=https;host=example.localhost")

382− req.Header.Set("X-Forwarded-Host", "forwarded.example.localhost")

383− req.Header.Set("X-Forwarded-Proto", "https")

384− req.Header.Set("X-Forwarded-For", "192.0.2.1")

385− req = middlewareapi.AddRequestScope(req, &middlewareapi.RequestScope{})

386− rw := httptest.NewRecorder()

387−

388− upstream := options.Upstream{

389− ID: "preserveForwardedHeaders",

390− PassHostHeader: ptr.To(true),

391− ProxyWebSockets: ptr.To(false),

392− InsecureSkipTLSVerify: ptr.To(false),

393− FlushInterval: &defaultFlushInterval,

394− Timeout: &defaultTimeout,

395− }

396−

397− u, err := url.Parse(serverAddr)

398− Expect(err).ToNot(HaveOccurred())

399−

400− handler := newHTTPUpstreamProxy(upstream, u, nil, nil)

401− httpUpstream, ok := handler.(*httpUpstreamProxy)

402− Expect(ok).To(BeTrue())

403−

404− requestInterceptor := func(h http.Handler) http.Handler {

405− return http.HandlerFunc(func(_ http.ResponseWriter, req *http.Request) {

406− proxy, ok := h.(*httputil.ReverseProxy)

407− Expect(ok).To(BeTrue())

408−

409− outReq := req.Clone(req.Context())

410− proxy.Rewrite(&httputil.ProxyRequest{

411− In: req,

412− Out: outReq,

413− })

414−

415− Expect(outReq.Header.Values("Forwarded")).To(Equal([]string{"for=192.0.2.1;proto=https;host=example.localhost"}))

416− Expect(outReq.Header.Values("X-Forwarded-Host")).To(Equal([]string{"forwarded.example.localhost"}))

417− Expect(outReq.Header.Values("X-Forwarded-Proto")).To(Equal([]string{"https"}))

418− Expect(outReq.Header.Values("X-Forwarded-For")).To(Equal([]string{"192.0.2.1, 192.0.2.10"}))

419− })

420− }

421− httpUpstream.handler = requestInterceptor(httpUpstream.handler)

422−

423− httpUpstream.ServeHTTP(rw, req)

424− })

425−

426373 type newUpstreamTableInput struct {

427374 proxyWebSockets bool

428375 flushInterval time.Duration

@@ -458,7 +405,6 @@ var _ = Describe("HTTP Upstream Suite", func() {

458405

459406 proxy, ok := upstreamProxy.handler.(*httputil.ReverseProxy)

460407 Expect(ok).To(BeTrue())

461− Expect(proxy.Rewrite).ToNot(BeNil())

462408 Expect(proxy.FlushInterval).To(Equal(in.flushInterval))

463409 transport, ok := proxy.Transport.(*http.Transport)

464410 Expect(ok).To(BeTrue())

pkg/upstream/proxy_test.go+1−1

@@ -79,7 +79,7 @@ var _ = Describe("Proxy Suite", func() {

7979 {

8080 ID: "bad-http-backend",

8181 Path: "/bad-http/",

82− URI: invalidServer,

82+ URI: "http://::1",

8383 },

8484 {

8585 ID: "single-path-backend",

pkg/upstream/upstream_suite_test.go+1−1

@@ -24,7 +24,7 @@ var (

2424 serverAddr string

2525 unixServer *httptest.Server

2626 unixServerAddr string

27− invalidServer = "http://127.0.0.1:1"

27+ invalidServer = "http://::1"

2828)

2929

3030func TestUpstreamSuite(t *testing.T) {

pkg/validation/sessions_test.go+2−2

@@ -193,8 +193,8 @@ var _ = Describe("Sessions", func() {

193193 unreachableRedisDelMsg = "unable to delete the redis initialization key: dial tcp 127.0.0.1:65535: connect: connection refused"

194194 unreachableSentinelSetMsg = "unable to set a redis initialization key: redis: all sentinels specified in configuration are unreachable: redis: nil"

195195 unrechableSentinelDelMsg = "unable to delete the redis initialization key: redis: all sentinels specified in configuration are unreachable: redis: nil"

196− refusedSentinelSetMsg = "unable to set a redis initialization key: redis: all sentinels specified in configuration are unreachable: dial tcp 127.0.0.1:65535: connect: connection refused"

