Merge branch 'main' of https://github.com/pocket-id/pocket-id into actors/config

backend/internal/bootstrap/router_bootstrap.go

@@ -68,7 +68,10 @@ func initEngine() (*gin.Engine, error) {
 
 	r := gin.New()
 	initLogger(r)
-	configureEngine(r)
+	err := configureEngine(r)
+	if err != nil {
+		return nil, err
+	}
 	registerGlobalMiddleware(r)
 
 	return r, nil
@@ -86,9 +89,10 @@ func setGinMode() {
 	}
 }
 
-func configureEngine(r *gin.Engine) {
-	if !common.EnvConfig.TrustProxy {
-		_ = r.SetTrustedProxies(nil)
+func configureEngine(r *gin.Engine) error {
+	err := r.SetTrustedProxies(common.EnvConfig.TrustProxy)
+	if err != nil {
+		return fmt.Errorf("failed to configure trusted proxies: %w", err)
 	}
 
 	if common.EnvConfig.TrustedPlatform != "" {
@@ -99,6 +103,8 @@ func configureEngine(r *gin.Engine) {
 		common.Name,
 		otelgin.WithFilter(shouldTraceRequest)),
 	)
+
+	return nil
 }
 
 // shouldTraceRequest reports whether an incoming request should be traced.

backend/internal/bootstrap/services_bootstrap.go

@@ -100,9 +100,10 @@ func initServices(
 		DB:         db,
 		HTTPClient: httpClient,
 		Config: oidc.Config{
-			BaseURL:      common.EnvConfig.AppURL,
-			TokenBaseURL: common.EnvConfig.AppURL,
-			Secret:       common.EnvConfig.EncryptionKey,
+			BaseURL:                   common.EnvConfig.AppURL,
+			TokenBaseURL:              common.EnvConfig.AppURL,
+			Secret:                    common.EnvConfig.EncryptionKey,
+			AllowInsecureCallbackURLs: common.EnvConfig.AllowInsecureCallbackURLs,
 		},
 		Signer:       svc.jwtService,
 		CustomClaims: svc.customClaimService,