feat(auth): support http auth and ip whitelist on wildcard subdomains and alias domains

composer.json

@@ -14,7 +14,8 @@
         },
         "files": [
             "auth-command.php",
-            "src/auth-utils.php"
+            "src/auth-utils.php",
+            "src/helper/hooks.php"
         ]
     },
     "extra": {

migrations/container/20260924120000_auth-command_regenerate_site_auth_files.php

@@ -0,0 +1,56 @@
+<?php
+
+namespace EE\Migration;
+
+use EE;
+use EE\Migration\Base;
+use EE\Model\Site;
+use function EE\Auth\Utils\generate_site_auth_files;
+use function EE\Auth\Utils\generate_site_whitelist;
+
+class RegenerateSiteAuthFiles extends Base {
+
+	private $sites;
+
+	public function __construct() {
+
+		parent::__construct();
+		$this->sites = Site::all();
+		if ( $this->is_first_execution || ! $this->sites ) {
+			$this->skip_this_migration = true;
+		}
+	}
+
+	/**
+	 * Regenerate the htpasswd and ACL files of all sites.
+	 *
+	 * Older versions only wrote `htpasswd/<site>` and `<site>_acl`, leaving subdomains and alias domains unprotected, and kept files of sites without own entries.
+	 *
+	 * @throws EE\ExitException
+	 */
+	public function up() {
+
+		if ( $this->skip_this_migration ) {
+			EE::debug( 'Skipping site auth files regeneration migration as it is not needed.' );
+
+			return;
+		}
+
+		foreach ( $this->sites as $site ) {
+			try {
+				generate_site_auth_files( $site->site_url, $site );
+				generate_site_whitelist( $site->site_url, $site );
+			} catch ( \Throwable $e ) {
+				EE::warning( sprintf( 'Could not regenerate the auth files of %s: %s', $site->site_url, $e->getMessage() ) );
+			}
+		}
+
+		\EE\Site\Utils\reload_global_nginx_proxy();
+	}
+
+	/**
+	 * Not reverted. The files need the nginx-proxy image of the same release: the previous image also applies `_wildcard.*` files to sibling sites.
+	 */
+	public function down() {
+	}
+}

src/Auth_Command.php

@@ -17,9 +17,13 @@
 use EE\Model\Auth;
 use EE\Model\Whitelist;
 use Symfony\Component\Filesystem\Filesystem;
+use function EE\Auth\Utils\generate_site_auth_files;
+use function EE\Auth\Utils\generate_site_whitelist;
 use function EE\Auth\Utils\verify_htpasswd_is_present;
+use function EE\Auth\Utils\write_htpasswd_file;
 use function EE\Site\Utils\auto_site_name;
 use function EE\Site\Utils\get_site_info;
+use function EE\Site\Utils\is_reserved_proxy_file_name;
 use function EE\Site\Utils\reload_global_nginx_proxy;
 
 class Auth_Command extends EE_Command {
@@ -161,7 +165,7 @@ private function create_auth( array $assoc_args, bool $global, string $site_url
 		if ( 'default' === $site_url ) {
 			$this->generate_global_auth_files();
 		} else {
-			$this->generate_site_auth_files( $site_url );
+			generate_site_auth_files( $site_url, $this->site_data );
 		}
 
 		EE::log( 'Reloading global reverse proxy.' );
@@ -200,7 +204,7 @@ private function create_whitelist( string $site_url, string $ips ) {
 		if ( 'default' === $site_url ) {
 			$this->generate_global_whitelist();
 		} else {
-			$this->generate_site_whitelist( $site_url );
+			generate_site_whitelist( $site_url, $this->site_data );
 		}
 
 		reload_global_nginx_proxy();
@@ -255,24 +259,17 @@ private function generate_global_auth_files() {
 		$global_admin_tools_auth = Auth::get_global_admin_tools_auth();
 
 		if ( ! empty( $global_admin_tools_auth ) ) {
-			EE::exec( sprintf( 'docker exec %s htpasswd -bc /etc/nginx/htpasswd/default_admin_tools %s %s', EE_PROXY_TYPE, $global_admin_tools_auth->username, $global_admin_tools_auth->password ) );
+			write_htpasswd_file( 'default_admin_tools', $global_admin_tools_auth );
 		} else {
-			$this->fs->remove( EE_ROOT_DIR . '/services/nginx-proxy/htpasswd/default_admin_tools' );
-			$this->fs->remove( EE_ROOT_DIR . '/services/nginx-proxy/htpasswd/default' );
 			$auths = Auth::get_global_auths();
 
 			if ( empty( $auths ) ) {
+				$this->fs->remove( EE_ROOT_DIR . '/services/nginx-proxy/htpasswd/default_admin_tools' );
+				$this->fs->remove( EE_ROOT_DIR . '/services/nginx-proxy/htpasswd/default' );
 				$this->regen_admin_tools_auth();
-			} else {
-				foreach ( $auths as $key => $auth ) {
-					$flags = 'b';
-
-					if ( 0 === $key ) {
-						$flags = 'bc';
-					}
-
-					EE::exec( sprintf( 'docker exec %s htpasswd -%s /etc/nginx/htpasswd/default %s %s', EE_PROXY_TYPE, $flags, $auth->username, $auth->password ) );
-				}
+			} elseif ( write_htpasswd_file( 'default', $auths ) ) {
+				// Admin tools prefer default_admin_tools, so drop it only once `default` is written; on failure both files keep protecting.
+				$this->fs->remove( EE_ROOT_DIR . '/services/nginx-proxy/htpasswd/default_admin_tools' );
 			}
 