197− refusedSentinelDelMsg = "unable to delete the redis initialization key: redis: all sentinels specified in configuration are unreachable: dial tcp 127.0.0.1:65535: connect: connection refused"

196+ refusedSentinelSetMsg = "unable to set a redis initialization key: redis: all sentinels specified in configuration are unreachable: context deadline exceeded"

197+ refusedSentinelDelMsg = "unable to delete the redis initialization key: redis: all sentinels specified in configuration are unreachable: context deadline exceeded"

198198 )

199199

200200 type redisStoreTableInput struct {

providers/atlassian-cloud.godeleted−99

@@ -1,99 +0,0 @@

1−package providers

2−

3−import (

4− "context"

5− "errors"

6− "net/url"

7−

8− "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/sessions"

9− "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/requests"

10−)

11−

12−// AtlassianProvider represents an Atlassian Cloud based Identity Provider

13−type AtlassianProvider struct {

14− *ProviderData

15−}

16−

17−var _ Provider = (*AtlassianProvider)(nil)

18−

19−const (

20− atlassianProviderName = "Atlassian"

21− atlassianDefaultScope = "read:me"

22− atlassianPrompt = "consent"

23− atlassianAudience = "api.atlassian.com"

24−)

25−

26−var (

27− atlassianDefaultLoginURL = &url.URL{

28− Scheme: "https",

29− Host: "auth.atlassian.com",

30− Path: "/authorize",

31− }

32−

33− atlassianDefaultRedeemURL = &url.URL{

34− Scheme: "https",

35− Host: "auth.atlassian.com",

36− Path: "/oauth/token",

37− }

38−

39− // atlassianDefaultProfileURL returns the signed-in user's profile.

40− atlassianDefaultProfileURL = &url.URL{

41− Scheme: "https",

42− Host: "api.atlassian.com",

43− Path: "/me",

44− }

45−)

46−

47−// NewAtlassianProvider initiates a new AtlassianProvider

48−func NewAtlassianProvider(p *ProviderData) *AtlassianProvider {

49− p.setProviderDefaults(providerDefaults{

50− name: atlassianProviderName,

51− loginURL: atlassianDefaultLoginURL,

52− redeemURL: atlassianDefaultRedeemURL,

53− profileURL: atlassianDefaultProfileURL,

54− validateURL: atlassianDefaultProfileURL,

55− scope: atlassianDefaultScope,

56− })

57− return &AtlassianProvider{ProviderData: p}

58−}

59−

60−// GetLoginURL adds the audience and prompt parameters Atlassian requires.

61−func (p *AtlassianProvider) GetLoginURL(redirectURI, state, _ string, extraParams url.Values) string {

62− params := url.Values{}

63− for k, v := range extraParams {

64− params[k] = v

65− }

66− params.Del("approval_prompt")

67− if params.Get("prompt") == "" {

68− params.Set("prompt", atlassianPrompt)

69− }

70− params.Set("audience", atlassianAudience)

71−

72− loginURL := makeLoginURL(p.ProviderData, redirectURI, state, params)

73− return loginURL.String()

74−}

75−

76−// EnrichSession sets the session's email from the Atlassian profile.

77−func (p *AtlassianProvider) EnrichSession(ctx context.Context, s *sessions.SessionState) error {

78− var profile struct {

79− Email string `json:"email"`

80− }

81− err := requests.New(p.ProfileURL.String()).

82− WithContext(ctx).

83− WithHeaders(makeOIDCHeader(s.AccessToken)).

84− Do().

85− UnmarshalInto(&profile)

86− if err != nil {

87− return err

88− }

89− if profile.Email == "" {

90− return errors.New("no email in Atlassian profile")

91− }

92− s.Email = profile.Email

93− return nil

94−}

95−

96−// ValidateSession validates the AccessToken

97−func (p *AtlassianProvider) ValidateSession(ctx context.Context, s *sessions.SessionState) bool {

98− return validateToken(ctx, p, s.AccessToken, makeOIDCHeader(s.AccessToken))

99−}

providers/atlassian-cloud_test.godeleted−93

@@ -1,93 +0,0 @@

1−package providers

2−

3−import (

4− "context"

5− "net/http"

6− "net/http/httptest"

7− "net/url"

