Allow per-app allow/deny.

2026-08-06 13:53:24 -04:00
parent c15a1cc14c
commit 8ce2919627
19 changed files with 1151 additions and 187 deletions
@@ -4,7 +4,12 @@ package authproxy
 // It remembers which app host the user was visiting and where to send them
 // after sign-in.
 type stateClaims struct {
-	Host  string `json:"h"` // app host the user was visiting
+	Host string `json:"h"` // app host the user was visiting
+	// App is the dokku app that host belongs to. It rides through the flow
+	// because the callback runs on the auth host, which may be a different
+	// app than the one being signed in to — and it is that destination app's
+	// access lists that decide.
+	App   string `json:"a"`
 	RD    string `json:"r"` // relative path to return to
 	Proto string `json:"p"` // http or https
 	Nonce string `json:"n"`