Allow redirector to be forced, bypassed, and use a bypass list

Author: mcasperson

cmd/azure/octoterra.go

@@ -7,14 +7,14 @@ import (
 	"github.com/OctopusSolutionsEngineering/OctopusTerraformExport/cmd/internal/environment"
 	"github.com/OctopusSolutionsEngineering/OctopusTerraformExport/cmd/internal/logger"
 	"github.com/OctopusSolutionsEngineering/OctopusTerraformExport/cmd/internal/strutil"
+	"github.com/samber/lo"
 	"go.uber.org/zap"
 	"io"
 	"log"
 	"net/http"
 	"net/url"
 	"os"
 	"path/filepath"
-	"strconv"
 	"strings"
 )
 
@@ -41,27 +41,13 @@ func octoterraHandler(w http.ResponseWriter, r *http.Request) {
 	// Allow the more sensitive values to be passed as headers
 	apiKey := r.Header.Get("X-Octopus-ApiKey")
 	accessToken := r.Header.Get("X-Octopus-AccessToken")
-	octopusUrl := r.Header.Get("X-Octopus-Url")
+	url := r.Header.Get("X-Octopus-Url")
 	redirectorRedirections := r.Header.Get("X_REDIRECTION_REDIRECTIONS")
 	redirectorApiKey := r.Header.Get("X_REDIRECTION_API_KEY")
 	redirectorServiceApiKey, _ := os.LookupEnv("REDIRECTION_SERVICE_API_KEY")
 	redirectorHost, _ := os.LookupEnv("REDIRECTION_HOST")
-	disableRedirector, _ := os.LookupEnv("DISABLE_REDIRECTION")
 
-	parsedUrl, err := url.Parse(octopusUrl)
-
-	if err != nil {
-		handleError(err, w)
-		return
-	}
-
-	disableRedirectorParsed, err := strconv.ParseBool(disableRedirector)
-
-	if err != nil {
-		disableRedirectorParsed = false
-	}
-
-	useRedirector := !disableRedirectorParsed && !hostIsCloudOrLocal(parsedUrl.Hostname()) && redirectorServiceApiKey != "" && redirectorHost != ""
+	enableRedirector, err := useRedirector(url, redirectorServiceApiKey, redirectorHost, redirectorRedirections, redirectorApiKey)
 
 	respBytes, err := io.ReadAll(r.Body)
 
@@ -119,12 +105,12 @@ func octoterraHandler(w http.ResponseWriter, r *http.Request) {
 		commandLineArgs = append(commandLineArgs, "-accessToken", accessToken)
 	}
 
-	if octopusUrl != "" {
-		commandLineArgs = append(commandLineArgs, "-url", octopusUrl)
+	if url != "" {
+		commandLineArgs = append(commandLineArgs, "-url", url)
 	}
 
-	if useRedirector {
-		zap.L().Info("Using redirector for host " + octopusUrl)
+	if enableRedirector {
+		zap.L().Info("Using redirector for host " + url)
 		commandLineArgs = append(commandLineArgs, "-useRedirector")
 		commandLineArgs = append(commandLineArgs, "-redirectorHost", redirectorHost)
 		commandLineArgs = append(commandLineArgs, "-redirectorServiceApiKey", redirectorServiceApiKey)
@@ -158,6 +144,35 @@ func octoterraHandler(w http.ResponseWriter, r *http.Request) {
 	}
 }
 
+func useRedirector(octopusUrl string, redirectorServiceApiKey string, redirectorHost string, redirections string, redirectorApiKey string) (bool, error) {
+	parsedUrl, err := url.Parse(octopusUrl)
+
+	if err != nil {
+		return false, err
+	}
+
+	bypassList := environment.GetRedirectionBypass()
+
+	// Allow bypassing specific domains via environment variable
+	if lo.Contains(bypassList, parsedUrl.Hostname()) {
+		return false, nil
+	}
+
+	// Allow forcing all traffic through the redirection service
+	if environment.GetRedirectionForce() {
+		return true, nil
+	}
+
+	// All redirections can be disabled via environment variable
+	if environment.GetRedirectionDisable() {
+		return false, nil
+	}
+
+	return redirectorServiceApiKey != "" && redirectorHost != "" &&
+		(!hostIsCloudOrLocal(parsedUrl.Hostname()) ||
+			(redirections != "" && redirectorApiKey != "")), nil
+}
+
 // sanitizeConfig removes sensitive information from the config so it is not
 // persisted to the disk.
 func sanitizeConfig(rawConfig []byte) ([]byte, error) {

cmd/internal/environment/environment.go

@@ -1,6 +1,12 @@
 package environment
 
-import "os"
+import (
+	"encoding/json"
+	"os"
+	"strings"
+
+	"go.uber.org/zap"
+)
 
 func GetPort() string {
 	// Get the port from the environment variable
@@ -13,3 +19,29 @@ func GetPort() string {
 	}
 	return port
 }
+
+func GetRedirectionBypass() []string {
+	hostnames := []string{}
+	hostnamesJson := os.Getenv("REDIRECTION_BYPASS")
+	if hostnamesJson == "" {
+		return []string{} // Default to empty slice if not set
+	}
+
+	err := json.Unmarshal([]byte(hostnamesJson), &hostnames)
+	if err != nil {
+		zap.L().Error("Error parsing JSON:", zap.Error(err))
+		return []string{}
+	}
+
+	return hostnames
+}
+
+func GetRedirectionForce() bool {
+	redirectionForce := os.Getenv("REDIRECTION_FORCE")
+	return strings.ToLower(redirectionForce) == "true"
+}
+
+func GetRedirectionDisable() bool {
+	redirectionForce := os.Getenv("REDIRECTION_DISABLE")
+	return strings.ToLower(redirectionForce) == "true"
+}