8− "testing"

9−

10− "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/sessions"

11− . "github.com/onsi/gomega"

12−)

13−

14−func testAtlassianBackend(status int, body string) *httptest.Server {

15− return httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

16− if r.URL.Path != "/me" || r.Header.Get("Authorization") != "Bearer imaginary_access_token" {

17− w.WriteHeader(http.StatusUnauthorized)

18− return

19− }

20− w.WriteHeader(status)

21− _, _ = w.Write([]byte(body))

22− }))

23−}

24−

25−func testAtlassianProvider(backend *httptest.Server) *AtlassianProvider {

26− p := NewAtlassianProvider(&ProviderData{})

27− u, _ := url.Parse(backend.URL)

28− updateURL(p.ProfileURL, u.Host)

29− updateURL(p.ValidateURL, u.Host)

30− return p

31−}

32−

33−func TestNewAtlassianProvider(t *testing.T) {

34− g := NewWithT(t)

35−

36− providerData := NewAtlassianProvider(&ProviderData{}).Data()

37− g.Expect(providerData.ProviderName).To(Equal("Atlassian"))

38− g.Expect(providerData.LoginURL.String()).To(Equal("https://auth.atlassian.com/authorize"))

39− g.Expect(providerData.RedeemURL.String()).To(Equal("https://auth.atlassian.com/oauth/token"))

40− g.Expect(providerData.ProfileURL.String()).To(Equal("https://api.atlassian.com/me"))

41− g.Expect(providerData.ValidateURL.String()).To(Equal("https://api.atlassian.com/me"))

42− g.Expect(providerData.Scope).To(Equal("read:me"))

43−}

44−

45−func TestAtlassianProviderGetLoginURL(t *testing.T) {

46− g := NewWithT(t)

47− p := NewAtlassianProvider(&ProviderData{ClientID: "client"})

48−

49− loginURL, err := url.Parse(p.GetLoginURL("https://proxy/oauth2/callback", "state", "",

50− url.Values{"approval_prompt": {"force"}}))

51− g.Expect(err).ToNot(HaveOccurred())

52−

53− q := loginURL.Query()

54− g.Expect(q.Get("audience")).To(Equal("api.atlassian.com"))

55− g.Expect(q.Get("prompt")).To(Equal("consent"))

56− g.Expect(q.Has("approval_prompt")).To(BeFalse())

57− g.Expect(q.Get("scope")).To(Equal("read:me"))

58−

59− loginURL, err = url.Parse(p.GetLoginURL("https://proxy/oauth2/callback", "state", "",

60− url.Values{"prompt": {"login"}}))

61− g.Expect(err).ToNot(HaveOccurred())

62− g.Expect(loginURL.Query().Get("prompt")).To(Equal("login"))

63−}

64−

65−func TestAtlassianProviderEnrichSession(t *testing.T) {

66− g := NewWithT(t)

67− b := testAtlassianBackend(http.StatusOK, `{"account_id":"abc","email":"user@example.com"}`)

68− defer b.Close()

69− p := testAtlassianProvider(b)

70−

71− session := CreateAuthorizedSession()

72− g.Expect(p.EnrichSession(context.Background(), session)).To(Succeed())

73− g.Expect(session.Email).To(Equal("user@example.com"))

74−}

75−

76−func TestAtlassianProviderEnrichSessionWithoutEmail(t *testing.T) {

77− g := NewWithT(t)

78− b := testAtlassianBackend(http.StatusOK, `{"account_id":"abc"}`)

79− defer b.Close()

80− p := testAtlassianProvider(b)

81−

82− g.Expect(p.EnrichSession(context.Background(), CreateAuthorizedSession())).ToNot(Succeed())

83−}

84−

85−func TestAtlassianProviderValidateSession(t *testing.T) {

86− g := NewWithT(t)

87− b := testAtlassianBackend(http.StatusOK, `{"email":"user@example.com"}`)

88− defer b.Close()

89− p := testAtlassianProvider(b)

90−

91− g.Expect(p.ValidateSession(context.Background(), CreateAuthorizedSession())).To(BeTrue())

92− g.Expect(p.ValidateSession(context.Background(), &sessions.SessionState{AccessToken: "wrong"})).To(BeFalse())

93−}

providers/dtt_sso.godeleted−202

@@ -1,202 +0,0 @@

1−package providers

2−

3−import (

4− "bytes"

5− "context"

6− "encoding/base64"

7− "errors"

8− "fmt"

9− "net/http"

10− "net/url"

11− "time"

12−

13− "github.com/golang-jwt/jwt/v5"

14− "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/sessions"

15− "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/requests"

16−)

17−

18−// DTTSSOProvider signs users in with the DTT SSO (auth-server).

