From ac817649abc50996848b2dc081a5c85635143d62 Mon Sep 17 00:00:00 2001
From: Andrew Stowell <andrew@digitaladapt.com>
Date: Fri, 26 Dec 2025 21:17:36 -0500
Subject: [PATCH] fixed bug which can occur if you delete cache files. fixed
 warnings due to volume locations.

---
 Caddyfile                       |  1 -
 Dockerfile                      | 10 +++++++---
 docs/Caddyfile                  |  8 +++-----
 docs/compose.yaml               |  8 +++++---
 docs/env.example                |  9 ---------
 src/Listener/RejectListener.php |  2 +-
 6 files changed, 16 insertions(+), 22 deletions(-)

diff --git a/Caddyfile b/Caddyfile
index d65b2e9..dd48371 100644
--- a/Caddyfile
+++ b/Caddyfile
@@ -5,4 +5,3 @@ php {
 	root /app/public
 	worker index.php
 }
-
diff --git a/Dockerfile b/Dockerfile
index 69af3d8..ca34646 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -9,11 +9,13 @@ RUN apt-get update && \
     apt-get install -y unzip git
 
 # symfony required environment variables
-ENV APP_ENV=prod
 ENV APP_DEBUG=0
+ENV APP_ENV=prod
+ENV APP_SHARE_DIR=/data/preauth
 ENV DEFAULT_URI='http://'
 
 # load application into build image
+RUN mkdir -p /data/preauth
 RUN mkdir -p /app/bin
 WORKDIR /app
 COPY ./bin/console   /app/bin/console
@@ -37,12 +39,14 @@ RUN pecl install apcu && \
     docker-php-ext-enable apcu
 
 # symfony required environment variables
-ENV APP_ENV=prod
 ENV APP_DEBUG=0
+ENV APP_ENV=prod
+ENV APP_SHARE_DIR=/data/preauth
 ENV DEFAULT_URI='http://'
 
 # load application into final image
 WORKDIR /app
+COPY --from=build /data/preauth /data/preauth
 COPY --from=build /app /app
 
 # configure container
@@ -51,7 +55,7 @@ RUN cp $PHP_INI_DIR/php.ini-production $PHP_INI_DIR/php.ini
 RUN echo 'expose_php = off' > $PHP_INI_DIR/conf.d/restrict.ini
 
 # app uses var folder for cache storage
-VOLUME ["/app/var"]
+VOLUME ["/config", "/data"]
 
 # runs http on standard port
 EXPOSE 80
diff --git a/docs/Caddyfile b/docs/Caddyfile
index d4244db..ae4affd 100644
--- a/docs/Caddyfile
+++ b/docs/Caddyfile
@@ -1,15 +1,13 @@
 # if using caddy v2.9.x+ you can use this snippet
-# snippet to put the pre-auth system in front any service easily
+# snippet to put the preauth system in front any service easily
 (preauth) {
 	# make sure caddy and preauth are on the same network
 	reverse_proxy {args[0]} preauth {
+		# leave body content for protected service
 		method GET
-		header_up X-Forwarded-Uri {uri}
+		# if auth is successful, send request to protected service
 		@preauth_ok status 2xx
 		handle_response @preauth_ok {
-			copy_response_headers {
-				include Set-Cookie Location
-			}
 			{block}
 		}
 	}
diff --git a/docs/compose.yaml b/docs/compose.yaml
index 2f78066..8008625 100644
--- a/docs/compose.yaml
+++ b/docs/compose.yaml
@@ -1,7 +1,7 @@
 services:
   preauth:
     env_file:
-      # TODO rename ".env.example" to just ".env", edit as needed
+      # TODO rename "env.example" to ".env", edit as needed
       # strongly recommend setting TOTP_URI, if not provided the app
       # will generate one for you, please copy it into your .env file
       - .env
@@ -16,8 +16,10 @@ services:
     #
     #user: <uid>:<gid>
     volumes:
-      - preauth:/app/var
+      - preauth-config:/config
+      - preauth-data:/data
 
 volumes:
-  preauth:
+  preauth-config:
+  preauth-data:
 
diff --git a/docs/env.example b/docs/env.example
index 574ac3e..f67975c 100644
--- a/docs/env.example
+++ b/docs/env.example
@@ -22,14 +22,6 @@
 
 # --- Extra Options ---
 
-# query parameter prefix to prevent collisions with protected app
-#QUERY_PREFIX='_preauth_'
-
-# TODO make it so boolean options can be true/false
-
-# allow files in /app/public/assets directory to be served, false to disable
-#ASSETS=true                # default enabled, boolean
-
 # how long do we allow *ALL* traffic from an ip address after successful login
 # could be useful if you have a system which does not handle cookies
 #IP_TTL=0                   # default disabled, time in seconds
@@ -42,7 +34,6 @@
 
 # --- Styling Options ---
 #TITLE='Pre-Authentication System'
-#ICONS=false                # default disabled, boolean, use favicon from root domain
 #BG_COLOR='#029386'         # teal
 #FG_COLOR='#ffffff'         # white
 #ERROR_COLOR='#ffb16d'      # apricot (light orange)
diff --git a/src/Listener/RejectListener.php b/src/Listener/RejectListener.php
index 421a676..cdd50ed 100644
--- a/src/Listener/RejectListener.php
+++ b/src/Listener/RejectListener.php
@@ -34,7 +34,7 @@ final readonly class RejectListener {
         /* check if they have made too many failed login attempts */
         $failuresItem = $this->requestPool->getItem($ipKey);
         if ($failuresItem->isHit()) {
-            $failures = $failuresItem->get();
+            $failures = $failuresItem->get() ?? [];
             if (count($failures) >= $this->config->limit()) {
                 $this->logger->debug("already blocked: {$event->getRequest()->getClientIp()}");
                 $html = $this->twig->render('error.html.twig');