From b2291e0704aff8f5b143d8163b977be16a79f0ba Mon Sep 17 00:00:00 2001
From: shimoncohen <shimoncohen655@gmail.com>
Date: Tue, 21 Jul 2026 11:03:05 +0300
Subject: [PATCH 1/2] feat(auth): export buildOpaBody for reuse by dependent
 gateways
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Extract the OPA request-body construction out of opaAuth into a
buildOpaBody(r) helper and export it. Gateways that build on this base
image (nginx-s3-gateway) run a combined OPA+credentials auth handler and
were rebuilding the OPA input themselves — with a stale header whitelist
that diverged from this image's denylist filtering. Exporting the builder
lets them send OPA an identical input contract instead.

opaAuth behavior is unchanged (pure extraction).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 docker-image/nginx-config/auth.js | 27 ++++++++++++++++-----------
 1 file changed, 16 insertions(+), 11 deletions(-)

diff --git a/docker-image/nginx-config/auth.js b/docker-image/nginx-config/auth.js
index ae5855e..29a2866 100644
--- a/docker-image/nginx-config/auth.js
+++ b/docker-image/nginx-config/auth.js
@@ -72,23 +72,28 @@ function filterHeaders(r) {
   return cleanHeaders;
 }
 
+// Builds the OPA request body (as a JSON string) from the current request.
+// Exported so gateways that reuse this base image (e.g. nginx-s3-gateway)
+// send OPA an identical input contract instead of reconstructing it.
+function buildOpaBody(r) {
+  return JSON.stringify({
+    input: {
+      method: r.variables.original_method,
+      headers: filterHeaders(r),
+      query: qs.parse(r.variables.original_args),
+      domain: r.variables.domain,
+    },
+  });
+}
+
 async function opaAuth(r) {
   try {
     if (r.variables.original_method == "OPTIONS") {
       return r.return(204);
     }
 
-    const body = {
-      input: {
-        method: r.variables.original_method,
-        headers: filterHeaders(r),
-        query: qs.parse(r.variables.original_args),
-        domain: r.variables.domain,
-      },
-    };
-
     const response = await r.subrequest("/opa", {
-      body: JSON.stringify(body),
+      body: buildOpaBody(r),
       method: "POST",
     });
 
@@ -145,4 +150,4 @@ function jwtPayloadSub(r) {
   }
 }
 
-export default { opaAuth, jwtPayloadSub };
+export default { opaAuth, jwtPayloadSub, buildOpaBody };

From 59fafaf8860851a83d046bf839846a3bf4a053fa Mon Sep 17 00:00:00 2001
From: shimoncohen <shimoncohen655@gmail.com>
Date: Tue, 21 Jul 2026 11:05:39 +0300
Subject: [PATCH 2/2] chore: remove some comments

---
 docker-image/nginx-config/auth.js | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/docker-image/nginx-config/auth.js b/docker-image/nginx-config/auth.js
index 29a2866..c6ec4aa 100644
--- a/docker-image/nginx-config/auth.js
+++ b/docker-image/nginx-config/auth.js
@@ -72,9 +72,6 @@ function filterHeaders(r) {
   return cleanHeaders;
 }
 
-// Builds the OPA request body (as a JSON string) from the current request.
-// Exported so gateways that reuse this base image (e.g. nginx-s3-gateway)
-// send OPA an identical input contract instead of reconstructing it.
 function buildOpaBody(r) {
   return JSON.stringify({
     input: {