19−type DTTSSOProvider struct {

20− *ProviderData

21−}

22−

23−var _ Provider = (*DTTSSOProvider)(nil)

24−

25−const (

26− dttSSOProviderName = "DTT SSO"

27− dttSSODefaultScope = "openid"

28−)

29−

30−var (

31− dttSSODefaultLoginURL = &url.URL{

32− Scheme: "https",

33− Host: "auth.thebestagent.pro",

34− Path: "/oauth/authorize",

35− }

36−

37− dttSSODefaultRedeemURL = &url.URL{

38− Scheme: "https",

39− Host: "auth.thebestagent.pro",

40− Path: "/oauth/token",

41− }

42−

43− dttSSODefaultValidateURL = &url.URL{

44− Scheme: "https",

45− Host: "auth.thebestagent.pro",

46− Path: "/oauth/check_token",

47− }

48−)

49−

50−// NewDTTSSOProvider initiates a new DTTSSOProvider

51−func NewDTTSSOProvider(p *ProviderData) *DTTSSOProvider {

52− p.setProviderDefaults(providerDefaults{

53− name: dttSSOProviderName,

54− loginURL: dttSSODefaultLoginURL,

55− redeemURL: dttSSODefaultRedeemURL,

56− profileURL: nil,

57− validateURL: dttSSODefaultValidateURL,

58− scope: dttSSODefaultScope,

59− })

60− return &DTTSSOProvider{ProviderData: p}

61−}

62−

63−// dttSSOTokenResponse is the SSO's /oauth/token response.

64−type dttSSOTokenResponse struct {

65− AccessToken string `json:"access_token"`

66− RefreshToken string `json:"refresh_token"`

67− ExpiresIn int64 `json:"expires_in"`

68− IDToken string `json:"id_token"`

69−}

70−

71−// dttSSOClaims holds the id_token claims the provider uses.

72−type dttSSOClaims struct {

73− jwt.RegisteredClaims

74− Email string `json:"email"`

75− Role string `json:"role"`

76− UserID string `json:"user_id"`

77−}

78−

79−// Redeem exchanges the authorization code for a session.

80−func (p *DTTSSOProvider) Redeem(ctx context.Context, redirectURL, code, _ string) (*sessions.SessionState, error) {

81− if code == "" {

82− return nil, ErrMissingCode

83− }

84− return p.requestTokens(ctx, url.Values{

85− "grant_type": {"authorization_code"},

86− "code": {code},

87− "redirect_uri": {redirectURL},

88− })

89−}

90−

91−// RefreshSession renews the tokens and re-reads the email and role.

92−func (p *DTTSSOProvider) RefreshSession(ctx context.Context, s *sessions.SessionState) (bool, error) {

93− if s == nil || s.RefreshToken == "" {

94− return false, nil

95− }

96− refreshed, err := p.requestTokens(ctx, url.Values{

97− "grant_type": {"refresh_token"},

98− "refresh_token": {s.RefreshToken},

99− })

100− if err != nil {

101− return false, fmt.Errorf("unable to redeem refresh token: %v", err)

102− }

103− s.AccessToken = refreshed.AccessToken

104− s.RefreshToken = refreshed.RefreshToken

105− s.IDToken = refreshed.IDToken

106− s.Email = refreshed.Email

107− s.User = refreshed.User

108− s.Groups = refreshed.Groups

109− s.CreatedAt = refreshed.CreatedAt

110− s.ExpiresOn = refreshed.ExpiresOn

111− return true, nil

112−}

113−

114−// ValidateSession checks the access token with the SSO's check_token endpoint.

115−func (p *DTTSSOProvider) ValidateSession(ctx context.Context, s *sessions.SessionState) bool {

116− return validateToken(ctx, p, s.AccessToken, makeOIDCHeader(s.AccessToken))

117−}

118−

119−// requestTokens calls the token endpoint and builds a session from the verified id_token.

