feat: add support for Envoy proxy

[pushpinderbal]

Summary

Implements: #527

Adds support for Envoy Proxy so Tinyauth can be used an external authroizer with ext_authz in Envoy filters and Istio AuthorizationPolicy.

Changes

• Exposes all standard HTTP methods for /api/auth/envoy as Envoy uses the original method when contacting Tinyauth.
• Other proxies will return a HTTP 405 Method Not Allowed if the request method is not GET.

Summary by CodeRabbit

• New Features

  • Added support for "envoy" as an additional proxy authentication option.
  • Proxy authentication endpoint now accepts a broader set of HTTP methods for supported proxies.

• Bug Fixes

  • Improved handling of unsupported HTTP methods with proper 405 responses when applicable.
  • Fixed redirection behavior for logged-out requests coming through envoy and other proxies.

_{✏️ Tip: You can customize this high-level summary in your review settings.}

[coderabbitai]

Walkthrough

Route for /auth/:proxy changed from GET to accept Any method; "envoy" added as a valid proxy. Non-GET requests to non-envoy proxies now return 405 Method Not Allowed; invalid-proxy checks still return 400. Tests added for method/Envoy behaviors.

Changes

Cohort / File(s)	Summary
Proxy controller logic internal/controller/proxy_controller.go	Route binding changed from GET to Any for /auth/:proxy. Added envoy to allowed proxy values. Enforced method-based access control: non-GET requests return 405 when proxy ≠ envoy; preserved 400 for unknown proxies.
Proxy controller tests internal/controller/proxy_controller_test.go	Added tests: 405 for invalid HTTP method on /api/auth/traefik; POST to /api/auth/envoy for logged-out user expects 307 redirect with forward headers and Accept: text/html. Existing traefik redirect test retained.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

• Review Any route impact on routing/middleware and security checks.
• Verify method-check logic distinguishes envoy correctly and returns 405 vs 400 as intended.
• Confirm new tests assert headers/status and do not introduce flaky timing/redirect assumptions.

Possibly related issues

• [FEATURE] Support Envoy Proxy #527 — Adds Envoy support and expands route to accept multiple HTTP methods; changes here implement that behavior.

Poem

🐰 I hopped along the auth-lined way,
Envoy whispered, "Let POSTs stay."
Non-GETs knocked where nginx sleeps,
I sorted routes and counted sleeps,
Now redirects dance beneath the proxy hay. 🎋

Pre-merge checks and finishing touches

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	You can run @coderabbitai generate docstrings to improve docstring coverage.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'feat: add support for Envoy proxy' directly and clearly summarizes the main change—adding Envoy proxy support as a new feature.

✨ Finishing touches

• 📝 Generate docstrings

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment

---

📜 Recent review details

Configuration used: defaults

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between ca2ec6c and 5a046bc.

📒 Files selected for processing (1)

• internal/controller/proxy_controller.go (3 hunks)

🚧 Files skipped from review as they are similar to previous changes (1)

• internal/controller/proxy_controller.go

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🧹 Nitpick comments (1)

internal/controller/proxy_controller_test.go (1)

102-112: LGTM - Consider adding a GET test for Envoy as well.

The test correctly validates that Envoy accepts POST requests and follows the same authentication flow (307 redirect to login) as other proxies. This confirms the method-based access control allows all methods for Envoy.

For completeness, consider adding a test that verifies Envoy also works with GET requests, ensuring parity across all supported methods.

🔎 Optional: Add GET test for Envoy

// Test logged out user (envoy) with GET
recorder = httptest.NewRecorder()
req = httptest.NewRequest("GET", "/api/auth/envoy", nil)
req.Header.Set("X-Forwarded-Proto", "https")
req.Header.Set("X-Forwarded-Host", "example.com")
req.Header.Set("X-Forwarded-Uri", "/somepath")
req.Header.Set("Accept", "text/html")
router.ServeHTTP(recorder, req)

assert.Equal(t, 307, recorder.Code)
assert.Equal(t, "http://localhost:8080/login?redirect_uri=https%3A%2F%2Fexample.com%2Fsomepath", recorder.Header().Get("Location"))

📜 Review details

Configuration used: defaults

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between f3d2e14 and ca2ec6c.

📒 Files selected for processing (2)

• internal/controller/proxy_controller.go (2 hunks)
• internal/controller/proxy_controller_test.go (2 hunks)

🔇 Additional comments (3)

internal/controller/proxy_controller.go (2)

42-42: LGTM - Route now accepts all HTTP methods for Envoy support.

The change from GET to Any is correct. Envoy forwards the original request method when contacting external authorizers, so the endpoint must accept all methods. The subsequent method validation at lines 58-65 ensures that only Envoy can use non-GET methods.

---

67-67: Verify Envoy ext_authz configuration includes necessary headers to authorization service.

Envoy's ext_authz filter automatically forwards the original HTTP method (as :method). However, X-Forwarded-Proto, X-Forwarded-Host, and X-Forwarded-Uri headers are not automatically included in authorization requests—they must be explicitly configured via the headers_to_add field in the authorization request settings. If your code at lines 84-86 depends on these headers being present, ensure the external authorization service is properly configured to provide them in its response, or configure Envoy to explicitly send them to the authorization service.

internal/controller/proxy_controller_test.go (1)

83-88: LGTM - Test validates method restriction for non-Envoy proxies.

The test correctly verifies that POST requests to non-Envoy proxies (traefik in this case) return 405 Method Not Allowed, which validates the new method-based access control.

[steveiliop56]

Closing in favor of #538.