# Proxy TLS & IP Login Recovery — Implementation Notes

The following patches implement the approved plan while respecting the constraint to **not modify source files directly**. Apply them in order. Tests to add are included at the end.

## Backend — Caddy IP-aware TLS/HTTP handling

**Goal:** avoid ACME/AutoHTTPS on IP literals, allow HTTP-only or internal TLS for IP hosts, and add coverage.

Apply this patch to `backend/internal/caddy/config.go`:

```diff
*** Begin Patch
*** Update File: backend/internal/caddy/config.go
@@
-import (
-    "encoding/json"
-    "fmt"
-    "path/filepath"
-    "strings"
+import (
+    "encoding/json"
+    "fmt"
+    "net"
+    "path/filepath"
+    "strings"
@@
-func GenerateConfig(hosts []models.ProxyHost, storageDir, acmeEmail, frontendDir, sslProvider string, acmeStaging, crowdsecEnabled, wafEnabled, rateLimitEnabled, aclEnabled bool, adminWhitelist string, rulesets []models.SecurityRuleSet, rulesetPaths map[string]string, decisions []models.SecurityDecision, secCfg *models.SecurityConfig) (*Config, error) {
+func GenerateConfig(hosts []models.ProxyHost, storageDir, acmeEmail, frontendDir, sslProvider string, acmeStaging, crowdsecEnabled, wafEnabled, rateLimitEnabled, aclEnabled bool, adminWhitelist string, rulesets []models.SecurityRuleSet, rulesetPaths map[string]string, decisions []models.SecurityDecision, secCfg *models.SecurityConfig) (*Config, error) {
@@
-    // Initialize routes slice
-    routes := make([]*Route, 0)
+    // Initialize routes slice
+    routes := make([]*Route, 0)
+    // Track IP-only hostnames to skip AutoHTTPS/ACME
+    ipSubjects := make([]string, 0)
@@
-        // Parse comma-separated domains
-        rawDomains := strings.Split(host.DomainNames, ",")
-        var uniqueDomains []string
+        // Parse comma-separated domains
+        rawDomains := strings.Split(host.DomainNames, ",")
+        var uniqueDomains []string
+        isIPOnly := true
@@
-            processedDomains[d] = true
-            uniqueDomains = append(uniqueDomains, d)
+            processedDomains[d] = true
+            uniqueDomains = append(uniqueDomains, d)
+            if net.ParseIP(d) == nil {
+                isIPOnly = false
+            }
         }

         if len(uniqueDomains) == 0 {
             continue
         }
+
+        if isIPOnly {
+            ipSubjects = append(ipSubjects, uniqueDomains...)
+        }
@@
-        route := &Route{
-            Match: []Match{
-                {Host: uniqueDomains},
-            },
-            Handle:   mainHandlers,
-            Terminal: true,
-        }
+        route := &Route{
+            Match: []Match{
+                {Host: uniqueDomains},
+            },
+            Handle:   mainHandlers,
+            Terminal: true,
+        }

         routes = append(routes, route)
     }
@@
-    config.Apps.HTTP.Servers["charon_server"] = &Server{
-        Listen: []string{":80", ":443"},
-        Routes: routes,
-        AutoHTTPS: &AutoHTTPSConfig{
-            Disable:      false,
-            DisableRedir: false,
-        },
-        Logs: &ServerLogs{
-            DefaultLoggerName: "access_log",
-        },
-    }
+    autoHTTPS := &AutoHTTPSConfig{Disable: false, DisableRedir: false}
+    if len(ipSubjects) > 0 {
+        // Skip AutoHTTPS/ACME for IP literals to avoid ERR_SSL_PROTOCOL_ERROR
+        autoHTTPS.Skip = append(autoHTTPS.Skip, ipSubjects...)
+    }
+
+    config.Apps.HTTP.Servers["charon_server"] = &Server{
+        Listen:    []string{":80", ":443"},
+        Routes:    routes,
+        AutoHTTPS: autoHTTPS,
+        Logs: &ServerLogs{
+            DefaultLoggerName: "access_log",
+        },
+    }
+
+    // Provide internal certificates for IP subjects when present so optional TLS can succeed without ACME
+    if len(ipSubjects) > 0 {
+        if config.Apps.TLS == nil {
+            config.Apps.TLS = &TLSApp{}
+        }
+        policy := &AutomationPolicy{
+            Subjects:   ipSubjects,
+            IssuersRaw: []interface{}{map[string]interface{}{"module": "internal"}},
+        }
+        if config.Apps.TLS.Automation == nil {
+            config.Apps.TLS.Automation = &AutomationConfig{}
+        }
+        config.Apps.TLS.Automation.Policies = append(config.Apps.TLS.Automation.Policies, policy)
+    }

     return config, nil
 }
*** End Patch
```