120−//

121−// The SSO compares the Basic credentials byte for byte, so they are sent unescaped

122−// rather than through golang.org/x/oauth2, which URL-escapes them.

123−func (p *DTTSSOProvider) requestTokens(ctx context.Context, params url.Values) (*sessions.SessionState, error) {

124− clientSecret, err := p.GetClientSecret()

125− if err != nil {

126− return nil, err

127− }

128− credentials := base64.StdEncoding.EncodeToString([]byte(p.ClientID + ":" + clientSecret))

129−

130− result := requests.New(p.RedeemURL.String()).

131− WithContext(ctx).

132− WithMethod(http.MethodPost).

133− WithBody(bytes.NewBufferString(params.Encode())).

134− SetHeader("Content-Type", "application/x-www-form-urlencoded").

135− SetHeader("Authorization", "Basic "+credentials).

136− Do()

137− if result.Error() != nil {

138− return nil, result.Error()

139− }

140− if result.StatusCode() != http.StatusOK {

141− return nil, fmt.Errorf("token request failed: status %d - %s", result.StatusCode(), result.Body())

142− }

143−

144− var token dttSSOTokenResponse

145− if err := result.UnmarshalInto(&token); err != nil {

146− return nil, err

147− }

148− if token.AccessToken == "" {

149− return nil, errors.New("token response carried no access_token")

150− }

151− claims, err := p.verifyIDToken(token.IDToken, clientSecret)

152− if err != nil {

153− return nil, err

154− }

155−

156− s := &sessions.SessionState{

157− AccessToken: token.AccessToken,

158− RefreshToken: token.RefreshToken,

159− IDToken: token.IDToken,

160− Email: claims.Email,

161− User: claims.UserID,

162− }

163− if claims.Role != "" {

164− s.Groups = []string{claims.Role}

165− }

166− s.CreatedAtNow()

167− if token.ExpiresIn > 0 {

168− s.ExpiresIn(time.Duration(token.ExpiresIn) * time.Second)

169− }

170− return s, nil

171−}

172−

173−// verifyIDToken checks the id_token's HS256 signature (keyed on the client secret),

174−// issuer, audience and expiry.

175−//

176−// go-jose is not used: it rejects HMAC keys under 32 bytes, and SSO client secrets

177−// can be shorter.

178−func (p *DTTSSOProvider) verifyIDToken(raw, clientSecret string) (*dttSSOClaims, error) {

179− if raw == "" {

180− return nil, errors.New("token response carried no id_token; the scope must be exactly \"openid\"")

181− }

182− var claims dttSSOClaims

183− _, err := jwt.ParseWithClaims(raw, &claims,

184− func(*jwt.Token) (any, error) { return []byte(clientSecret), nil },

185− jwt.WithValidMethods([]string{jwt.SigningMethodHS256.Alg()}),

186− jwt.WithIssuer(p.issuer()),

187− jwt.WithAudience(p.ClientID),

188− jwt.WithExpirationRequired(),

189− )

190− if err != nil {

191− return nil, fmt.Errorf("verifying id_token: %v", err)

192− }

193− if claims.Email == "" {

194− return nil, errors.New("id_token carries no email")

195− }

196− return &claims, nil

197−}

198−

199−// issuer is the SSO's site host, the origin of the login URL.

200−func (p *DTTSSOProvider) issuer() string {

201− return p.LoginURL.Scheme + "://" + p.LoginURL.Host

202−}

providers/dtt_sso_test.godeleted−237

@@ -1,237 +0,0 @@

1−package providers

2−

3−import (

4− "context"

5− "encoding/base64"

6− "encoding/json"

7− "net/http"

8− "net/http/httptest"

9− "net/url"

10− "testing"

11− "time"

12−

13− "github.com/golang-jwt/jwt/v5"

14− "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/sessions"

15− . "github.com/onsi/gomega"

16−)

17−

18−const (

19− dttSSOTestClientID = "redash-gate"

20− // Shorter than 32 bytes, and contains characters golang.org/x/oauth2 would

21− // URL-escape in Basic auth.

22− dttSSOTestSecret = "s3cr+t/abc=="

23−)

24−

25−// dttSSOTestServer mimics the SSO's token and check_token endpoints.