 			$sites = array_unique(
@@ -283,34 +280,11 @@ private function generate_global_auth_files() {
 			);
 
 			foreach ( $sites as $site ) {
-				$this->generate_site_auth_files( $site );
-			}
-		}
-	}
-
-	/**
-	 * Generates auth files for a site
-	 *
-	 * @param string $site_url URL of site
-	 *
-	 * @throws Exception
-	 */
-	private function generate_site_auth_files( string $site_url ) {
-		$site_auth_file = EE_ROOT_DIR . '/services/nginx-proxy/htpasswd/' . $site_url;
-		$this->fs->remove( $site_auth_file );
-
-		$auths = array_merge(
-			Auth::get_global_auths(),
-			Auth::where( 'site_url', $site_url )
-		);
-
-		foreach ( $auths as $key => $auth ) {
-			$flags = 'b';
-
-			if ( $key === 0 ) {
-				$flags = 'bc';
+				// The global files were handled above.
+				if ( ! is_reserved_proxy_file_name( $site ) ) {
+					generate_site_auth_files( $site, \EE\Model\Site::find( $site ) ?: null );
+				}
 			}
-			EE::exec( sprintf( 'docker exec %s htpasswd -%s /etc/nginx/htpasswd/%s %s %s', EE_PROXY_TYPE, $flags, $site_url, $auth->username, $auth->password ) );
 		}
 	}
 
@@ -320,7 +294,7 @@ private function generate_site_auth_files( string $site_url ) {
 	 * @throws Exception
 	 */
 	private function generate_global_whitelist() {
-		$this->generate_site_whitelist( 'default' );
+		generate_site_whitelist( 'default' );
 
 		$sites = array_unique(
 			array_column(
@@ -333,54 +307,11 @@ private function generate_global_whitelist() {
 		}
 
 		foreach ( $sites as $site ) {
-			$this->generate_site_whitelist( $site );
+			generate_site_whitelist( $site, \EE\Model\Site::find( $site ) ?: null );
 		}
 
 	}
 
-	/**
-	 * Generates site whitelist files
-	 *
-	 * @param string $site_url
-	 *
-	 * @throws Exception
-	 */
-	private function generate_site_whitelist( string $site_url ) {
-		$site_whitelist_file = EE_ROOT_DIR . '/services/nginx-proxy/vhost.d/' . $site_url . '_acl';
-		$this->fs->remove( $site_whitelist_file );
-
-		$whitelists = array_column(
-			'default' === $site_url ? Whitelist::get_global_ips() :
-				array_merge(
-					Whitelist::get_global_ips(),
-					Whitelist::where( 'site_url', $site_url )
-				),
-			'ip'
-		);
-
-		$this->put_ips_to_file( $site_whitelist_file, $whitelists );
-	}
-
-	/**
-	 * Function to put list of ip's into a file.
-	 *
-	 * @param string $file Path of file to write ip's in.
-	 * @param array  $ips  List of ip's.
-	 */
-	private function put_ips_to_file( string $file, array $ips ) {
-
-		if ( empty( $ips ) ) {
-			return;
-		}
-
-		$file_content = 'satisfy any;' . PHP_EOL;
-		foreach ( $ips as $ip ) {
-			$file_content .= "allow $ip;" . PHP_EOL;
-		}
-		$file_content .= 'deny all;';
-		$this->fs->dumpFile( $file, $file_content );
-	}
-
 	/**
 	 * Updates http authentication password for a site.
 	 *
@@ -453,7 +384,7 @@ private function update_auth( array $assoc_args, string $site_url ) {
 		if ( 'default' === $site_url ) {
 			$this->generate_global_auth_files();
 		} else {
-			$this->generate_site_auth_files( $site_url );
+			generate_site_auth_files( $site_url, $this->site_data );
 		}
 
 		EE::log( 'Reloading global reverse proxy.' );
@@ -499,7 +430,7 @@ private function update_whitelist( string $site_url, string $ips ) {
 		if ( 'default' === $site_url ) {
 			$this->generate_global_whitelist();
 		} else {
-			$this->generate_site_whitelist( $site_url );
+			generate_site_whitelist( $site_url, $this->site_data );
 		}
 
 		reload_global_nginx_proxy();
@@ -594,7 +525,7 @@ public function delete( $args, $assoc_args ) {
 			if ( 'default' === $site_url ) {
 				$this->generate_global_auth_files();
 			} else {
-				$this->generate_site_auth_files( $site_url );
+				generate_site_auth_files( $site_url, $this->site_data );
 			}
 
 			if ( $user ) {
@@ -646,7 +577,7 @@ public function delete( $args, $assoc_args ) {
 			if ( 'default' === $site_url ) {
 				$this->generate_global_whitelist();
 			} else {
-				$this->generate_site_whitelist( $site_url );
+				generate_site_whitelist( $site_url, $this->site_data );
 			}
 
 			reload_global_nginx_proxy();