enhance: reduce to one client construct

CHANGELOG.md

@@ -1,66 +1,5 @@
 # Changelog
 
-## [8.0.0](https://github.com/opencloud-eu/opencloud/releases/tag/v8.0.0) - 2026-09-09
-
-### ❤️ Thanks to all contributors! ❤️
-
-@butonic, @dschmidt, @fredrikblau, @fschade, @maki5, @pbleser-oc, @v-scharf, @zerox80
-
-### 💥 Breaking changes
-
-- feat(search): check the index schema on startup and refuse breaking changes [[#3197](https://github.com/opencloud-eu/opencloud/pull/3197)]
-- refactor: reflection-based search mapping + location geopoint [[#3345](https://github.com/opencloud-eu/opencloud/pull/3345)]
-- fix(search): make openSearch and bleve behave the same [[#3408](https://github.com/opencloud-eu/opencloud/pull/3408)]
-
-### ✅ Tests
-
-- api-tests: add search retry to all search tests [[#3500](https://github.com/opencloud-eu/opencloud/pull/3500)]
-- test(search): fail the parity suite when the committed matrix is stale [[#3423](https://github.com/opencloud-eu/opencloud/pull/3423)]
-- ci: run search API and e2e suites against OpenSearch [[#3379](https://github.com/opencloud-eu/opencloud/pull/3379)]
-- test(search): engine parity suite for bleve and opensearch [[#3418](https://github.com/opencloud-eu/opencloud/pull/3418)]
-
-### 🐛 Bug Fixes
-
-- fix(search): extract facets from the main tika document only [[#3484](https://github.com/opencloud-eu/opencloud/pull/3484)]
-- fix(thumbnails): bound declared image dimensions before decoding [[#3457](https://github.com/opencloud-eu/opencloud/pull/3457)]
-- test(search): re-search until the expected files are in the result [[#3488](https://github.com/opencloud-eu/opencloud/pull/3488)]
-- fix(config): correct pending version annotations [[#3487](https://github.com/opencloud-eu/opencloud/pull/3487)]
-- Activitylog event handler split [[#3241](https://github.com/opencloud-eu/opencloud/pull/3241)]
-- test(search): wait for expected properties and documents [[#3486](https://github.com/opencloud-eu/opencloud/pull/3486)]
-- fix: log jwt expired on debug level instead of error [[#3463](https://github.com/opencloud-eu/opencloud/pull/3463)]
-- fix(proxy): restrict JWT signed urls to the allowed HTTP methods [[#3481](https://github.com/opencloud-eu/opencloud/pull/3481)]
-- fix: notification handling for share removal and space membership expiry  [[#3257](https://github.com/opencloud-eu/opencloud/pull/3257)]
-- fix: posix cli commands [[#3348](https://github.com/opencloud-eu/opencloud/pull/3348)]
-
-### 📈 Enhancement
-
-- feat(graph): expand thumbnails on driveItems [[#3471](https://github.com/opencloud-eu/opencloud/pull/3471)]
-- graph: expose lockInfo on driveItems [[#3444](https://github.com/opencloud-eu/opencloud/pull/3444)]
-- graph: expose @libre.graph.shareTypes on driveItems [[#3438](https://github.com/opencloud-eu/opencloud/pull/3438)]
-- feat(search): live photo facet [[#3202](https://github.com/opencloud-eu/opencloud/pull/3202)]
-- feat: support $expand=children on the driveItem endpoint [[#3445](https://github.com/opencloud-eu/opencloud/pull/3445)]
-- feat(search): motion photo facet [[#3200](https://github.com/opencloud-eu/opencloud/pull/3200)]
-- feat(search): video facet [[#3201](https://github.com/opencloud-eu/opencloud/pull/3201)]
-- graph: expose pendingOperations on driveItems [[#3437](https://github.com/opencloud-eu/opencloud/pull/3437)]
-- feat(search): extract more data from tika 4 (if available) [[#3198](https://github.com/opencloud-eu/opencloud/pull/3198)]
-- graph: expose following state, tags and allowed actions on driveItems [[#3113](https://github.com/opencloud-eu/opencloud/pull/3113)]
-- feat(search): scope searches to a drive via the driveId field [[#3424](https://github.com/opencloud-eu/opencloud/pull/3424)]
-- chore(policies): disable gRPC or event handlers by configuration + add metrics [[#3287](https://github.com/opencloud-eu/opencloud/pull/3287)]
-- moved ShareCreated event consumer from frontend to shared service [[#3389](https://github.com/opencloud-eu/opencloud/pull/3389)]
-
-### 📦️ Dependencies
-
-- build(deps): bump go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp from 0.70.0 to 0.71.0 [[#3441](https://github.com/opencloud-eu/opencloud/pull/3441)]
-- build(deps): bump go.opentelemetry.io/contrib/zpages from 0.70.0 to 0.71.0 [[#3442](https://github.com/opencloud-eu/opencloud/pull/3442)]
-- build(deps): bump go.opentelemetry.io/otel from 1.45.0 to 1.46.0 [[#3426](https://github.com/opencloud-eu/opencloud/pull/3426)]
-- build(deps): bump google.golang.org/grpc from 1.83.1 to 1.83.2 [[#3429](https://github.com/opencloud-eu/opencloud/pull/3429)]
-- build(deps): bump github.com/blevesearch/bleve/v2 from 2.6.0 to 2.6.1 [[#3417](https://github.com/opencloud-eu/opencloud/pull/3417)]
-- build(deps): bump github.com/sirupsen/logrus from 1.10.0 to 1.10.1 [[#3409](https://github.com/opencloud-eu/opencloud/pull/3409)]
-- build(deps): bump github.com/opensearch-project/opensearch-go/v4 from 4.6.0 to 4.7.3 [[#3216](https://github.com/opencloud-eu/opencloud/pull/3216)]
-- build(deps): bump github.com/KimMachineGun/automemlimit from 0.7.5 to 1.0.0 [[#3404](https://github.com/opencloud-eu/opencloud/pull/3404)]
-- build(deps): bump github.com/nats-io/nats.go from 1.52.0 to 1.53.1 [[#3403](https://github.com/opencloud-eu/opencloud/pull/3403)]
-- build(deps): bump github.com/open-policy-agent/opa from 1.19.0 to 1.19.1 [[#3402](https://github.com/opencloud-eu/opencloud/pull/3402)]
-
 ## [7.5.0](https://github.com/opencloud-eu/opencloud/releases/tag/v7.5.0) - 2026-08-25
 