26−type dttSSOTestServer struct {

27− *httptest.Server

28− claims map[string]interface{}

29− signingKey []byte

30− lastForm url.Values

31− validTokens map[string]bool

32− tokenCounter int

33−}

34−

35−func newDTTSSOTestServer() *dttSSOTestServer {

36− s := &dttSSOTestServer{

37− signingKey: []byte(dttSSOTestSecret),

38− validTokens: map[string]bool{},

39− }

40− s.Server = httptest.NewServer(http.HandlerFunc(s.handle))

41− u, _ := url.Parse(s.URL)

42− s.claims = map[string]interface{}{

43− "iss": "http://" + u.Host,

44− "aud": dttSSOTestClientID,

45− "sub": "0b5c1e1a-1111-2222-3333-444455556666",

46− "user_id": "0b5c1e1a-1111-2222-3333-444455556666",

47− "email": "admin@example.com",

48− "role": "dtt_admin",

49− "exp": time.Now().Add(time.Hour).Unix(),

50− }

51− return s

52−}

53−

54−func (s *dttSSOTestServer) handle(w http.ResponseWriter, r *http.Request) {

55− switch r.URL.Path {

56− case "/oauth/token":

57− want := "Basic " + base64.StdEncoding.EncodeToString([]byte(dttSSOTestClientID+":"+dttSSOTestSecret))

58− if r.Header.Get("Authorization") != want {

59− w.WriteHeader(http.StatusUnauthorized)

60− return

61− }

62− _ = r.ParseForm()

63− s.lastForm = r.PostForm

64− if r.PostForm.Get("grant_type") == "refresh_token" && !s.validTokens["refresh-"+r.PostForm.Get("refresh_token")] {

65− w.WriteHeader(http.StatusBadRequest)

66− _, _ = w.Write([]byte(`{"error":"invalid_grant","error_description":"Invalid refresh token"}`))

67− return

68− }

69− s.tokenCounter++

70− access := "access-" + string(rune('0'+s.tokenCounter))

71− refresh := "refresh-" + string(rune('0'+s.tokenCounter))

72− s.validTokens[access] = true

73− s.validTokens["refresh-"+refresh] = true

74− w.Header().Set("Content-Type", "application/json")

75− _ = json.NewEncoder(w).Encode(map[string]interface{}{

76− "access_token": access,

77− "token_type": "bearer",

78− "expires_in": 3600,

79− "refresh_token": refresh,

80− "id_token": s.idToken(),

81− "scope": "openid",

82− })

83− case "/oauth/check_token":

84− token := r.Header.Get("Authorization")

85− if len(token) > len("Bearer ") && s.validTokens[token[len("Bearer "):]] {

86− _, _ = w.Write([]byte(`{"user_id":"0b5c1e1a-1111-2222-3333-444455556666","real_user_id":null,"issued_by":"redash-gate"}`))

87− return

88− }

89− w.WriteHeader(http.StatusUnauthorized)

90− _, _ = w.Write([]byte("Invalid access token"))

91− default:

92− w.WriteHeader(http.StatusNotFound)

93− }

94−}

95−

96−func (s *dttSSOTestServer) idToken() string {

97− if s.claims == nil {

98− return ""

99− }

100− raw, err := jwt.NewWithClaims(jwt.SigningMethodHS256, jwt.MapClaims(s.claims)).SignedString(s.signingKey)

101− if err != nil {

102− panic(err)

103− }

104− return raw

105−}

106−

107−func testDTTSSOProvider(server *dttSSOTestServer) *DTTSSOProvider {

108− p := NewDTTSSOProvider(&ProviderData{ClientID: dttSSOTestClientID, ClientSecret: dttSSOTestSecret})

109− u, _ := url.Parse(server.URL)

110− updateURL(p.LoginURL, u.Host)

111− updateURL(p.RedeemURL, u.Host)

112− updateURL(p.ValidateURL, u.Host)

113− return p

114−}

115−

116−func TestNewDTTSSOProvider(t *testing.T) {

117− g := NewWithT(t)

118−

119− providerData := NewDTTSSOProvider(&ProviderData{}).Data()

120− g.Expect(providerData.ProviderName).To(Equal("DTT SSO"))

121− g.Expect(providerData.LoginURL.String()).To(Equal("https://auth.thebestagent.pro/oauth/authorize"))