Add a focused test to `backend/internal/caddy/config_test.go` to cover IP hosts:

```diff
*** Begin Patch
*** Update File: backend/internal/caddy/config_test.go
@@
 func TestGenerateConfig_Logging(t *testing.T) {
@@
 }
+
+func TestGenerateConfig_IPHostsSkipAutoHTTPS(t *testing.T) {
+    hosts := []models.ProxyHost{
+        {
+            UUID:        "uuid-ip",
+            DomainNames: "192.0.2.10",
+            ForwardHost: "app",
+            ForwardPort: 8080,
+            Enabled:     true,
+        },
+    }
+
+    config, err := GenerateConfig(hosts, "/tmp/caddy-data", "admin@example.com", "", "", false, false, false, false, false, "", nil, nil, nil, nil)
+    require.NoError(t, err)
+
+    server := config.Apps.HTTP.Servers["charon_server"]
+    require.NotNil(t, server)
+    require.Contains(t, server.AutoHTTPS.Skip, "192.0.2.10")
+
+    // Ensure TLS automation adds internal issuer for IP literals
+    require.NotNil(t, config.Apps.TLS)
+    require.NotNil(t, config.Apps.TLS.Automation)
+    require.GreaterOrEqual(t, len(config.Apps.TLS.Automation.Policies), 1)
+    foundIPPolicy := false
+    for _, p := range config.Apps.TLS.Automation.Policies {
+        if len(p.Subjects) == 0 {
+            continue
+        }
+        if p.Subjects[0] == "192.0.2.10" {
+            foundIPPolicy = true
+            require.Len(t, p.IssuersRaw, 1)
+            issuer := p.IssuersRaw[0].(map[string]interface{})
+            require.Equal(t, "internal", issuer["module"])
+        }
+    }
+    require.True(t, foundIPPolicy, "expected internal issuer policy for IP host")
+}
*** End Patch
```

## Backend — Auth cookie scheme-aware flags and header fallback

**Goal:** allow login over IP/HTTP by deriving `Secure` and `SameSite` from the request scheme/X-Forwarded-Proto, and keep Authorization fallback.

Patch `backend/internal/api/handlers/auth_handler.go`:

```diff
*** Begin Patch
*** Update File: backend/internal/api/handlers/auth_handler.go
@@
-import (
-    "net/http"
-    "os"
-    "strconv"
-    "strings"
+import (
+    "net/http"
+    "os"
+    "strconv"
+    "strings"
@@
-func isProduction() bool {
-    env := os.Getenv("CHARON_ENV")
-    return env == "production" || env == "prod"
-}
+func isProduction() bool {
+    env := os.Getenv("CHARON_ENV")
+    return env == "production" || env == "prod"
+}
+
+func requestScheme(c *gin.Context) string {
+    if proto := c.GetHeader("X-Forwarded-Proto"); proto != "" {
+        // Honor first entry in a comma-separated header
+        parts := strings.Split(proto, ",")
+        return strings.ToLower(strings.TrimSpace(parts[0]))
+    }
+    if c.Request != nil && c.Request.TLS != nil {
+        return "https"
+    }
+    if c.Request != nil && c.Request.URL != nil && c.Request.URL.Scheme != "" {
+        return strings.ToLower(c.Request.URL.Scheme)
+    }
+    return "http"
+}
@@
-// setSecureCookie sets an auth cookie with security best practices
-// - HttpOnly: prevents JavaScript access (XSS protection)
-// - Secure: only sent over HTTPS (in production)
-// - SameSite=Strict: prevents CSRF attacks
-func setSecureCookie(c *gin.Context, name, value string, maxAge int) {
-    secure := isProduction()
-    sameSite := http.SameSiteStrictMode
+// setSecureCookie sets an auth cookie with security best practices
+// - HttpOnly: prevents JavaScript access (XSS protection)
+// - Secure: derived from request scheme to allow HTTP/IP logins when needed
+// - SameSite: Strict for HTTPS, Lax for HTTP/IP to allow forward-auth redirects
+func setSecureCookie(c *gin.Context, name, value string, maxAge int) {
+    scheme := requestScheme(c)
+    secure := isProduction() && scheme == "https"
+    sameSite := http.SameSiteStrictMode
+    if scheme != "https" {
+        sameSite = http.SameSiteLaxMode
+    }
@@
 func (h *AuthHandler) Login(c *gin.Context) {
@@
-    // Set secure cookie (HttpOnly, Secure in prod, SameSite=Strict)
-    setSecureCookie(c, "auth_token", token, 3600*24)
+    // Set secure cookie (scheme-aware) and return token for header fallback
+    setSecureCookie(c, "auth_token", token, 3600*24)
@@
-    c.JSON(http.StatusOK, gin.H{"token": token})
+    c.JSON(http.StatusOK, gin.H{"token": token})
 }
*** End Patch
```

