refactor: consolidate cookie package into captcha package

LaurenceJJones · LaurenceJJones · commit 9b06567c8e2c · 2025-11-21T10:54:21.000Z
- Move CookieGenerator struct and methods from internal/cookie to internal/remediation/captcha
- Remove internal/cookie package as it was only used by captcha
- All cookie-related functionality now lives in the captcha package
- Simplifies codebase by removing unnecessary package separation
diff --git a/.vagrant/bundler/global.sol b/.vagrant/bundler/global.sol
@@ -0,0 +1 @@
+{"dependencies":[["racc",["~> 1.4"]],["nokogiri",["~> 1.6"]],["diffy",[">= 0"]],["rexml",[">= 0"]],["xml-simple",[">= 0"]],["logger",[">= 0"]],["mime-types-data",["~> 3.2025",">= 3.2025.0507"]],["mime-types",[">= 0"]],["io-console",["~> 0.5"]],["reline",[">= 0"]],["formatador",[">= 0.2","< 2.0"]],["excon",["~> 1.0"]],["builder",[">= 0"]],["fog-core",["~> 2"]],["ruby-libvirt",[">= 0.7.0"]],["json",[">= 0"]],["fog-xml",["~> 0.1.1"]],["multi_json",["~> 1.10"]],["fog-json",[">= 0"]],["fog-libvirt",[">= 0.6.0"]],["vagrant-libvirt",["= 0.12.2"]]],"checksum":"dace3d7f3fcba18ce91d5eac7b88fdd803e91799bc4c56ac0ebfa2e34c3e65bd","vagrant_version":"2.4.7"}
diff --git a/.vagrant/machines/default/libvirt/action_provision b/.vagrant/machines/default/libvirt/action_provision
@@ -0,0 +1 @@
+1.5:ecca97ac-c75c-466e-93c5-6117ff74e3d6
diff --git a/.vagrant/machines/default/libvirt/box_meta b/.vagrant/machines/default/libvirt/box_meta
@@ -0,0 +1 @@
+{"name":"debian/bookworm64","version":"12.20230615.1","provider":"libvirt","directory":"boxes/debian-VAGRANTSLASH-bookworm64/12.20230615.1/libvirt"}
diff --git a/.vagrant/machines/default/libvirt/created_networks b/.vagrant/machines/default/libvirt/created_networks
@@ -0,0 +1,2 @@
+dd001c62-67dd-464b-b1ee-38b29077c763
+67a8d9cb-3a8e-49fa-9055-4b247899b2d8
diff --git a/.vagrant/machines/default/libvirt/creator_uid b/.vagrant/machines/default/libvirt/creator_uid
@@ -0,0 +1 @@
+1000
diff --git a/.vagrant/machines/default/libvirt/id b/.vagrant/machines/default/libvirt/id
@@ -0,0 +1 @@
+ecca97ac-c75c-466e-93c5-6117ff74e3d6
diff --git a/.vagrant/machines/default/libvirt/index_uuid b/.vagrant/machines/default/libvirt/index_uuid
@@ -0,0 +1 @@
+71644354ce1047ae9a58557ac3882ddd
diff --git a/.vagrant/machines/default/libvirt/logs/ssh-forwarding-*_9090-192.168.121.33_9090.log b/.vagrant/machines/default/libvirt/logs/ssh-forwarding-*_9090-192.168.121.33_9090.log
@@ -0,0 +1 @@
+Warning: Permanently added '192.168.121.33' (ED25519) to the list of known hosts.
diff --git a/.vagrant/machines/default/libvirt/pids/ssh_9090.pid b/.vagrant/machines/default/libvirt/pids/ssh_9090.pid
@@ -0,0 +1 @@
+142557
diff --git a/.vagrant/machines/default/libvirt/private_key b/.vagrant/machines/default/libvirt/private_key
@@ -0,0 +1,8 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAA
+AAtzc2gtZWQyNTUxOQAAACBBHbYrOCffqzfPzvLIhHqzss3ZT5WTAgH5+CkL
+TpOiRQAAAJCIrbxriK28awAAAAtzc2gtZWQyNTUxOQAAACBBHbYrOCffqzfP
+zvLIhHqzss3ZT5WTAgH5+CkLTpOiRQAAAECsv1yo+qGlPlOZDshCpAzP2Rsw
+bsLaqDh0nsJ8uLR9B0Edtis4J9+rN8/O8siEerOyzdlPlZMCAfn4KQtOk6JF
+AAAAB3ZhZ3JhbnQBAgMEBQY=
+-----END OPENSSH PRIVATE KEY-----
diff --git a/.vagrant/machines/default/libvirt/synced_folders b/.vagrant/machines/default/libvirt/synced_folders
@@ -0,0 +1 @@
+{"rsync":{"/vagrant":{"type":"rsync","nfs_version":"4","nfs_udp":false,"guestpath":"/vagrant","hostpath":"/opt/cs-haproxy-spoa-bouncer","disabled":false,"rsync__exclude":[".git/","node_modules/","*.log"],"__vagrantfile":true,"exclude":[".git/","node_modules/","*.log"],"owner":"vagrant","group":"vagrant"}}}
diff --git a/.vagrant/machines/default/libvirt/vagrant_cwd b/.vagrant/machines/default/libvirt/vagrant_cwd
@@ -0,0 +1 @@
+/opt/cs-haproxy-spoa-bouncer
diff --git a/.vagrant/rgloader/loader.rb b/.vagrant/rgloader/loader.rb
@@ -0,0 +1,12 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: BUSL-1.1
+
+# This file loads the proper rgloader/loader.rb file that comes packaged
+# with Vagrant so that encoded files can properly run with Vagrant.
+
+if ENV["VAGRANT_INSTALLER_EMBEDDED_DIR"]
+  require File.expand_path(
+    "rgloader/loader", ENV["VAGRANT_INSTALLER_EMBEDDED_DIR"])
+else
+  raise "Encoded files can't be read outside of the Vagrant installer."
+end
diff --git a/internal/cookie/root.go b/internal/cookie/root.go
diff --git a/internal/remediation/captcha/root.go b/internal/remediation/captcha/root.go
@@ -2,6 +2,7 @@ package captcha
 