122− g.Expect(providerData.RedeemURL.String()).To(Equal("https://auth.thebestagent.pro/oauth/token"))

123− g.Expect(providerData.ValidateURL.String()).To(Equal("https://auth.thebestagent.pro/oauth/check_token"))

124− g.Expect(providerData.Scope).To(Equal("openid"))

125−}

126−

127−func TestDTTSSOProviderRedeem(t *testing.T) {

128− g := NewWithT(t)

129− server := newDTTSSOTestServer()

130− defer server.Close()

131− p := testDTTSSOProvider(server)

132−

133− s, err := p.Redeem(context.Background(), "https://redash.example.com/oauth2/callback", "the-code", "")

134− g.Expect(err).ToNot(HaveOccurred())

135− g.Expect(s.Email).To(Equal("admin@example.com"))

136− g.Expect(s.User).To(Equal("0b5c1e1a-1111-2222-3333-444455556666"))

137− g.Expect(s.Groups).To(Equal([]string{"dtt_admin"}))

138− g.Expect(s.AccessToken).To(Equal("access-1"))

139− g.Expect(s.RefreshToken).To(Equal("refresh-1"))

140− g.Expect(s.IDToken).ToNot(BeEmpty())

141− g.Expect(s.ExpiresOn).ToNot(BeNil())

142− g.Expect(*s.ExpiresOn).To(BeTemporally("~", time.Now().Add(time.Hour), time.Minute))

143−

144− g.Expect(server.lastForm.Get("grant_type")).To(Equal("authorization_code"))

145− g.Expect(server.lastForm.Get("code")).To(Equal("the-code"))

146− g.Expect(server.lastForm.Get("redirect_uri")).To(Equal("https://redash.example.com/oauth2/callback"))

147−}

148−

149−func TestDTTSSOProviderRedeemRejectsBadIDTokens(t *testing.T) {

150− testCases := map[string]func(s *dttSSOTestServer){

151− "signed with another secret": func(s *dttSSOTestServer) { s.signingKey = []byte("some-other-client-secret") },

152− "other audience": func(s *dttSSOTestServer) { s.claims["aud"] = "frappe-gate" },

153− "other issuer": func(s *dttSSOTestServer) { s.claims["iss"] = "https://evil.example.com" },

154− "expired": func(s *dttSSOTestServer) { s.claims["exp"] = time.Now().Add(-time.Minute).Unix() },

155− "no email": func(s *dttSSOTestServer) { delete(s.claims, "email") },

156− "no id_token": func(s *dttSSOTestServer) { s.claims = nil },

157− }

158− for name, tamper := range testCases {

159− t.Run(name, func(t *testing.T) {

160− g := NewWithT(t)

161− server := newDTTSSOTestServer()

162− defer server.Close()

163− tamper(server)

164−

165− _, err := testDTTSSOProvider(server).Redeem(context.Background(), "https://redash.example.com/oauth2/callback", "the-code", "")

166− g.Expect(err).To(HaveOccurred())

167− })

168− }

169−}

170−

171−func TestDTTSSOProviderRedeemRejectsUnsignedIDToken(t *testing.T) {

172− g := NewWithT(t)

173− server := newDTTSSOTestServer()

174− defer server.Close()

175− p := testDTTSSOProvider(server)

176−

177− header := base64.RawURLEncoding.EncodeToString([]byte(`{"alg":"none"}`))

178− payload, _ := json.Marshal(server.claims)

179− unsigned := header + "." + base64.RawURLEncoding.EncodeToString(payload) + "."

180−

181− _, err := p.verifyIDToken(unsigned, dttSSOTestSecret)

182− g.Expect(err).To(HaveOccurred())

183−}

184−

185−func TestDTTSSOProviderRefreshSession(t *testing.T) {

186− g := NewWithT(t)

187− server := newDTTSSOTestServer()

188− defer server.Close()

189− p := testDTTSSOProvider(server)

190−

191− s, err := p.Redeem(context.Background(), "https://redash.example.com/oauth2/callback", "the-code", "")

192− g.Expect(err).ToNot(HaveOccurred())

193− nonce := []byte("keep-me")

194− s.Nonce = nonce

195−

196− server.claims["role"] = "agent"

197− server.claims["email"] = "renamed@example.com"

