End any existing session when a sign-in is refused

A browser that still holds a session and signs in as an account outside
the household's group got the 403 page but kept its old session. The
refusal now ends that session and clears its cookie first.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

README.md

@@ -40,10 +40,6 @@ export MEALQUEST_OIDC_ALLOWED_GROUPS=mealquest-admin
 # and always MEALQUEST_SESSION_MAX after sign-in (default 4320h).
 # export MEALQUEST_SESSION_IDLE=720h
 # export MEALQUEST_SESSION_MAX=4320h
-# Optional: comma-separated IPs/CIDRs of reverse proxies whose
-# X-Forwarded-For/-Proto headers are honoured (production: Traefik). Unset
-# trusts no peer, which is right for local development.
-# export MEALQUEST_TRUSTED_PROXY=10.60.1.33
 make dev
 ```
 
@@ -51,8 +47,7 @@ make dev
 (which proxies `/api`, `/auth` and `/media` to `:8080`). Open
 http://localhost:5173. Configuration is environment-only and fails fast:
 every variable above is required except the commented-out session
-lifetimes (when set they must be positive, with MAX at least IDLE) and
-trusted proxy list (every entry must be an IP or CIDR), and
+lifetimes (when set they must be positive, with MAX at least IDLE), and
 secrets are read only from files named by `*_FILE` variables. `MEALQUEST_PUBLIC_URL`, `MEALQUEST_OIDC_ISSUER` and the
 endpoints the issuer advertises must be `https://`; plain `http://` is
 accepted only for `localhost`, `127.0.0.1` and `[::1]`.

cmd/server/main.go

@@ -15,7 +15,6 @@ import (
 
 	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/auth"
 	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/config"
-	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/forwarded"
 	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/frontend"
 	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/server"
 	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/store"
@@ -32,7 +31,7 @@ func main() {
 		os.Exit(1)
 	}
 
-	logger := slog.New(forwarded.LogHandler(slog.NewJSONHandler(os.Stdout, nil)))
+	logger := slog.New(slog.NewJSONHandler(os.Stdout, nil))
 	if err := run(cfg, logger); err != nil {
 		logger.Error("server stopped", "error", err)
 		os.Exit(1)
@@ -69,7 +68,7 @@ func run(cfg config.Config, logger *slog.Logger) error {
 		return err
 	}
 
-	router, err := server.NewRouter(logger, version, cfg.TrustedProxy, authFlow, sessions, frontend.Assets())
+	router, err := server.NewRouter(logger, version, authFlow, sessions, frontend.Assets())
 	if err != nil {
 		return err
 	}
@@ -127,7 +126,6 @@ func logListening(logger *slog.Logger, cfg config.Config) {
 	logger.Info("listening",
 		"addr", cfg.HTTPAddr,
 		"public_origin", cfg.PublicOrigin(),
-		"trusted_proxy", cfg.TrustedProxy,
 		"data_dir", cfg.DataDir,
 		"version", version,
 	)

docs/ARCHITECTURE.md

@@ -29,15 +29,6 @@ docker compose project "mealquest" — 10.60.1.14
 One Go service serves the API, the auth flow, media and the PWA. Its SQLite
 database is replicated by Litestream to the NAS.
 
-Traefik terminates TLS. The service honours `X-Forwarded-For` and
-`X-Forwarded-Proto` only from peers listed in `MEALQUEST_TRUSTED_PROXY`
-(comma-separated IPs/CIDRs; production lists `10.60.1.33`); from any other
-peer they are ignored. The client is the rightmost `X-Forwarded-For` address
-that is not a trusted proxy. The resolved client IP is added as `client_ip`
-to every log line written while handling a request. The OIDC redirect URI
-and the Secure cookies are fixed by `MEALQUEST_PUBLIC_URL`, never by request
-headers, so sign-in works whichever peer the request arrives from.
-
 ## Repository layout
 
 | Path | Purpose |

internal/auth/actor.go

@@ -19,27 +19,17 @@ func (s Session) Actor() Actor {
 	return Actor{Subject: s.Subject, Email: s.Email, Name: s.Name, Groups: slices.Clone(s.Groups)}
 }
 
-type sessionKey struct{}
+type actorKey struct{}
 
-// WithSession returns a copy of ctx carrying s. The session middleware calls
-// it for every authenticated request.
-func WithSession(ctx context.Context, s Session) context.Context {
-	return context.WithValue(ctx, sessionKey{}, s)
+// WithActor returns a copy of ctx carrying actor. The session middleware
+// calls it for every authenticated request.
+func WithActor(ctx context.Context, actor Actor) context.Context {
+	return context.WithValue(ctx, actorKey{}, actor)
 }
 
-// SessionFrom returns the session WithSession stored in ctx. ok is false when
-// ctx has none, which behind the session middleware means a wiring bug.
-func SessionFrom(ctx context.Context) (s Session, ok bool) {
-	s, ok = ctx.Value(sessionKey{}).(Session)
-	return s, ok
-}
-
-// ActorFrom returns the actor of the session WithSession stored in ctx. ok is
-// false when ctx has none.
+// ActorFrom returns the actor WithActor stored in ctx. ok is false when ctx
+// has none, which behind the session middleware means a wiring bug.
 func ActorFrom(ctx context.Context) (actor Actor, ok bool) {
-	s, ok := SessionFrom(ctx)
-	if !ok {
-		return Actor{}, false
-	}
-	return s.Actor(), true
+	actor, ok = ctx.Value(actorKey{}).(Actor)
+	return actor, ok
 }

internal/auth/actor_test.go

@@ -11,18 +11,10 @@ func TestActorContext(t *testing.T) {
 	if _, ok := ActorFrom(context.Background()); ok {
 		t.Error("ActorFrom found an actor in an empty context")
 	}
-	if _, ok := SessionFrom(context.Background()); ok {
-		t.Error("SessionFrom found a session in an empty context")
-	}
-	s := Session{Subject: "user-123", Email: "cook@example.com", Name: "Home Cook", Groups: []string{"mealquest-admin"}, CSRFToken: "t"}
-	ctx := WithSession(context.Background(), s)
-	gotSession, ok := SessionFrom(ctx)
-	if !ok || gotSession.Subject != s.Subject || gotSession.CSRFToken != s.CSRFToken {
-		t.Errorf("SessionFrom = %+v (ok=%v), want %+v", gotSession, ok, s)
-	}
-	got, ok := ActorFrom(ctx)
-	if !ok || got.Subject != s.Subject || got.Email != s.Email || got.Name != s.Name || !slices.Equal(got.Groups, s.Groups) {
-		t.Errorf("ActorFrom = %+v (ok=%v), want the session's actor", got, ok)
+	want := Actor{Subject: "user-123", Email: "cook@example.com", Name: "Home Cook", Groups: []string{"mealquest-admin"}}
+	got, ok := ActorFrom(WithActor(context.Background(), want))
+	if !ok || got.Subject != want.Subject || got.Email != want.Email || got.Name != want.Name || !slices.Equal(got.Groups, want.Groups) {
+		t.Errorf("ActorFrom = %+v (ok=%v), want %+v", got, ok, want)
 	}
 }
 

internal/auth/auth.go

@@ -13,7 +13,6 @@ import (
 	"net/http"
 	"net/url"
 	"slices"
-	"sync/atomic"
 	"time"
 
 	"github.com/coreos/go-oidc/v3/oidc"
@@ -108,12 +107,9 @@ func New(ctx context.Context, cfg Config, sessions Sessions, logger *slog.Logger
 	}
 
 	client := &http.Client{Timeout: providerTimeout, CheckRedirect: checkRedirect}
-	discovery := *client
-	recorder := &statusRecorder{next: http.DefaultTransport}
-	discovery.Transport = recorder
-	provider, err := oidc.NewProvider(oidc.ClientContext(ctx, &discovery), cfg.Issuer)
+	provider, err := oidc.NewProvider(oidc.ClientContext(ctx, client), cfg.Issuer)
 	if err != nil {
-		return nil, discoveryError(err, int(recorder.status.Load()))
+		return nil, fmt.Errorf("auth: OIDC discovery: %w", err)
 	}
 	endpoint := provider.Endpoint()
 	var discovered struct {
@@ -163,32 +159,6 @@ func New(ctx context.Context, cfg Config, sessions Sessions, logger *slog.Logger
 	}, nil
 }
 
-// statusRecorder records the status of the last response it carries.