 import (
 	"context"
+	"encoding/base64"
 	"encoding/json"
 	"errors"
 	"fmt"
@@ -11,7 +12,7 @@ import (
 	"strings"
 	"time"
 
-	"github.com/crowdsecurity/crowdsec-spoa/internal/cookie"
+	"github.com/crowdsecurity/go-cs-lib/ptr"
 	"github.com/crowdsecurity/crowdsec-spoa/internal/remediation"
 	"github.com/google/uuid"
 	"github.com/negasus/haproxy-spoe-go/action"
@@ -28,20 +29,88 @@ const (
 	MaxTimeout = 300
 )
 
+// CookieGenerator handles cookie configuration and generation for captcha
+type CookieGenerator struct {
+	Secure   string     `yaml:"secure"`    // Secure sets the secure flag on the cookie, valid arguments are "auto", "always", "never". "auto" relies on the `ssl_fc` flag from HAProxy
+	HTTPOnly *bool      `yaml:"http_only"` // HttpOnly sets the HttpOnly flag on the cookie
+	Secret   string     `yaml:"secret"`    // Secret used for signing cookies (required for stateless cookies)
+	Name     string     `yaml:"-"`         // Name of the cookie, usually set by the remediation. EG "crowdsec_captcha"
+	logger   *log.Entry `yaml:"-"`          // logger passed from the remediation
+}
+
+func (c *CookieGenerator) Init(logger *log.Entry, name, secret string) {
+	c.logger = logger.WithField("type", "cookie")
+	c.Name = name
+	if c.Secret == "" {
+		c.Secret = secret
+	}
+	c.SetDefaults()
+}
+
+func (c *CookieGenerator) SetDefaults() {
+	// Default Secure to auto
+	if c.Secure == "" {
+		c.Secure = "auto"
+	}
+	// Default httpOnly to true
+	if c.HTTPOnly == nil {
+		c.HTTPOnly = ptr.Of(true)
+	}
+	// Note: Cookies are always signed (required for stateless design)
+}
+
+func (c *CookieGenerator) IsValid() error {
+	//TODO
+	return nil
+}
+
+func (c *CookieGenerator) GenerateUnsetCookie(ssl *bool) (*http.Cookie, error) {
+	cookie := &http.Cookie{
+		Name:     c.Name,
+		Value:    "",
+		MaxAge:   -1,
+		HttpOnly: *c.HTTPOnly,
+		Secure:   false,
+		SameSite: http.SameSiteStrictMode,
+		Path:     "/",
+	}
+
+	switch c.Secure {
+	case "auto":
+		if ssl != nil {
+			cookie.Secure = *ssl
+		} else {
+			c.logger.Warn("ssl flag not set, defaulting to false")
+		}
+	case "always":
+		cookie.Secure = true
+	}
+
+	return cookie, urlEncodeValue(cookie)
+}
+
+func urlEncodeValue(cookie *http.Cookie) error {
+	cookie.Value = base64.URLEncoding.EncodeToString([]byte(cookie.Value))
+	if len(cookie.String()) > 4096 {
+		return fmt.Errorf("cookie value too long")
+	}
+	return nil
+}
+
 type Captcha struct {
-	Provider            string                 `yaml:"provider"`             // Captcha Provider
-	SecretKey           string                 `yaml:"secret_key"`           // Captcha Provider Secret Key
-	SiteKey             string                 `yaml:"site_key"`             // Captcha Provider Site Key
-	FallbackRemediation string                 `yaml:"fallback_remediation"` // if captcha configuration is invalid what should we fallback too
-	Timeout             int                    `yaml:"timeout"`              // HTTP client timeout in seconds (default: 5)
-	CookieGenerator     cookie.CookieGenerator `yaml:"cookie"`               // CookieGenerator to generate cookies
-	PendingTTL          string                 `yaml:"pending_ttl"`          // TTL for pending captcha tokens (default: 30m)
