enhance: reduce to one client construct

services/audit/README.md

@@ -10,24 +10,21 @@ file_delete)
    user 'user_id' trashed file 'item_id'
 file_trash_delete)
    user 'user_id' removed file 'item_id' from trashbin
-file_read)
-   user 'user_id' read file 'item_id'
 ```
 
 Example json:
 ```
 {"RemoteAddr":"","User":"user_id","URL":"","Method":"","UserAgent":"","Time":"","App":"admin_audit","Message":"user 'user_id' trashed file 'item_id'","Action":"file_delete","CLI":false,"Level":1,"Path":"path","Owner":"user_id","FileID":"item_id"}
 {"RemoteAddr":"","User":"user_id","URL":"","Method":"","UserAgent":"","Time":"","App":"admin_audit","Message":"user 'user_id' removed file 'item_id' from trashbin","Action":"file_trash_delete","CLI":false,"Level":1,"Path":"path","Owner":"user_id","FileID":"item_id"}
-{"RemoteAddr":"","User":"user_id","URL":"","Method":"","UserAgent":"","Time":"","App":"admin_audit","Message":"user 'user_id' read file 'item_id'","Action":"file_read","CLI":false,"Level":1,"Path":"path","Owner":"user_id","FileID":"item_id"}
 ```
 
 The audit service is not started automatically when running as single binary started via `opencloud server` or when running as docker container and must be started and stopped manually on demand.
 
 The audit service logs:
 
-- File system operations
-(create/delete/move/read; including actions on the trash bin and versioning)
-- User management operations
+-   File system operations  
+(create/delete/move; including actions on the trash bin and versioning)
+-   User management operations  
 (creation/deletion of users)
-- Sharing operations
+-   Sharing operations  
 (user/group sharing, sharing via link, changing permissions, calls to sharing API from clients)

services/proxy/pkg/command/server.go

@@ -97,15 +97,19 @@ func Server(cfg *config.Config) *cobra.Command {
 				return err
 			}
 
+			// Clone the default transport so that the proxy configuration from the
+			// environment (HTTP_PROXY, HTTPS_PROXY, NO_PROXY) is honored when talking
+			// to the IDP. A bare &http.Transport{} leaves Proxy nil and never proxies.
+			oidcTransport := http.DefaultTransport.(*http.Transport).Clone()
+			oidcTransport.TLSClientConfig = &tls.Config{
+				MinVersion:         tls.VersionTLS12,
+				InsecureSkipVerify: cfg.OIDC.Insecure, //nolint:gosec
+			}
+			oidcTransport.DisableKeepAlives = true
+
 			oidcHTTPClient := &http.Client{
-				Transport: &http.Transport{
-					TLSClientConfig: &tls.Config{
-						MinVersion:         tls.VersionTLS12,
-						InsecureSkipVerify: cfg.OIDC.Insecure, //nolint:gosec
-					},
-					DisableKeepAlives: true,
-				},
-				Timeout: time.Second * 10,
+				Transport: oidcTransport,
+				Timeout:   time.Second * 10,
 			}
 
 			oidcClient := oidc.NewOIDCClient(
@@ -194,7 +198,7 @@ func Server(cfg *config.Config) *cobra.Command {
 
 			gr := runner.NewGroup()
 			{
-				middlewares := loadMiddlewares(logger, cfg, userInfoCache, signingKeyStore, traceProvider, *m, userProvider, publisher, gatewaySelector, serviceSelector)
+				middlewares := loadMiddlewares(logger, cfg, userInfoCache, signingKeyStore, traceProvider, *m, userProvider, publisher, gatewaySelector, serviceSelector, oidcClient, oidcHTTPClient)
 
