Disallow proxy server-side when disabled (#578)

bff/transport/rest/ginutil/util.go

@@ -14,6 +14,12 @@ func BadRequest(c *gin.Context, err error) {
 	})
 }
 
+func Forbidden(c *gin.Context, err error) {
+	c.JSON(403, gin.H{
+		"error": err.Error(),
+	})
+}
+
 func Success(c *gin.Context) {
 	c.JSON(200, gin.H{
 		"status": "success",

bff/transport/rest/proxy/proxy.go

@@ -1,16 +1,23 @@
 package proxy
 
 import (
+	"errors"
 	"io"
 	"net/http"
 	"net/url"
 	"time"
 
 	"github.com/gin-gonic/gin"
+	"github.com/harryzcy/mailbox-browser/bff/config"
 	"github.com/harryzcy/mailbox-browser/bff/transport/rest/ginutil"
 )
 
 func Proxy(ctx *gin.Context) {
+	if !config.PROXY_ENABLE {
+		ginutil.Forbidden(ctx, errors.New("proxy disabled"))
+		return
+	}
+
 	target, err := url.QueryUnescape(ctx.Query("l"))
 	if err != nil {
 		ginutil.InternalError(ctx, err)

bff/transport/rest/proxy/proxy_test.go

@@ -0,0 +1,31 @@
+package proxy
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"testing"
+
+	"github.com/gin-gonic/gin"
+	"github.com/harryzcy/mailbox-browser/bff/config"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestProxy(t *testing.T) {
+	original := config.PROXY_ENABLE
+	config.PROXY_ENABLE = false
+	defer func() {
+		config.PROXY_ENABLE = original
+	}()
+
+	w := httptest.NewRecorder()
+	ctx, _ := gin.CreateTestContext(w)
+
+	Proxy(ctx)
+	assert.Equal(t, http.StatusForbidden, w.Code)
+}
+
+func TestMain(m *testing.M) {
+	gin.SetMode(gin.TestMode)
+	os.Exit(m.Run())
+}

cloudflare/functions/proxy.ts

@@ -1,4 +1,15 @@
-export const onRequest: PagesFunction = async (context) => {
+import { Env } from '../src/config'
+
+export const onRequest: PagesFunction<Env> = async (context) => {
+  if (!context.env.PROXY_ENABLE) {
+    return new Response(
+      JSON.stringify({
+        reason: 'proxy disabled'
+      }),
+      { status: 403 }
+    )
+  }
+
   const url = context.request.url
   const { searchParams } = new URL(url)
   const target = searchParams.get('l')