-type statusRecorder struct {
-	next   http.RoundTripper
-	status atomic.Int32
-}
-
-func (s *statusRecorder) RoundTrip(req *http.Request) (*http.Response, error) {
-	resp, err := s.next.RoundTrip(req)
-	if err == nil {
-		s.status.Store(int32(resp.StatusCode))
-	}
-	return resp, err
-}
-
-// discoveryError reports a failed discovery. go-oidc puts the provider's
-// response body in its error for a non-200 discovery response, so that
-// error is replaced by the status alone. Transport errors carry no response
-// content and keep their cause.
-func discoveryError(err error, status int) error {
-	var urlErr *url.Error
-	if !errors.As(err, &urlErr) && status != 0 && status != http.StatusOK {
-		return fmt.Errorf("auth: OIDC discovery: provider answered HTTP %d", status)
-	}
-	return fmt.Errorf("auth: OIDC discovery: %w", err)
-}
-
 // checkEndpoint applies secureurl.Check to the provider URL raw, naming the
 // endpoint in the error.
 func checkEndpoint(name, raw string) error {

internal/auth/auth_test.go

@@ -11,7 +11,6 @@ import (
 	"encoding/base64"
 	"encoding/json"
 	"errors"
-	"fmt"
 	"io"
 	"log/slog"
 	"maps"
@@ -790,41 +789,6 @@ func TestNewFailsWhenDiscoveryFails(t *testing.T) {
 	}
 }
 
-func TestNewDiscoveryErrorOmitsProviderBody(t *testing.T) {
-	t.Parallel()
-	const sentinel = "sentinel-discovery-body-7f3a"
-	for _, status := range []int{http.StatusNotFound, http.StatusInternalServerError} {
-		t.Run(http.StatusText(status), func(t *testing.T) {
-			t.Parallel()
-			srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
-				w.WriteHeader(status)
-				io.WriteString(w, sentinel)
-			}))
-			t.Cleanup(srv.Close)
-			logs := &syncBuffer{}
-			_, err := New(context.Background(), Config{
-				Issuer:        srv.URL,
-				ClientID:      testClientID,
-				ClientSecret:  testClientSecret,
-				PublicURL:     testPublicURL,
-				SecretKey:     []byte("k"),
-				AllowedGroups: testAllowedGroups,
-			}, &memorySessions{}, slog.New(slog.NewTextHandler(logs, nil)))
-			if err == nil {
-				t.Fatal("New succeeded without a discovery document")
-			}
-			// cmd/server logs the returned error at startup.
-			slog.New(slog.NewTextHandler(logs, nil)).Error("startup failed", "err", err)
-			if strings.Contains(logs.String(), sentinel) {
-				t.Errorf("logs contain the provider response body: %s", logs)
-			}
-			if want := fmt.Sprintf("auth: OIDC discovery: provider answered HTTP %d", status); err.Error() != want {
-				t.Errorf("error = %q, want %q", err, want)
-			}
-		})
-	}
-}
-
 func TestNewFailsOnIssuerMismatch(t *testing.T) {
 	t.Parallel()
 	p := newFakeProvider(t)

internal/config/config.go

@@ -12,7 +12,6 @@ import (
 	"strings"
 	"time"
 
-	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/forwarded"
 	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/secureurl"
 )
 
@@ -31,8 +30,6 @@ const (
 
 	EnvSessionIdle = "MEALQUEST_SESSION_IDLE"
 	EnvSessionMax  = "MEALQUEST_SESSION_MAX"
-
-	EnvTrustedProxy = "MEALQUEST_TRUSTED_PROXY"
 )
 
 // Session lifetime defaults (D-004): long enough that the kitchen tablet
@@ -61,10 +58,6 @@ type Config struct {
 	SessionIdle time.Duration
 	// SessionMax ends every session this long after sign-in, used or not.
 	SessionMax time.Duration
-
-	// TrustedProxy lists the reverse proxies whose X-Forwarded-For and
-	// X-Forwarded-Proto headers are honoured. Empty trusts no peer.
-	TrustedProxy forwarded.Trusted
 }
 
 // PublicOrigin returns the scheme and host of PublicURL, the only parts of it
@@ -95,8 +88,6 @@ func load(lookup func(string) (string, bool)) (Config, error) {
 
 		SessionIdle: r.sessionDuration(EnvSessionIdle, DefaultSessionIdle),
 		SessionMax:  r.sessionDuration(EnvSessionMax, DefaultSessionMax),
-
-		TrustedProxy: r.trustedProxy(EnvTrustedProxy),
 	}
 	if cfg.SessionIdle > 0 && cfg.SessionMax > 0 && cfg.SessionMax < cfg.SessionIdle {
 		r.fail(EnvSessionMax, "must be at least %s (%s)", EnvSessionIdle, cfg.SessionIdle)
@@ -186,18 +177,6 @@ func (r *reader) list(name string) []string {
 	return items
 }
 
-// trustedProxy parses an optional comma-separated list of IP addresses and
-// CIDR prefixes with forwarded.ParseTrusted. Unset or blank trusts no peer.
-func (r *reader) trustedProxy(name string) forwarded.Trusted {
-	v, _ := r.lookup(name)
-	t, err := forwarded.ParseTrusted(v)
-	if err != nil {
-		r.fail(name, "%v", err)
-		return nil
-	}
-	return t
-}
-
 func (r *reader) listenAddr(name string) string {
 	v, ok := r.required(name)
 	if !ok {

internal/config/config_test.go

@@ -3,7 +3,6 @@ package config
 import (
 	"errors"
 	"fmt"
-	"net/netip"
 	"net/url"
 	"os"
 	"path/filepath"
@@ -12,8 +11,6 @@ import (
 	"strings"
 	"testing"
 	"time"
-
-	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/forwarded"
 )
 
 func TestLoad(t *testing.T) {
@@ -296,48 +293,6 @@ func TestLoad(t *testing.T) {
 			env:     with(map[string]string{EnvSessionMax: "719h"}),
 			badVars: []string{EnvSessionMax},
 		},
-		{
-			name: "trusted proxy IP",
-			env:  with(map[string]string{EnvTrustedProxy: "10.60.1.33"}),
-		},
-		{
-			name: "trusted proxy IPs and CIDRs",
-			env:  with(map[string]string{EnvTrustedProxy: "10.60.1.33, 172.16.0.0/12,2001:db8::/32,::1"}),
-		},
-		{
-			name: "blank trusted proxy trusts no peer",
-			env:  with(map[string]string{EnvTrustedProxy: "  "}),
-		},
-		{
-			name:    "trusted proxy not an IP",
-			env:     with(map[string]string{EnvTrustedProxy: "traefik"}),
-			badVars: []string{EnvTrustedProxy},
-		},
-		{
-			name:    "trusted proxy invalid CIDR",
-			env:     with(map[string]string{EnvTrustedProxy: "10.60.1.0/33"}),
-			badVars: []string{EnvTrustedProxy},
-		},
-		{
-			name:    "trusted proxy CIDR with host bits",
-			env:     with(map[string]string{EnvTrustedProxy: "10.60.1.33/24"}),
-			badVars: []string{EnvTrustedProxy},
-		},
-		{
-			name:    "trusted proxy empty entry",
-			env:     with(map[string]string{EnvTrustedProxy: "10.60.1.33,,10.60.1.34"}),
-			badVars: []string{EnvTrustedProxy},
-		},
-		{
-			name:    "trusted proxy trusting everyone",
-			env:     with(map[string]string{EnvTrustedProxy: "0.0.0.0/0"}),
-			badVars: []string{EnvTrustedProxy},
-		},
-		{
-			name:    "trusted proxy with port",
-			env:     with(map[string]string{EnvTrustedProxy: "10.60.1.33:443"}),
-			badVars: []string{EnvTrustedProxy},
-		},
 		{
 			name: "several invalid values are all named",
 			env: with(map[string]string{
@@ -447,13 +402,8 @@ func TestLoadValues(t *testing.T) {
 		t.Errorf("SessionIdle, SessionMax = %v, %v, want defaults 720h, 4320h", cfg.SessionIdle, cfg.SessionMax)
 	}
 
-	if cfg.TrustedProxy != nil {
-		t.Errorf("TrustedProxy = %v, want none when unset", cfg.TrustedProxy)
-	}
-
 	env[EnvSessionIdle] = "12h"
 	env[EnvSessionMax] = "36h"
-	env[EnvTrustedProxy] = "10.60.1.33, 172.16.0.0/12"
 	cfg, err = load(func(k string) (string, bool) { v, ok := env[k]; return v, ok })
 	if err != nil {
 		t.Fatalf("load() error = %v", err)
@@ -461,10 +411,6 @@ func TestLoadValues(t *testing.T) {
 	if cfg.SessionIdle != 12*time.Hour || cfg.SessionMax != 36*time.Hour {
 		t.Errorf("SessionIdle, SessionMax = %v, %v, want 12h, 36h", cfg.SessionIdle, cfg.SessionMax)
 	}
-	want := forwarded.Trusted{netip.MustParsePrefix("10.60.1.33/32"), netip.MustParsePrefix("172.16.0.0/12")}
-	if !slices.Equal(cfg.TrustedProxy, want) {
-		t.Errorf("TrustedProxy = %v, want %v", cfg.TrustedProxy, want)
-	}
 }
 
 func TestSecretRedacted(t *testing.T) {

internal/forwarded/forwarded.go

@@ -1,221 +0,0 @@
-// Package forwarded resolves where a request really came from. The service
-// runs behind a reverse proxy (Traefik), so the TCP peer is usually the proxy;
-// the X-Forwarded-For and X-Forwarded-Proto headers it adds are believed only
-// when the peer is a trusted proxy. From anyone else they are ignored, so a
-// client cannot spoof its address or scheme.