 				server, err := proxyHTTP.Server(
 					proxyHTTP.Handler(lh.Handler()),
@@ -247,7 +251,8 @@ func loadMiddlewares(logger log.Logger, cfg *config.Config,
 	userInfoCache, signingKeyStore microstore.Store,
 	traceProvider trace.TracerProvider, metrics metrics.Metrics,
 	userProvider backend.UserBackend, publisher events.Publisher,
-	gatewaySelector pool.Selectable[gateway.GatewayAPIClient], serviceSelector selector.Selector) alice.Chain {
+	gatewaySelector pool.Selectable[gateway.GatewayAPIClient], serviceSelector selector.Selector,
+	oidcClient oidc.OIDCClient, oidcHTTPClient *http.Client) alice.Chain {
 
 	rolesClient := settingssvc.NewRoleService("eu.opencloud.api.settings", cfg.GrpcClient)
 	policiesProviderClient := policiessvc.NewPoliciesProviderService("eu.opencloud.api.policies", cfg.GrpcClient)
@@ -272,17 +277,6 @@ func loadMiddlewares(logger log.Logger, cfg *config.Config,
 		logger.Fatal().Msgf("Invalid role assignment driver '%s'", cfg.RoleAssignment.Driver)
 	}
 
-	oidcHTTPClient := &http.Client{
-		Transport: &http.Transport{
-			TLSClientConfig: &tls.Config{
-				MinVersion:         tls.VersionTLS12,
-				InsecureSkipVerify: cfg.OIDC.Insecure, //nolint:gosec
-			},
-			DisableKeepAlives: true,
-		},
-		Timeout: time.Second * 10,
-	}
-
 	var authenticators []middleware.Authenticator
 	if cfg.EnableBasicAuth {
 		logger.Warn().Msg("basic auth enabled, use only for testing or development")
@@ -306,13 +300,7 @@ func loadMiddlewares(logger log.Logger, cfg *config.Config,
 		middleware.HTTPClient(oidcHTTPClient),
 		middleware.OIDCIss(cfg.OIDC.Issuer),
 		middleware.AccessTokenVerifyMethod(cfg.OIDC.AccessTokenVerifyMethod),
-		middleware.OIDCClient(oidc.NewOIDCClient(
-			oidc.WithAccessTokenVerifyMethod(cfg.OIDC.AccessTokenVerifyMethod),
-			oidc.WithLogger(logger),
-			oidc.WithHTTPClient(oidcHTTPClient),
-			oidc.WithOidcIssuer(cfg.OIDC.Issuer),
-			oidc.WithJWKSOptions(cfg.OIDC.JWKS),
-		)),
+		middleware.OIDCClient(oidcClient),
 		middleware.SkipUserInfo(cfg.OIDC.SkipUserInfo),
 	))
 	authenticators = append(authenticators, middleware.PublicShareAuthenticator{

services/webfinger/pkg/server/http/server.go

@@ -72,15 +72,19 @@ func Server(opts ...Option) (ohttp.Service, error) {
 		),
 	)
 
+	// Clone the default transport so that the proxy configuration from the
+	// environment (HTTP_PROXY, HTTPS_PROXY, NO_PROXY) is honored when talking
+	// to the IDP. A bare &http.Transport{} leaves Proxy nil and never proxies.
+	oidcTransport := http.DefaultTransport.(*http.Transport).Clone()
+	oidcTransport.TLSClientConfig = &tls.Config{
+		MinVersion:         tls.VersionTLS12,
+		InsecureSkipVerify: options.Config.Insecure, //nolint:gosec
+	}
+	oidcTransport.DisableKeepAlives = true
+
 	var oidcHTTPClient = &http.Client{
-		Transport: &http.Transport{
-			TLSClientConfig: &tls.Config{
-				MinVersion:         tls.VersionTLS12,
-				InsecureSkipVerify: options.Config.Insecure, //nolint:gosec
-			},
-			DisableKeepAlives: true,
-		},
-		Timeout: time.Second * 10,
+		Transport: oidcTransport,
+		Timeout:   time.Second * 10,
 	}
 
 	mux.Use(middleware.OidcAuth(