-	PassedTTL           string                 `yaml:"passed_ttl"`           // TTL for passed captcha tokens (default: 24h)
-	CookieSecret        string                 `yaml:"cookie_secret"`        // Secret for signing captcha cookies (defaults to secret_key if not set)
-	logger              *log.Entry             `yaml:"-"`
-	client              *http.Client           `yaml:"-"`
-	parsedPendingTTL    time.Duration          `yaml:"-"`
-	parsedPassedTTL     time.Duration          `yaml:"-"`
+	Provider            string         `yaml:"provider"`             // Captcha Provider
+	SecretKey           string         `yaml:"secret_key"`           // Captcha Provider Secret Key
+	SiteKey             string         `yaml:"site_key"`             // Captcha Provider Site Key
+	FallbackRemediation string         `yaml:"fallback_remediation"` // if captcha configuration is invalid what should we fallback too
+	Timeout             int            `yaml:"timeout"`              // HTTP client timeout in seconds (default: 5)
+	CookieGenerator     CookieGenerator `yaml:"cookie"`               // CookieGenerator to generate cookies
+	PendingTTL          string         `yaml:"pending_ttl"`          // TTL for pending captcha tokens (default: 30m)
+	PassedTTL           string         `yaml:"passed_ttl"`           // TTL for passed captcha tokens (default: 24h)
+	CookieSecret        string         `yaml:"cookie_secret"`        // Secret for signing captcha cookies (defaults to secret_key if not set)
+	logger              *log.Entry     `yaml:"-"`
+	client              *http.Client   `yaml:"-"`
+	parsedPendingTTL    time.Duration  `yaml:"-"`
+	parsedPassedTTL     time.Duration  `yaml:"-"`
 }
 
 func (c *Captcha) Init(logger *log.Entry) error {

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1 @@`
	`1`	+{"dependencies":[["racc",["~> 1.4"]],["nokogiri",["~> 1.6"]],["diffy",[">= 0"]],["rexml",[">= 0"]],["xml-simple",[">= 0"]],["logger",[">= 0"]],["mime-types-data",["~> 3.2025",">= 3.2025.0507"]],["mime-types",[">= 0"]],["io-console",["~> 0.5"]],["reline",[">= 0"]],["formatador",[">= 0.2","< 2.0"]],["excon",["~> 1.0"]],["builder",[">= 0"]],["fog-core",["~> 2"]],["ruby-libvirt",[">= 0.7.0"]],["json",[">= 0"]],["fog-xml",["~> 0.1.1"]],["multi_json",["~> 1.10"]],["fog-json",[">= 0"]],["fog-libvirt",[">= 0.6.0"]],["vagrant-libvirt",["= 0.12.2"]]],"checksum":"dace3d7f3fcba18ce91d5eac7b88fdd803e91799bc4c56ac0ebfa2e34c3e65bd","vagrant_version":"2.4.7"}
Original file line number	Diff line number	Diff line change
`@@ -0,0 +1 @@`
	`1`	`+1.5:ecca97ac-c75c-466e-93c5-6117ff74e3d6`
Original file line number	Diff line number	Diff line change
`@@ -0,0 +1 @@`
	`1`	`+{"name":"debian/bookworm64","version":"12.20230615.1","provider":"libvirt","directory":"boxes/debian-VAGRANTSLASH-bookworm64/12.20230615.1/libvirt"}`
Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,2 @@`
	`1`	`+dd001c62-67dd-464b-b1ee-38b29077c763`
	`2`	`+67a8d9cb-3a8e-49fa-9055-4b247899b2d8`
Original file line number	Diff line number	Diff line change
`@@ -0,0 +1 @@`
	`1`	`+Warning: Permanently added '192.168.121.33' (ED25519) to the list of known hosts.`