-package forwarded
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"log/slog"
-	"net/http"
-	"net/netip"
-	"strings"
-)
-
-// Header names honoured from trusted proxies.
-const (
-	HeaderFor   = "X-Forwarded-For"
-	HeaderProto = "X-Forwarded-Proto"
-)
-
-// ErrInvalidHeader marks a malformed forwarded header from a trusted peer.
-var ErrInvalidHeader = errors.New("invalid forwarded header")
-
-// Trusted is the set of proxy addresses whose forwarded headers are honoured.
-// The zero value trusts no peer.
-type Trusted []netip.Prefix
-
-// ParseTrusted parses a comma-separated list of IP addresses and CIDR
-// prefixes. A blank list trusts no peer. Each entry must be a plain address
-// or a prefix with no host bits set; zones, IPv4-mapped IPv6 forms and
-// zero-length prefixes, which would trust every peer, are rejected.
-func ParseTrusted(s string) (Trusted, error) {
-	if strings.TrimSpace(s) == "" {
-		return nil, nil
-	}
-	var t Trusted
-	for _, entry := range strings.Split(s, ",") {
-		entry = strings.TrimSpace(entry)
-		if entry == "" {
-			return nil, fmt.Errorf("empty entry in comma-separated list %q", s)
-		}
-		p, err := parseEntry(entry)
-		if err != nil {
-			return nil, err
-		}
-		t = append(t, p)
-	}
-	return t, nil
-}
-
-func parseEntry(entry string) (netip.Prefix, error) {
-	var p netip.Prefix
-	if strings.Contains(entry, "/") {
-		var err error
-		p, err = netip.ParsePrefix(entry)
-		if err != nil {
-			return netip.Prefix{}, fmt.Errorf("invalid CIDR %q", entry)
-		}
-		if p != p.Masked() {
-			return netip.Prefix{}, fmt.Errorf("CIDR %q has host bits set (did you mean %s?)", entry, p.Masked())
-		}
-	} else {
-		a, err := netip.ParseAddr(entry)
-		if err != nil {
-			return netip.Prefix{}, fmt.Errorf("invalid IP address %q", entry)
-		}
-		if a.Zone() != "" {
-			return netip.Prefix{}, fmt.Errorf("IP address %q must not have a zone", entry)
-		}
-		p = netip.PrefixFrom(a, a.BitLen())
-	}
-	switch {
-	case p.Addr().Is4In6():
-		return netip.Prefix{}, fmt.Errorf("%q is IPv4-mapped IPv6; write the IPv4 form", entry)
-	case p.Bits() == 0:
-		return netip.Prefix{}, fmt.Errorf("%q would trust every peer", entry)
-	}
-	return p, nil
-}
-
-// Contains reports whether a is a trusted proxy address. IPv4-mapped IPv6
-// addresses, as a dual-stack listener reports IPv4 peers, match their IPv4
-// form.
-func (t Trusted) Contains(a netip.Addr) bool {
-	a = normalize(a)
-	for _, p := range t {
-		if p.Contains(a) {
-			return true
-		}
-	}
-	return false
-}
-
-func normalize(a netip.Addr) netip.Addr { return a.Unmap().WithZone("") }
-
-// Origin is where a request came from.
-type Origin struct {
-	// ClientIP is the client's address.
-	ClientIP netip.Addr
-	// Scheme is "https" or "http": the scheme the client used.
-	Scheme string
-}
-
-// Resolve works out r's Origin. When the TCP peer (r.RemoteAddr) is not in
-// trusted, both forwarded headers are ignored: the client is the peer and the
-// scheme is that of the connection.
-//
-// When the peer is trusted:
-//   - X-Forwarded-For entries (across all its header lines, in order) are
-//     walked right to left, skipping trusted proxy addresses; the first
-//     untrusted address is the client. Entries left of it are client-supplied
-//     and not examined. If every entry is trusted the leftmost is the client;
-//     with no X-Forwarded-For the peer is the client.
-//   - X-Forwarded-Proto, if present, must be a single "http" or "https" and
-//     is the scheme; without it the connection's scheme is used.
-//
-// A malformed header from a trusted peer is an error wrapping
-// ErrInvalidHeader; any other error means RemoteAddr is not an IP and port.
-func Resolve(r *http.Request, trusted Trusted) (Origin, error) {
-	peer, err := netip.ParseAddrPort(r.RemoteAddr)
-	if err != nil {
-		return Origin{}, fmt.Errorf("peer address %q is not an IP and port", r.RemoteAddr)
-	}
-	o := Origin{ClientIP: normalize(peer.Addr()), Scheme: "http"}
-	if r.TLS != nil {
-		o.Scheme = "https"
-	}
-	if !trusted.Contains(o.ClientIP) {
-		return o, nil
-	}
-	if values := r.Header.Values(HeaderFor); len(values) > 0 {
-		o.ClientIP, err = clientFromChain(strings.Split(strings.Join(values, ","), ","), trusted)
-		if err != nil {
-			return Origin{}, err
-		}
-	}
-	switch values := r.Header.Values(HeaderProto); len(values) {
-	case 0:
-	case 1:
-		switch scheme := strings.ToLower(strings.TrimSpace(values[0])); scheme {
-		case "http", "https":
-			o.Scheme = scheme
-		default:
-			return Origin{}, fmt.Errorf("%w: %s %q is not http or https", ErrInvalidHeader, HeaderProto, values[0])
-		}
-	default:
-		return Origin{}, fmt.Errorf("%w: %d %s headers, want one", ErrInvalidHeader, len(values), HeaderProto)
-	}
-	return o, nil
-}
-
-// clientFromChain returns the rightmost untrusted address in chain, or the
-// leftmost address when all are trusted.
-func clientFromChain(chain []string, trusted Trusted) (netip.Addr, error) {
-	var client netip.Addr
-	for i := len(chain) - 1; i >= 0; i-- {
-		a, err := netip.ParseAddr(strings.TrimSpace(chain[i]))
-		if err != nil {
-			return netip.Addr{}, fmt.Errorf("%w: %s entry %q is not an IP address", ErrInvalidHeader, HeaderFor, strings.TrimSpace(chain[i]))
-		}
-		client = normalize(a)
-		if !trusted.Contains(client) {
-			break
-		}
-	}
-	return client, nil
-}
-
-type contextKey struct{}
-
-// NewContext returns ctx carrying o.
-func NewContext(ctx context.Context, o Origin) context.Context {
-	return context.WithValue(ctx, contextKey{}, o)
-}
-
-// FromContext returns the Origin ctx carries; ok is false when the request
-// was not resolved.
-func FromContext(ctx context.Context) (o Origin, ok bool) {
-	o, ok = ctx.Value(contextKey{}).(Origin)
-	return o, ok
-}
-
-// ClientIP returns the resolved client address ctx carries.
-func ClientIP(ctx context.Context) (netip.Addr, bool) {
-	o, ok := FromContext(ctx)
-	return o.ClientIP, ok
-}
-
-// Scheme returns the resolved request scheme ctx carries.
-func Scheme(ctx context.Context) (string, bool) {
-	o, ok := FromContext(ctx)
-	return o.Scheme, ok
-}
-
-// LogAttr is the log attribute key for the resolved client address.
-const LogAttr = "client_ip"
-
-// LogHandler wraps h so every record logged with a resolved request's
-// context carries the client address as LogAttr.
-func LogHandler(h slog.Handler) slog.Handler { return logHandler{h} }
-
-type logHandler struct{ slog.Handler }
-
-func (h logHandler) Handle(ctx context.Context, rec slog.Record) error {
-	if ip, ok := ClientIP(ctx); ok {
-		rec = rec.Clone()
-		rec.AddAttrs(slog.String(LogAttr, ip.String()))
-	}
-	return h.Handler.Handle(ctx, rec)
-}
-
-func (h logHandler) WithAttrs(attrs []slog.Attr) slog.Handler {
-	return logHandler{h.Handler.WithAttrs(attrs)}
-}
-
-func (h logHandler) WithGroup(name string) slog.Handler {
-	return logHandler{h.Handler.WithGroup(name)}
-}

internal/forwarded/forwarded_test.go

@@ -1,260 +0,0 @@
-package forwarded
-
-import (
-	"bytes"
-	"context"
-	"crypto/tls"
-	"errors"
-	"log/slog"
-	"net/http"
-	"net/http/httptest"
-	"net/netip"
-	"slices"
-	"strings"
-	"testing"
-)
-
-func TestParseTrusted(t *testing.T) {
-	t.Parallel()
-	tests := []struct {
-		in      string
-		want    []string
-		wantErr string
-	}{
-		{in: "", want: nil},
-		{in: "   ", want: nil},
-		{in: "10.60.1.33", want: []string{"10.60.1.33/32"}},
-		{in: "10.60.1.33, 172.16.0.0/12", want: []string{"10.60.1.33/32", "172.16.0.0/12"}},
-		{in: "2001:db8::1,2001:db8::/32", want: []string{"2001:db8::1/128", "2001:db8::/32"}},
-		{in: "traefik", wantErr: "invalid IP address"},
-		{in: "10.60.1.33:443", wantErr: "invalid IP address"},
-		{in: "10.60.1.0/33", wantErr: "invalid CIDR"},
-		{in: "10.60.1.33/24", wantErr: "did you mean 10.60.1.0/24"},
-		{in: "10.60.1.33,,10.60.1.34", wantErr: "empty entry"},
-		{in: "10.60.1.33,", wantErr: "empty entry"},
-		{in: "fe80::1%eth0", wantErr: "zone"},
-		{in: "::ffff:10.60.1.33", wantErr: "IPv4-mapped"},
-		{in: "0.0.0.0/0", wantErr: "every peer"},
-		{in: "::/0", wantErr: "every peer"},
-	}
-	for _, tt := range tests {
-		got, err := ParseTrusted(tt.in)
-		if tt.wantErr != "" {
-			if err == nil || !strings.Contains(err.Error(), tt.wantErr) {
-				t.Errorf("ParseTrusted(%q) error = %v, want one containing %q", tt.in, err, tt.wantErr)
-			}
-			continue
-		}
-		if err != nil {
-			t.Errorf("ParseTrusted(%q) error = %v", tt.in, err)
-			continue
-		}
-		var gotStr []string
-		for _, p := range got {
-			gotStr = append(gotStr, p.String())
-		}
-		if !slices.Equal(gotStr, tt.want) {
-			t.Errorf("ParseTrusted(%q) = %v, want %v", tt.in, gotStr, tt.want)
-		}
-	}
-}
-
-func TestTrustedContainsMappedIPv4(t *testing.T) {
-	t.Parallel()
-	trusted := mustTrusted(t, "10.60.1.33")
-	if !trusted.Contains(netip.MustParseAddr("::ffff:10.60.1.33")) {
-		t.Error("IPv4-mapped form of a trusted address is not trusted")
-	}
-	if Trusted(nil).Contains(netip.MustParseAddr("10.60.1.33")) {
-		t.Error("an empty set trusts a peer")
-	}
-}
-
-func mustTrusted(t *testing.T, s string) Trusted {
-	t.Helper()
-	tr, err := ParseTrusted(s)
-	if err != nil {
-		t.Fatal(err)
-	}
-	return tr
-}
-
-func TestResolve(t *testing.T) {
-	t.Parallel()
-	// 10.60.1.33 is Traefik; 10.60.2.0/24 is an inner proxy tier.
-	trusted := mustTrusted(t, "10.60.1.33,10.60.2.0/24")
-	tests := []struct {
-		name       string
-		peer       string
-		tls        bool
-		xff        []string
-		xfp        []string
-		wantIP     string
-		wantScheme string
-	}{
-		{
-			name: "untrusted peer, no headers",
-			peer: "198.51.100.9:5000", wantIP: "198.51.100.9", wantScheme: "http",
-		},
-		{
-			name: "untrusted peer over TLS",
-			peer: "198.51.100.9:5000", tls: true, wantIP: "198.51.100.9", wantScheme: "https",
-		},
-		{
-			name: "untrusted peer spoofing both headers is ignored",
-			peer: "198.51.100.9:5000", xff: []string{"203.0.113.7"}, xfp: []string{"https"},
-			wantIP: "198.51.100.9", wantScheme: "http",
-		},
-		{
-			name: "untrusted peer's malformed headers are ignored, not rejected",
-			peer: "198.51.100.9:5000", xff: []string{"not-an-ip"}, xfp: []string{"gopher"},
-			wantIP: "198.51.100.9", wantScheme: "http",
-		},
-		{
-			name: "trusted peer: client from X-Forwarded-For, scheme from X-Forwarded-Proto",
-			peer: "10.60.1.33:41000", xff: []string{"203.0.113.7"}, xfp: []string{"https"},
-			wantIP: "203.0.113.7", wantScheme: "https",
-		},
-		{
-			name: "trusted peer seen as IPv4-mapped IPv6",
-			peer: "[::ffff:10.60.1.33]:41000", xff: []string{"203.0.113.7"}, xfp: []string{"https"},
-			wantIP: "203.0.113.7", wantScheme: "https",
-		},
-		{
-			name: "trusted peer without headers is itself the client",
-			peer: "10.60.1.33:41000", wantIP: "10.60.1.33", wantScheme: "http",
-		},
-		{
-			name: "rightmost untrusted address wins over a client-supplied prefix",
-			peer: "10.60.1.33:41000", xff: []string{"1.2.3.4, 203.0.113.7"}, xfp: []string{"https"},
-			wantIP: "203.0.113.7", wantScheme: "https",
-		},
-		{
-			name: "trusted proxies in the chain are skipped",
-			peer: "10.60.1.33:41000", xff: []string{"1.2.3.4, 203.0.113.7, 10.60.2.5"}, xfp: []string{"https"},
-			wantIP: "203.0.113.7", wantScheme: "https",
-		},
-		{
-			name: "several header lines form one chain",
-			peer: "10.60.1.33:41000", xff: []string{"1.2.3.4", "203.0.113.7, 10.60.2.5"},
-			wantIP: "203.0.113.7", wantScheme: "http",
-		},
-		{
-			name: "garbage left of the client is not examined",
-			peer: "10.60.1.33:41000", xff: []string{"spoofed, 203.0.113.7"},
-			wantIP: "203.0.113.7", wantScheme: "http",
-		},
-		{
-			name: "all trusted: leftmost is the client",
-			peer: "10.60.1.33:41000", xff: []string{"10.60.2.5, 10.60.2.6"},
-			wantIP: "10.60.2.5", wantScheme: "http",
-		},
-		{
-			name: "IPv6 client",
-			peer: "10.60.1.33:41000", xff: []string{"2001:db8::7"}, xfp: []string{"HTTPS"},
-			wantIP: "2001:db8::7", wantScheme: "https",
-		},
-		{
-			name: "trusted peer may downgrade to http",
-			peer: "10.60.1.33:41000", tls: true, xfp: []string{"http"},
-			wantIP: "10.60.1.33", wantScheme: "http",
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			t.Parallel()
-			r := request(tt.peer, tt.xff, tt.xfp)
-			if tt.tls {
-				r.TLS = &tls.ConnectionState{}
-			}
-			o, err := Resolve(r, trusted)
-			if err != nil {
-				t.Fatalf("Resolve error = %v", err)
-			}
-			if o.ClientIP.String() != tt.wantIP || o.Scheme != tt.wantScheme {
-				t.Errorf("Resolve = %s %s, want %s %s", o.ClientIP, o.Scheme, tt.wantIP, tt.wantScheme)
-			}
-		})
-	}
-}
-
-func TestResolveRejectsMalformedHeadersFromTrustedPeer(t *testing.T) {
-	t.Parallel()
-	trusted := mustTrusted(t, "10.60.1.33")
-	for _, tt := range []struct {
-		name     string
-		xff, xfp []string
-	}{
-		{"X-Forwarded-For not an IP", []string{"not-an-ip"}, nil},
-		{"X-Forwarded-For with a port", []string{"203.0.113.7:5000"}, nil},
-		{"X-Forwarded-For empty entry", []string{"203.0.113.7, "}, nil},
-		{"X-Forwarded-For empty", []string{""}, nil},
-		{"X-Forwarded-Proto unknown scheme", nil, []string{"ftp"}},
-		{"X-Forwarded-Proto list", nil, []string{"https, http"}},
-		{"X-Forwarded-Proto repeated", nil, []string{"https", "https"}},
-	} {
-		_, err := Resolve(request("10.60.1.33:41000", tt.xff, tt.xfp), trusted)
-		if !errors.Is(err, ErrInvalidHeader) {
-			t.Errorf("%s: Resolve error = %v, want ErrInvalidHeader", tt.name, err)
-		}
-	}
-}
-
-func TestResolveBadPeerAddress(t *testing.T) {
-	t.Parallel()
-	r := request("@", nil, nil)
-	_, err := Resolve(r, nil)
-	if err == nil || errors.Is(err, ErrInvalidHeader) {
-		t.Errorf("Resolve error = %v, want a peer address error", err)
-	}
-}
-
-func request(peer string, xff, xfp []string) *http.Request {
-	r := httptest.NewRequest(http.MethodGet, "/", nil)
-	r.RemoteAddr = peer
-	for _, v := range xff {
-		r.Header.Add(HeaderFor, v)
-	}
-	for _, v := range xfp {
-		r.Header.Add(HeaderProto, v)
-	}
-	return r
-}
-
-func TestContextHelpers(t *testing.T) {
-	t.Parallel()
-	if _, ok := ClientIP(context.Background()); ok {
-		t.Error("ClientIP ok on an unresolved context")
-	}
-	if _, ok := Scheme(context.Background()); ok {
-		t.Error("Scheme ok on an unresolved context")
-	}
-	ctx := NewContext(context.Background(), Origin{ClientIP: netip.MustParseAddr("203.0.113.7"), Scheme: "https"})
-	if ip, ok := ClientIP(ctx); !ok || ip.String() != "203.0.113.7" {
-		t.Errorf("ClientIP = %s %v, want 203.0.113.7 true", ip, ok)
-	}
-	if s, ok := Scheme(ctx); !ok || s != "https" {
-		t.Errorf("Scheme = %q %v, want https true", s, ok)
-	}
-}
-
-func TestLogHandler(t *testing.T) {
-	t.Parallel()
-	var buf bytes.Buffer
-	logger := slog.New(LogHandler(slog.NewTextHandler(&buf, nil))).With("component", "test")
-	ctx := NewContext(context.Background(), Origin{ClientIP: netip.MustParseAddr("203.0.113.7"), Scheme: "https"})
-
-	logger.InfoContext(ctx, "resolved")
-	logger.InfoContext(context.Background(), "unresolved")
-
-	lines := strings.Split(strings.TrimSpace(buf.String()), "\n")
-	if len(lines) != 2 {
-		t.Fatalf("logged %d lines, want 2: %q", len(lines), buf.String())
-	}
-	if !strings.Contains(lines[0], "client_ip=203.0.113.7") || !strings.Contains(lines[0], "component=test") {
-		t.Errorf("resolved line = %q, want client_ip and the With attribute", lines[0])
-	}
-	if strings.Contains(lines[1], "client_ip") {
-		t.Errorf("unresolved line = %q, want no client_ip", lines[1])
-	}
-}

internal/server/csrf.go

@@ -1,42 +0,0 @@
-package server
-
-import (
-	"crypto/subtle"
-	"log/slog"
-	"net/http"
-
-	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/auth"
-)
-
-// CSRFHeader carries the session's CSRF token, which the client reads from
-// GET /api/v1/me.
-const CSRFHeader = "X-MealQuest-CSRF"
-
-// requireCSRF passes GET requests to next; every other
-// request must carry CSRFHeader equal to its session's CSRF token or get 403
-// csrf. It runs behind requireSession, which puts the session in the context.
-func requireCSRF(logger *slog.Logger) func(http.Handler) http.Handler {
-	forbidden := apiErrorHandler(logger, http.StatusForbidden, "csrf", "missing or invalid CSRF token")
-	internal := apiErrorHandler(logger, http.StatusInternalServerError, "internal", "internal error")
-	return func(next http.Handler) http.Handler {
-		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-			switch r.Method {
-			case http.MethodGet:
-				next.ServeHTTP(w, r)
-				return
-			}
-			s, ok := auth.SessionFrom(r.Context())
-			if !ok || s.CSRFToken == "" {
-				// An empty token would match a missing header.
-				logger.ErrorContext(r.Context(), "csrf check without a session token", "session", ok)
-				internal(w, r)
-				return
-			}
-			if subtle.ConstantTimeCompare([]byte(r.Header.Get(CSRFHeader)), []byte(s.CSRFToken)) != 1 {
-				forbidden(w, r)
-				return
-			}
-			next.ServeHTTP(w, r)
-		})
-	}
-}

internal/server/csrf_test.go

@@ -1,166 +0,0 @@
-package server
-
-import (
-	"context"
-	"encoding/json"
-	"io"
-	"log/slog"
-	"net/http"
-	"net/http/httptest"
-	"testing"
-
-	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/auth"
-)
-
-const (
-	csrfJSON             = `{"error":{"code":"csrf","message":"missing or invalid CSRF token","retryable":false}}`
-	methodNotAllowedJSON = `{"error":{"code":"method_not_allowed","message":"method not allowed","retryable":false}}`
-)
-
-func TestCSRFThroughRouter(t *testing.T) {
-	t.Parallel()
-
-	router := newTestRouter(t, "dev")
-	for _, tc := range []struct {
-		name, method, path string
-		header             []string // nil sends no CSRF header
-		wantStatus         int
-		wantBody           string
-	}{
-		{"POST without header", http.MethodPost, "/api/v1/me", nil, http.StatusForbidden, csrfJSON},
-		{"POST with wrong header", http.MethodPost, "/api/v1/me", []string{"wrong-token"}, http.StatusForbidden, csrfJSON},
-		{"POST with empty header", http.MethodPost, "/api/v1/me", []string{""}, http.StatusForbidden, csrfJSON},
-		{"POST with token prefix", http.MethodPost, "/api/v1/me", []string{"csrf-token"}, http.StatusForbidden, csrfJSON},
-		{"PATCH without header", http.MethodPatch, "/api/v1/settings/household", nil, http.StatusForbidden, csrfJSON},
-		{"DELETE with wrong header", http.MethodDelete, "/api/v1/me", []string{"wrong-token"}, http.StatusForbidden, csrfJSON},
-		// The right token passes the check and reaches the router, which has
-		// no POST /api/v1/me.
-		{"POST with right header", http.MethodPost, "/api/v1/me", []string{testSession.CSRFToken}, http.StatusMethodNotAllowed, methodNotAllowedJSON},
-		{"PATCH with right header", http.MethodPatch, "/api/v1/settings/household", []string{testSession.CSRFToken}, http.StatusNotFound, notFoundJSON},
-		{"GET without header", http.MethodGet, "/api/v1/me", nil, http.StatusOK, ""},
-		// Only GET is exempt; HEAD and OPTIONS need the header too.
-		{"HEAD without header", http.MethodHead, "/api/v1/me", nil, http.StatusForbidden, csrfJSON},
-		{"OPTIONS without header", http.MethodOptions, "/api/v1/me", nil, http.StatusForbidden, csrfJSON},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			t.Parallel()
-			req := httptest.NewRequest(tc.method, tc.path, nil)
-			req.AddCookie(validSessionCookie)
-			if tc.header != nil {
-				req.Header.Set(CSRFHeader, tc.header[0])
-			}
-			rec := httptest.NewRecorder()
-			router.ServeHTTP(rec, req)
-
-			if rec.Code != tc.wantStatus {
-				t.Errorf("status = %d, want %d (body %s)", rec.Code, tc.wantStatus, rec.Body.String())
-			}
-			if tc.wantBody != "" && rec.Body.String() != tc.wantBody {
-				t.Errorf("body = %s, want %s", rec.Body.String(), tc.wantBody)
-			}
-		})
-	}
-}
-
-func TestCSRFUnauthenticatedGets401(t *testing.T) {
-	t.Parallel()
-
-	req := httptest.NewRequest(http.MethodPost, "/api/v1/me", nil)
-	rec := httptest.NewRecorder()
-	newTestRouter(t, "dev").ServeHTTP(rec, req)
-
-	if rec.Code != http.StatusUnauthorized || rec.Body.String() != unauthenticatedJSON {
-		t.Errorf("response = %d %s, want 401 %s", rec.Code, rec.Body.String(), unauthenticatedJSON)
-	}
-}
-
-func TestRequireCSRF(t *testing.T) {
-	t.Parallel()
-
-	logger := slog.New(slog.NewTextHandler(io.Discard, nil))
-	for _, tc := range []struct {
-		name       string
-		method     string
-		session    *auth.Session
-		header     string
-		wantStatus int
-	}{
-		{"right header reaches handler", http.MethodPost, &testSession, testSession.CSRFToken, http.StatusNoContent},
-		{"wrong header", http.MethodPut, &testSession, "nope", http.StatusForbidden},
-		{"GET needs no header", http.MethodGet, &testSession, "", http.StatusNoContent},
-		{"HEAD needs the header", http.MethodHead, &testSession, "", http.StatusForbidden},
-		{"OPTIONS needs the header", http.MethodOptions, &testSession, "", http.StatusForbidden},
-		{"no session in context", http.MethodPost, nil, "", http.StatusInternalServerError},
-		{"session without token", http.MethodPost, &auth.Session{Subject: "user-123"}, "", http.StatusInternalServerError},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			t.Parallel()
-			called := false
-			h := requireCSRF(logger)(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
-				called = true
-				w.WriteHeader(http.StatusNoContent)
-			}))
-			ctx := context.Background()
-			if tc.session != nil {
-				ctx = auth.WithSession(ctx, *tc.session)
-			}
-			req := httptest.NewRequestWithContext(ctx, tc.method, "/api/v1/anything", nil)
-			if tc.header != "" {
-				req.Header.Set(CSRFHeader, tc.header)
-			}
-			rec := httptest.NewRecorder()
-			h.ServeHTTP(rec, req)
-
-			if rec.Code != tc.wantStatus {
-				t.Errorf("status = %d, want %d", rec.Code, tc.wantStatus)
-			}
-			if called != (tc.wantStatus == http.StatusNoContent) {
-				t.Errorf("handler called = %v with status %d", called, rec.Code)
-			}
-		})
-	}
-}
-
-func TestMe(t *testing.T) {
-	t.Parallel()
-
-	req := httptest.NewRequest(http.MethodGet, "/api/v1/me", nil)
-	req.AddCookie(validSessionCookie)
-	rec := httptest.NewRecorder()
-	newTestRouter(t, "dev").ServeHTTP(rec, req)
-
-	if rec.Code != http.StatusOK {
-		t.Fatalf("status = %d, want 200 (body %s)", rec.Code, rec.Body.String())
-	}
-	if ct := rec.Header().Get("Content-Type"); ct != "application/json" {
-		t.Errorf("Content-Type = %q, want application/json", ct)
-	}
-	if cc := rec.Header().Get("Cache-Control"); cc != "no-store" {
-		t.Errorf("Cache-Control = %q, want no-store", cc)
-	}
-	var got map[string]any
-	if err := json.Unmarshal(rec.Body.Bytes(), &got); err != nil {
-		t.Fatalf("decode %s: %v", rec.Body.String(), err)
-	}
-	want := map[string]any{
-		"name":      "Home Cook",
-		"email":     "cook@example.com",
-		"household": map[string]any{"label": "Our kitchen"},
-		"csrfToken": "csrf-token-123",
-	}
-	gotJSON, _ := json.Marshal(got)
-	wantJSON, _ := json.Marshal(want)
-	if string(gotJSON) != string(wantJSON) {
-		t.Errorf("body = %s, want %s", gotJSON, wantJSON)
-	}
-}
-
-func TestMeNeedsSession(t *testing.T) {
-	t.Parallel()
-
-	rec := httptest.NewRecorder()
-	newTestRouter(t, "dev").ServeHTTP(rec, httptest.NewRequest(http.MethodGet, "/api/v1/me", nil))
-	if rec.Code != http.StatusUnauthorized || rec.Body.String() != unauthenticatedJSON {
-		t.Errorf("response = %d %s, want 401 %s", rec.Code, rec.Body.String(), unauthenticatedJSON)
-	}
-}

internal/server/login_test.go

@@ -1,140 +0,0 @@
-package server
-
-import (
-	"context"
-	"encoding/json"
-	"io"
-	"log/slog"
-	"net/http"
-	"net/http/httptest"
-	"net/url"
-	"testing"
-	"testing/fstest"
-	"time"
-
-	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/auth"
-	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/forwarded"
-	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/store"
-	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/migrations"
-)
-
-// newDiscoveryProvider serves the OIDC discovery document auth.New needs;
-// login only redirects to its authorization endpoint.
-func newDiscoveryProvider(t *testing.T) *httptest.Server {
-	t.Helper()
-	var srv *httptest.Server
-	srv = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if r.URL.Path != "/.well-known/openid-configuration" {
-			http.NotFound(w, r)
-			return
-		}
-		w.Header().Set("Content-Type", "application/json")
-		json.NewEncoder(w).Encode(map[string]any{
-			"issuer":                                srv.URL,
-			"authorization_endpoint":                srv.URL + "/authorize",
-			"token_endpoint":                        srv.URL + "/token",
-			"jwks_uri":                              srv.URL + "/jwks",
-			"userinfo_endpoint":                     srv.URL + "/userinfo",
-			"end_session_endpoint":                  srv.URL + "/end-session/",
-			"response_types_supported":              []string{"code"},
-			"subject_types_supported":               []string{"public"},
-			"id_token_signing_alg_values_supported": []string{"RS256"},
-		})
-	}))
-	t.Cleanup(srv.Close)
-	return srv
-}
-
-// newLoginRouter wires the production router as cmd/server does: the real
-// auth flow and session manager, trusting Traefik only.
-func newLoginRouter(t *testing.T, issuer string) http.Handler {
-	t.Helper()
-	ctx := context.Background()
-	db, err := store.Open(ctx, t.TempDir())
-	if err != nil {
-		t.Fatal(err)
-	}
-	t.Cleanup(func() {
-		if err := db.Close(); err != nil {
-			t.Error(err)
-		}
-	})
-	if err := store.Migrate(ctx, db.Writer, migrations.FS); err != nil {
-		t.Fatal(err)
-	}
-	sessions, err := auth.NewSessionManager(db, 720*time.Hour, 4320*time.Hour)
-	if err != nil {
-		t.Fatal(err)
-	}
-	logger := slog.New(forwarded.LogHandler(slog.NewTextHandler(io.Discard, nil)))
-	flow, err := auth.New(ctx, auth.Config{
-		Issuer:        issuer,
-		ClientID:      "mealquest",
-		ClientSecret:  "client-s3cret",
-		PublicURL:     &url.URL{Scheme: "https", Host: "meals.example.com"},
-		SecretKey:     []byte("server-secret-key"),
-		AllowedGroups: []string{"mealquest-admin"},
-	}, sessions, logger)
-	if err != nil {
-		t.Fatal(err)
-	}
-	trusted, err := forwarded.ParseTrusted(traefik)
-	if err != nil {
-		t.Fatal(err)
-	}
-	r, err := NewRouter(logger, "dev", trusted, flow, sessions,
-		fstest.MapFS{"index.html": {Data: []byte(fixtureIndex)}})
-	if err != nil {
-		t.Fatal(err)
-	}
-	return r
-}
-
-// TestLoginThroughRouter starts a login through the production router. The
-// redirect URI and the Secure login cookie come from MEALQUEST_PUBLIC_URL
-// whatever the direct peer: forwarded headers from an untrusted peer are
-// ignored but never fail sign-in.
-func TestLoginThroughRouter(t *testing.T) {
-	t.Parallel()
-	provider := newDiscoveryProvider(t)
-	router := newLoginRouter(t, provider.URL)
-	// Traefik reaches the service over plain http on its internal address;
-	// the host headers must not leak into the redirect URI.
-	headers := map[string]string{
-		forwarded.HeaderFor:   "203.0.113.7",
-		forwarded.HeaderProto: "https",
-		"X-Forwarded-Host":    "evil.example.com",
-	}
-	tests := []struct {
-		name string
-		peer string
-	}{
-		{"trusted proxy", traefik + ":41000"},
-		{"untrusted peer", "172.17.0.1:5000"},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			t.Parallel()
-			rec := httptest.NewRecorder()
-			router.ServeHTTP(rec, originRequest("http://mealquest:8080"+auth.LoginPath, tt.peer, headers))
-			resp := rec.Result()
-			if resp.StatusCode != http.StatusFound {
-				t.Fatalf("login status = %d, want 302", resp.StatusCode)
-			}
-			loc, err := url.Parse(resp.Header.Get("Location"))
-			if err != nil {
-				t.Fatal(err)
-			}
-			if got, want := loc.Scheme+"://"+loc.Host+loc.Path, provider.URL+"/authorize"; got != want {
-				t.Errorf("redirect to %s, want %s", got, want)
-			}
-			if got, want := loc.Query().Get("redirect_uri"), "https://meals.example.com/auth/callback"; got != want {
-				t.Errorf("redirect_uri = %q, want %q from the public URL", got, want)
-			}
-			cookies := resp.Cookies()
-			if len(cookies) != 1 || cookies[0].Name != "__Host-mealquest_login" || !cookies[0].Secure || !cookies[0].HttpOnly {
-				t.Errorf("login cookies = %v, want one Secure, HttpOnly __Host-mealquest_login", cookies)
-			}
-		})
-	}
-}

internal/server/me.go

@@ -1,52 +0,0 @@
-package server
-
-import (
-	"encoding/json"
-	"log/slog"
-	"net/http"
-
-	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/auth"
-)
-
-// householdLabel is the single shared household identity.
-const householdLabel = "Our kitchen"
-
-type meResponse struct {
-	Name      string        `json:"name"`
-	Email     string        `json:"email"`
-	Household householdInfo `json:"household"`
-	CSRFToken string        `json:"csrfToken"`
-}
-
-type householdInfo struct {
-	Label string `json:"label"`
-}
-
-// me answers GET /api/v1/me with the signed-in member, the household and the
-// session's CSRF token for CSRFHeader.
-func me(logger *slog.Logger) http.HandlerFunc {
-	internal := apiErrorHandler(logger, http.StatusInternalServerError, "internal", "internal error")
-	return func(w http.ResponseWriter, r *http.Request) {
-		s, ok := auth.SessionFrom(r.Context())
-		if !ok {
-			logger.ErrorContext(r.Context(), "GET /api/v1/me without a session")
-			internal(w, r)
-			return
-		}
-		body, err := json.Marshal(meResponse{
-			Name:      s.Name,
-			Email:     s.Email,
-			Household: householdInfo{Label: householdLabel},
-			CSRFToken: s.CSRFToken,
-		})
-		if err != nil {
-			panic(err) // string fields cannot fail to marshal
-		}
-		w.Header().Set("Content-Type", "application/json")
-		w.Header().Set("Cache-Control", "no-store")
-		w.WriteHeader(http.StatusOK)
-		if _, err := w.Write(body); err != nil {
-			logger.WarnContext(r.Context(), "write me response", "error", err)
-		}
-	}
-}

internal/server/origin.go

@@ -1,34 +0,0 @@
-package server
-
-import (
-	"errors"
-	"log/slog"
-	"net/http"
-
-	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/forwarded"
-)
-
-// resolveOrigin resolves every request's client address and scheme with
-// forwarded.Resolve and puts them in the context (read them with
-// forwarded.ClientIP and forwarded.Scheme). Forwarded headers are honoured
-// only from a peer in trusted. A malformed forwarded header from a trusted
-// peer gets 400 bad_request.
-func resolveOrigin(logger *slog.Logger, trusted forwarded.Trusted) func(http.Handler) http.Handler {
-	badRequest := apiErrorHandler(logger, http.StatusBadRequest, "bad_request", "invalid forwarded headers")
-	internal := apiErrorHandler(logger, http.StatusInternalServerError, "internal", "internal error")
-	return func(next http.Handler) http.Handler {
-		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-			o, err := forwarded.Resolve(r, trusted)
-			switch {
-			case errors.Is(err, forwarded.ErrInvalidHeader):
-				logger.WarnContext(r.Context(), "rejected forwarded headers", "peer", r.RemoteAddr, "error", err)
-				badRequest(w, r)
-			case err != nil:
-				logger.ErrorContext(r.Context(), "resolve request origin", "error", err)
-				internal(w, r)
-			default:
-				next.ServeHTTP(w, r.WithContext(forwarded.NewContext(r.Context(), o)))
-			}
-		})
-	}
-}

internal/server/origin_test.go

@@ -1,145 +0,0 @@
-package server
-
-import (
-	"bytes"
-	"encoding/json"
-	"fmt"
-	"io"
-	"log/slog"
-	"net/http"
-	"net/http/httptest"
-	"testing"
-	"testing/fstest"
-
-	"github.com/go-chi/chi/v5"
-
-	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/forwarded"
-)
-
-// traefik is the production proxy's address.
-const traefik = "10.60.1.33"
-
-// probeAuth mounts GET /auth/probe, which reports the request's resolved
-// origin, in place of the real auth flow.
-type probeAuth struct{}
-
-func (probeAuth) Mount(r chi.Router) {
-	r.Get("/auth/probe", func(w http.ResponseWriter, r *http.Request) {
-		ip, ipOK := forwarded.ClientIP(r.Context())
-		scheme, schemeOK := forwarded.Scheme(r.Context())
-		if !ipOK || !schemeOK {
-			http.Error(w, "origin not resolved", http.StatusInternalServerError)
-			return
-		}
-		fmt.Fprintf(w, "%s %s", ip, scheme)
-	})
-}
-
-// newOriginRouter builds the production router trusting Traefik, logging
-// through forwarded.LogHandler as cmd/server does.
-func newOriginRouter(t *testing.T, logs io.Writer) http.Handler {
-	t.Helper()
-	trusted, err := forwarded.ParseTrusted(traefik)
-	if err != nil {
-		t.Fatal(err)
-	}
-	logger := slog.New(forwarded.LogHandler(slog.NewJSONHandler(logs, nil)))
-	r, err := NewRouter(logger, "dev", trusted, probeAuth{}, stubSessions{},
-		fstest.MapFS{"index.html": {Data: []byte(fixtureIndex)}})
-	if err != nil {
-		t.Fatal(err)
-	}
-	return r
-}
-
-func originRequest(target, peer string, headers map[string]string) *http.Request {
-	req := httptest.NewRequest(http.MethodGet, target, nil)
-	req.RemoteAddr = peer
-	for k, v := range headers {
-		req.Header.Set(k, v)
-	}
-	return req
-}
-
-func TestRouterResolvesOrigin(t *testing.T) {
-	t.Parallel()
-	spoofed := map[string]string{forwarded.HeaderFor: "203.0.113.7", forwarded.HeaderProto: "https"}
-	tests := []struct {
-		name string
-		peer string
-		want string
-	}{
-		{"trusted proxy's forwarded headers are honoured", traefik + ":41000", "203.0.113.7 https"},
-		{"untrusted peer spoofing them is ignored", "198.51.100.9:5000", "198.51.100.9 http"},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			t.Parallel()
-			rec := httptest.NewRecorder()
-			newOriginRouter(t, io.Discard).ServeHTTP(rec, originRequest("/auth/probe", tt.peer, spoofed))
-			if rec.Code != http.StatusOK || rec.Body.String() != tt.want {
-				t.Errorf("probe = %d %q, want 200 %q", rec.Code, rec.Body.String(), tt.want)
-			}
-		})
-	}
-}
-
-func TestRouterLogsResolvedClientIP(t *testing.T) {
-	t.Parallel()
-	spoofed := map[string]string{forwarded.HeaderFor: "203.0.113.7", forwarded.HeaderProto: "https"}
-	tests := []struct {
-		name string
-		peer string
-		want string
-	}{
-		{"trusted proxy", traefik + ":41000", "203.0.113.7"},
-		{"untrusted peer spoofing", "198.51.100.9:5000", "198.51.100.9"},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			t.Parallel()
-			var logs bytes.Buffer
-			// A failed session lookup is logged with the request's context.
-			req := originRequest("/api/v1/me", tt.peer, spoofed)
-			req.AddCookie(brokenSessionCookie)
-			rec := httptest.NewRecorder()
-			newOriginRouter(t, &logs).ServeHTTP(rec, req)
-			if rec.Code != http.StatusInternalServerError {
-				t.Fatalf("status = %d, want 500", rec.Code)
-			}
-			var line map[string]any
-			if err := json.Unmarshal(logs.Bytes(), &line); err != nil {
-				t.Fatalf("log %q: %v", logs.String(), err)
-			}
-			if line["msg"] != "look up session" || line[forwarded.LogAttr] != tt.want {
-				t.Errorf("log = %v, want the session error with %s=%s", line, forwarded.LogAttr, tt.want)
-			}
-		})
-	}
-}
-
-func TestRouterRejectsMalformedForwardedHeaders(t *testing.T) {
-	t.Parallel()
-	const badRequestJSON = `{"error":{"code":"bad_request","message":"invalid forwarded headers","retryable":false}}`
-	for _, headers := range []map[string]string{
-		{forwarded.HeaderFor: "not-an-ip"},
-		{forwarded.HeaderProto: "ftp"},
-	} {
-		var logs bytes.Buffer
-		rec := httptest.NewRecorder()
-		newOriginRouter(t, &logs).ServeHTTP(rec, originRequest("/health", traefik+":41000", headers))
-		if rec.Code != http.StatusBadRequest || rec.Body.String() != badRequestJSON {
-			t.Errorf("%v: response = %d %s, want 400 %s", headers, rec.Code, rec.Body.String(), badRequestJSON)
-		}
-		if !bytes.Contains(logs.Bytes(), []byte("rejected forwarded headers")) {
-			t.Errorf("%v: logs = %q, want the rejection logged", headers, logs.String())
-		}
-
-		// The same headers from an untrusted peer are not examined at all.
-		rec = httptest.NewRecorder()
-		newOriginRouter(t, io.Discard).ServeHTTP(rec, originRequest("/health", "198.51.100.9:5000", headers))
-		if rec.Code != http.StatusOK {
-			t.Errorf("%v from an untrusted peer: status = %d, want 200", headers, rec.Code)
-		}
-	}
-}

internal/server/server.go

@@ -9,7 +9,6 @@ import (
 
 	"github.com/go-chi/chi/v5"
 
-	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/forwarded"
 	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/frontend"
 )
 
@@ -22,13 +21,11 @@ type RouteMounter interface {
 	Mount(r chi.Router)
 }
 
-// NewRouter returns the HTTP handler for the service. Every request first
-// has its client address and scheme resolved, honouring forwarded headers
-// only from a peer in trusted (see resolveOrigin). version is reported by
+// NewRouter returns the HTTP handler for the service. version is reported by
 // GET /health; auth mounts the /auth routes; sessions guards /api/v1 and
 // /media; assets is the web build served for every other GET. /health, /auth
-// and the web build are public. Requests to /api/v1 other than GET also need the session's CSRF token in CSRFHeader.
-func NewRouter(logger *slog.Logger, version string, trusted forwarded.Trusted, auth RouteMounter, sessions SessionLookup, assets fs.FS) (http.Handler, error) {
+// and the web build are public.
+func NewRouter(logger *slog.Logger, version string, auth RouteMounter, sessions SessionLookup, assets fs.FS) (http.Handler, error) {
 	notFound := apiErrorHandler(logger, http.StatusNotFound, "not_found", "not found")
 	methodNotAllowed := apiErrorHandler(logger, http.StatusMethodNotAllowed, "method_not_allowed", "method not allowed")
 
@@ -38,7 +35,6 @@ func NewRouter(logger *slog.Logger, version string, trusted forwarded.Trusted, a
 	}
 
 	r := chi.NewRouter()
-	r.Use(resolveOrigin(logger, trusted))
 	r.MethodNotAllowed(methodNotAllowed)
 	r.NotFound(notFound)
 
@@ -48,17 +44,15 @@ func NewRouter(logger *slog.Logger, version string, trusted forwarded.Trusted, a
 	// rather than being added with Use: chi skips a subrouter's middleware
 	// when it has no routes, which would leave it unguarded.
 	signedIn := requireSession(logger, sessions)
-	csrf := requireCSRF(logger)
 	apiV1, media := chi.NewRouter(), chi.NewRouter()
 	for _, sub := range []*chi.Mux{apiV1, media} {
 		sub.MethodNotAllowed(methodNotAllowed)
 		sub.NotFound(notFound)
 	}
-	apiV1.Get("/me", me(logger))
 	r.Route("/api", func(r chi.Router) {
 		r.MethodNotAllowed(methodNotAllowed)
 		r.NotFound(notFound)
-		r.Mount("/v1", signedIn(csrf(apiV1)))
+		r.Mount("/v1", signedIn(apiV1))
 	})
 	r.Mount("/media", signedIn(media))
 	// Catch-all for the PWA. Unknown /auth paths reach the frontend handler,

internal/server/server_test.go

@@ -27,7 +27,7 @@ func newTestRouter(t *testing.T, version string) http.Handler {
 		"index.html":             {Data: []byte(fixtureIndex)},
 		"assets/index-AbC123.js": {Data: []byte(fixtureAsset)},
 	}
-	r, err := NewRouter(logger, version, nil, stubAuth{}, stubSessions{}, assets)
+	r, err := NewRouter(logger, version, stubAuth{}, stubSessions{}, assets)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -139,11 +139,9 @@ func TestReservedPathsNotFound(t *testing.T) {
 		t.Run(tt.method+" "+tt.path, func(t *testing.T) {
 			t.Parallel()
 
-			// Signed in with the CSRF token, so /api/v1 and /media reach
-			// their routers.
+			// Signed in, so /api/v1 and /media reach their routers.
 			req := httptest.NewRequest(tt.method, tt.path, nil)
 			req.AddCookie(validSessionCookie)
-			req.Header.Set(CSRFHeader, testSession.CSRFToken)
 			rec := httptest.NewRecorder()
 			router.ServeHTTP(rec, req)
 

internal/server/session.go

@@ -15,8 +15,8 @@ type SessionLookup interface {
 }
 
 // requireSession is the RequireSession middleware. It passes requests with a
-// live session to next with the session in the context (read it with
-// auth.SessionFrom or auth.ActorFrom); others get 401 unauthenticated.
+// live session to next with the session's actor in the context (read it with
+// auth.ActorFrom); others get 401 unauthenticated.
 func requireSession(logger *slog.Logger, sessions SessionLookup) func(http.Handler) http.Handler {
 	unauthenticated := apiErrorHandler(logger, http.StatusUnauthorized, "unauthenticated", "sign in required")
 	internal := apiErrorHandler(logger, http.StatusInternalServerError, "internal", "internal error")
@@ -30,7 +30,7 @@ func requireSession(logger *slog.Logger, sessions SessionLookup) func(http.Handl
 				logger.ErrorContext(r.Context(), "look up session", "error", err)
 				internal(w, r)
 			default:
-				next.ServeHTTP(w, r.WithContext(auth.WithSession(r.Context(), s)))
+				next.ServeHTTP(w, r.WithContext(auth.WithActor(r.Context(), s.Actor())))
 			}
 		})
 	}

internal/server/session_test.go

@@ -21,11 +21,10 @@ var (
 	validSessionCookie  = &http.Cookie{Name: auth.SessionCookieName, Value: "valid"}
 	brokenSessionCookie = &http.Cookie{Name: auth.SessionCookieName, Value: "broken"}
 	testSession         = auth.Session{
-		Subject:   "user-123",
-		Email:     "cook@example.com",
-		Name:      "Home Cook",
-		Groups:    []string{"mealquest-admin"},
-		CSRFToken: "csrf-token-123",
+		Subject: "user-123",
+		Email:   "cook@example.com",
+		Name:    "Home Cook",
+		Groups:  []string{"mealquest-admin"},
 	}
 )