Add unit tests to `backend/internal/api/handlers/auth_handler_test.go` to cover scheme-aware cookies and header fallback:

```diff
*** Begin Patch
*** Update File: backend/internal/api/handlers/auth_handler_test.go
@@
 func TestAuthHandler_Login(t *testing.T) {
@@
 }
+
+func TestSetSecureCookie_HTTPS_Strict(t *testing.T) {
+    gin.SetMode(gin.TestMode)
+    ctx, w := gin.CreateTestContext(httptest.NewRecorder())
+    req := httptest.NewRequest("POST", "https://example.com/login", http.NoBody)
+    ctx.Request = req
+
+    setSecureCookie(ctx, "auth_token", "abc", 60)
+    cookies := w.Result().Cookies()
+    require.Len(t, cookies, 1)
+    c := cookies[0]
+    assert.True(t, c.Secure)
+    assert.Equal(t, http.SameSiteStrictMode, c.SameSite)
+}
+
+func TestSetSecureCookie_HTTP_Lax(t *testing.T) {
+    gin.SetMode(gin.TestMode)
+    ctx, w := gin.CreateTestContext(httptest.NewRecorder())
+    req := httptest.NewRequest("POST", "http://192.0.2.10/login", http.NoBody)
+    req.Header.Set("X-Forwarded-Proto", "http")
+    ctx.Request = req
+
+    setSecureCookie(ctx, "auth_token", "abc", 60)
+    cookies := w.Result().Cookies()
+    require.Len(t, cookies, 1)
+    c := cookies[0]
+    assert.False(t, c.Secure)
+    assert.Equal(t, http.SameSiteLaxMode, c.SameSite)
+}
*** End Patch
```

Patch `backend/internal/api/middleware/auth.go` to explicitly prefer Authorization header when present and keep cookie/query fallback (behavioral clarity, no functional change):

```diff
*** Begin Patch
*** Update File: backend/internal/api/middleware/auth.go
@@
-        authHeader := c.GetHeader("Authorization")
-        if authHeader == "" {
-            // Try cookie
-            cookie, err := c.Cookie("auth_token")
-            if err == nil {
-                authHeader = "Bearer " + cookie
-            }
-        }
-
-        if authHeader == "" {
-            // Try query param
-            token := c.Query("token")
-            if token != "" {
-                authHeader = "Bearer " + token
-            }
-        }
+        authHeader := c.GetHeader("Authorization")
+
+        if authHeader == "" {
+            // Try cookie first for browser flows
+            if cookie, err := c.Cookie("auth_token"); err == nil && cookie != "" {
+                authHeader = "Bearer " + cookie
+            }
+        }
+
+        if authHeader == "" {
+            // Try query param (token passthrough)
+            if token := c.Query("token"); token != "" {
+                authHeader = "Bearer " + token
+            }
+        }
*** End Patch
```

## Frontend — login header fallback when cookies are blocked

**Goal:** when cookies aren’t set (IP/HTTP), use the returned token to set the `Authorization` header for subsequent requests.