198− refreshed, err := p.RefreshSession(context.Background(), s)

199− g.Expect(err).ToNot(HaveOccurred())

200− g.Expect(refreshed).To(BeTrue())

201− g.Expect(s.AccessToken).To(Equal("access-2"))

202− g.Expect(s.RefreshToken).To(Equal("refresh-2"))

203− g.Expect(s.Groups).To(Equal([]string{"agent"}))

204− g.Expect(s.Email).To(Equal("renamed@example.com"))

205− g.Expect(s.Nonce).To(Equal(nonce))

206− g.Expect(server.lastForm.Get("grant_type")).To(Equal("refresh_token"))

207− g.Expect(server.lastForm.Get("refresh_token")).To(Equal("refresh-1"))

208−}

209−

210−func TestDTTSSOProviderRefreshSessionFailures(t *testing.T) {

211− g := NewWithT(t)

212− server := newDTTSSOTestServer()

213− defer server.Close()

214− p := testDTTSSOProvider(server)

215−

216− refreshed, err := p.RefreshSession(context.Background(), &sessions.SessionState{})

217− g.Expect(err).ToNot(HaveOccurred())

218− g.Expect(refreshed).To(BeFalse())

219−

220− refreshed, err = p.RefreshSession(context.Background(), &sessions.SessionState{RefreshToken: "revoked"})

221− g.Expect(err).To(HaveOccurred())

222− g.Expect(refreshed).To(BeFalse())

223−}

224−

225−func TestDTTSSOProviderValidateSession(t *testing.T) {

226− g := NewWithT(t)

227− server := newDTTSSOTestServer()

228− defer server.Close()

229− p := testDTTSSOProvider(server)

230−

231− s, err := p.Redeem(context.Background(), "https://redash.example.com/oauth2/callback", "the-code", "")

232− g.Expect(err).ToNot(HaveOccurred())

233− g.Expect(p.ValidateSession(context.Background(), s)).To(BeTrue())

234−

235− delete(server.validTokens, s.AccessToken)

236− g.Expect(p.ValidateSession(context.Background(), s)).To(BeFalse())

237−}

providers/providers.go+3−7

@@ -40,8 +40,6 @@ func NewProvider(providerConfig options.Provider) (Provider, error) {

4040 switch providerConfig.Type {

4141 case options.ADFSProvider:

4242 return NewADFSProvider(providerData, providerConfig), nil

43− case options.AtlassianProvider:

44− return NewAtlassianProvider(providerData), nil

4543 case options.AzureProvider:

4644 return NewAzureProvider(providerData, providerConfig.AzureConfig), nil

4745 case options.MicrosoftEntraIDProvider:

@@ -52,8 +50,6 @@ func NewProvider(providerConfig options.Provider) (Provider, error) {

5250 return NewCIDAASProvider(providerData, providerConfig), nil

5351 case options.DigitalOceanProvider:

5452 return NewDigitalOceanProvider(providerData), nil

55− case options.DTTSSOProvider:

56− return NewDTTSSOProvider(providerData), nil

5753 case options.FacebookProvider:

5854 return NewFacebookProvider(providerData), nil

5955 case options.GitHubProvider:

@@ -193,9 +189,9 @@ func parseCodeChallengeMethod(providerConfig options.Provider) string {

193189

194190func providerRequiresOIDCProviderVerifier(providerType options.ProviderType) (bool, error) {

195191 switch providerType {

196− case options.AtlassianProvider, options.BitbucketProvider, options.DigitalOceanProvider, options.DTTSSOProvider,

197− options.FacebookProvider, options.GitHubProvider, options.GoogleProvider, options.KeycloakProvider,

198− options.LinkedInProvider, options.LoginGovProvider, options.NextCloudProvider, options.SourceHutProvider:

192+ case options.BitbucketProvider, options.DigitalOceanProvider, options.FacebookProvider, options.GitHubProvider,

193+ options.GoogleProvider, options.KeycloakProvider, options.LinkedInProvider, options.LoginGovProvider,

194+ options.NextCloudProvider, options.SourceHutProvider:

199195 return false, nil

200196 case options.OIDCProvider, options.ADFSProvider, options.AzureProvider, options.CidaasProvider,

201197 options.GitLabProvider, options.KeycloakOIDCProvider, options.MicrosoftEntraIDProvider: