dunglas / mercure / 30115936829

89%

master: 93%

Build Type

push

github

Committed by web-flow

Commit Message

feat!: derive hub public URL from the request (#1312)

The hub validated tokens against a single static resource_identifier and
built the RFC 9728 metadata URL once at startup, so a hub reachable
through several public URLs needed manual, duplicated domain config.

Derive the identity per request instead: the OAuth 2.0 resource
identifier (aud) and the protected resource metadata now come from the
public URL the client contacted, resolved in the Caddy module from
Caddy request placeholders (trusted_proxies aware) and injected into the
request context. Several domains work with no configuration; the site
host matching already restricts which Host reaches the hub.

Add a public_urls allowlist that pins the accepted scheme and host and
rejects an unlisted origin with 421 Misdirected Request, for a catch-all
site block that would otherwise let a client pick the derived identity.
resource_identifier stays as an optional override to pin one canonical
audience across every domain.

BREAKING CHANGE: NewHub no longer requires a resource identifier; it
derives one per request when none is configured.

Coverage Stats

97 of 99 new or added lines in 8 files covered. (97.98%)

4 existing lines in 2 files now uncovered.

2540 of 2878 relevant lines covered (88.26%)

111.1 hits per line