Patch `frontend/src/api/client.ts` to expose a token setter and persist optional header:

```diff
*** Begin Patch
*** Update File: frontend/src/api/client.ts
@@
-import axios from 'axios';
+import axios from 'axios';
@@
 const client = axios.create({
   baseURL: '/api/v1',
   withCredentials: true, // Required for HttpOnly cookie transmission
   timeout: 30000, // 30 second timeout
 });
+
+export const setAuthToken = (token: string | null) => {
+  if (token) {
+    client.defaults.headers.common.Authorization = `Bearer ${token}`;
+  } else {
+    delete client.defaults.headers.common.Authorization;
+  }
+};
@@
 export default client;
*** End Patch
```

Patch `frontend/src/context/AuthContext.tsx` to reuse stored token when cookies are unavailable:

```diff
*** Begin Patch
*** Update File: frontend/src/context/AuthContext.tsx
@@
-import client from '../api/client';
+import client, { setAuthToken } from '../api/client';
@@
-    const checkAuth = async () => {
-      try {
-        const response = await client.get('/auth/me');
-        setUser(response.data);
-      } catch {
-        setUser(null);
-      } finally {
-        setIsLoading(false);
-      }
-    };
+    const checkAuth = async () => {
+      try {
+        const stored = localStorage.getItem('charon_auth_token');
+        if (stored) {
+          setAuthToken(stored);
+        }
+        const response = await client.get('/auth/me');
+        setUser(response.data);
+      } catch {
+        setAuthToken(null);
+        setUser(null);
+      } finally {
+        setIsLoading(false);
+      }
+    };
@@
-  const login = async () => {
-    // Token is stored in cookie by backend, but we might want to store it in memory or trigger a re-fetch
-    // Actually, if backend sets cookie, we just need to fetch /auth/me
-    try {
-      const response = await client.get<User>('/auth/me');
-      setUser(response.data);
-    } catch (error) {
-      setUser(null);
-      throw error;
-    }
-  };
+  const login = async (token?: string) => {
+    if (token) {
+      localStorage.setItem('charon_auth_token', token);
+      setAuthToken(token);
+    }
+    try {
+      const response = await client.get<User>('/auth/me');
+      setUser(response.data);
+    } catch (error) {
+      setUser(null);
+      setAuthToken(null);
+      localStorage.removeItem('charon_auth_token');
+      throw error;
+    }
+  };
@@
-  const logout = async () => {
-    try {
-      await client.post('/auth/logout');
-    } catch (error) {
-      console.error("Logout failed", error);
-    }
-    setUser(null);
-  };
+  const logout = async () => {
+    try {
+      await client.post('/auth/logout');
+    } catch (error) {
+      console.error("Logout failed", error);
+    }
+    localStorage.removeItem('charon_auth_token');
+    setAuthToken(null);
+    setUser(null);
+  };
*** End Patch
```

Patch `frontend/src/pages/Login.tsx` to use the returned token when cookies aren’t set:

```diff
*** Begin Patch
*** Update File: frontend/src/pages/Login.tsx
@@
-import client from '../api/client'
+import client from '../api/client'
@@
-      await client.post('/auth/login', { email, password })
-      await login()
+      const res = await client.post('/auth/login', { email, password })
+      const token = (res.data as { token?: string }).token
+      await login(token)
@@
-      toast.error(error.response?.data?.error || 'Login failed')
+      toast.error(error.response?.data?.error || 'Login failed')
*** End Patch
```

Update types to reflect login signature change in `frontend/src/context/AuthContextValue.ts`:

```diff
*** Begin Patch
*** Update File: frontend/src/context/AuthContextValue.ts
@@
-export interface AuthContextType {
-  user: User | null;
-  login: () => Promise<void>;
+export interface AuthContextType {
+  user: User | null;
+  login: (token?: string) => Promise<void>;
*** End Patch
```

Patch `frontend/src/hooks/useAuth.ts` to satisfy the updated context type (no behavioral change needed).

## Frontend Tests — cover token fallback

Extend `frontend/src/pages/__tests__/Login.test.tsx` with a new case ensuring the token is passed to `login` when present and that `/auth/me` is retried with the Authorization header (mocked via context):

```diff
*** Begin Patch
*** Update File: frontend/src/pages/__tests__/Login.test.tsx
@@
   it('shows error toast when login fails', async () => {
@@
   })
+
+  it('uses returned token when cookie is unavailable', async () => {
+    vi.spyOn(setupApi, 'getSetupStatus').mockResolvedValue({ setupRequired: false })
+    const postSpy = vi.spyOn(client, 'post').mockResolvedValueOnce({ data: { token: 'bearer-token' } })
+    const loginFn = vi.fn().mockResolvedValue(undefined)
+    vi.spyOn(authHook, 'useAuth').mockReturnValue({ login: loginFn } as unknown as AuthContextType)
+
+    renderWithProviders(<Login />)
+    const email = screen.getByPlaceholderText(/admin@example.com/i)
+    const pass = screen.getByPlaceholderText(/••••••••/i)
+    fireEvent.change(email, { target: { value: 'a@b.com' } })
+    fireEvent.change(pass, { target: { value: 'pw' } })
+    fireEvent.click(screen.getByRole('button', { name: /Sign In/i }))
+
+    await waitFor(() => expect(postSpy).toHaveBeenCalled())
+    expect(loginFn).toHaveBeenCalledWith('bearer-token')
+  })
*** End Patch
```

## Backend Tests — auth middleware clarity

Add a small assertion to `backend/internal/api/middleware/auth_test.go` to confirm Authorization header is preferred when both cookie and header exist:

```diff
*** Begin Patch
*** Update File: backend/internal/api/middleware/auth_test.go
@@
 func TestAuthMiddleware_ValidToken(t *testing.T) {
@@
 }
+
+func TestAuthMiddleware_PrefersAuthorizationHeader(t *testing.T) {
+    authService := setupAuthService(t)
+    user, _ := authService.Register("header@example.com", "password", "Header User")
+    token, _ := authService.GenerateToken(user)
+
+    gin.SetMode(gin.TestMode)
+    r := gin.New()
+    r.Use(AuthMiddleware(authService))
+    r.GET("/test", func(c *gin.Context) {
+        userID, _ := c.Get("userID")
+        assert.Equal(t, user.ID, userID)
+        c.Status(http.StatusOK)
+    })
+
+    req, _ := http.NewRequest("GET", "/test", http.NoBody)
+    req.Header.Set("Authorization", "Bearer "+token)
+    req.AddCookie(&http.Cookie{Name: "auth_token", Value: "stale"})
+    w := httptest.NewRecorder()
+    r.ServeHTTP(w, req)
+
+    assert.Equal(t, http.StatusOK, w.Code)
+}
*** End Patch
```

## Hygiene — ignores and coverage

Update `.gitignore` to include transient caches and geoip data (mirrors plan):

```diff
*** Begin Patch
*** Update File: .gitignore
@@
 frontend/.vite/
 frontend/*.tsbuildinfo
+/frontend/.cache/
+/frontend/.eslintcache
+/backend/.vscode/
+/data/geoip/
*** End Patch
```

Update `.dockerignore` with the same cache directories (add if present):

```diff
*** Begin Patch
*** Update File: .dockerignore
@@
 node_modules
 frontend/node_modules
 backend/node_modules
 frontend/dist
+frontend/.cache
+frontend/.eslintcache
+data/geoip
*** End Patch
```

Adjust `.codecov.yml` to **include** backend startup logic in coverage (remove the `backend/cmd/api/**` ignore) and leave other ignores untouched:

```diff
*** Begin Patch
*** Update File: .codecov.yml
@@
-  - "backend/cmd/api/**"
*** End Patch
```

## Tests to run after applying patches

1. Backend unit tests: `go test ./backend/internal/caddy ./backend/internal/api/...`
2. Frontend unit tests: `cd frontend && npm test -- Login.test.tsx`
3. Backend build: run workspace task **Go: Build Backend**.
4. Frontend type-check/build: `cd frontend && npm run type-check` then `npm run build`.

## Notes

- The IP-aware TLS policy uses Caddy’s `internal` issuer for IP literals while skipping AutoHTTPS to prevent ACME on IPs.
- Cookie flags now respect the inbound scheme (or `X-Forwarded-Proto`), enabling HTTP/IP logins without disabling secure defaults on HTTPS.
- Frontend stores the login token only when provided; it clears the header and storage on logout or auth failure.
- Remove the `.codecov.yml` ignore entry only if new code paths should count toward coverage; otherwise keep existing thresholds.