 ### ❤️ Thanks to all contributors! ❤️

services/proxy/pkg/command/server.go

@@ -97,15 +97,19 @@ func Server(cfg *config.Config) *cobra.Command {
 				return err
 			}
 
+			// Clone the default transport so that the proxy configuration from the
+			// environment (HTTP_PROXY, HTTPS_PROXY, NO_PROXY) is honored when talking
+			// to the IDP. A bare &http.Transport{} leaves Proxy nil and never proxies.
+			oidcTransport := http.DefaultTransport.(*http.Transport).Clone()
+			oidcTransport.TLSClientConfig = &tls.Config{
+				MinVersion:         tls.VersionTLS12,
+				InsecureSkipVerify: cfg.OIDC.Insecure, //nolint:gosec
+			}
+			oidcTransport.DisableKeepAlives = true
+
 			oidcHTTPClient := &http.Client{
-				Transport: &http.Transport{
-					TLSClientConfig: &tls.Config{
-						MinVersion:         tls.VersionTLS12,
-						InsecureSkipVerify: cfg.OIDC.Insecure, //nolint:gosec
-					},
-					DisableKeepAlives: true,
-				},
-				Timeout: time.Second * 10,
+				Transport: oidcTransport,
+				Timeout:   time.Second * 10,
 			}
 
 			oidcClient := oidc.NewOIDCClient(
@@ -194,7 +198,7 @@ func Server(cfg *config.Config) *cobra.Command {
 
 			gr := runner.NewGroup()
 			{
-				middlewares := loadMiddlewares(logger, cfg, userInfoCache, signingKeyStore, traceProvider, *m, userProvider, publisher, gatewaySelector, serviceSelector)
+				middlewares := loadMiddlewares(logger, cfg, userInfoCache, signingKeyStore, traceProvider, *m, userProvider, publisher, gatewaySelector, serviceSelector, oidcClient, oidcHTTPClient)
 
 				server, err := proxyHTTP.Server(
 					proxyHTTP.Handler(lh.Handler()),
@@ -247,7 +251,8 @@ func loadMiddlewares(logger log.Logger, cfg *config.Config,
 	userInfoCache, signingKeyStore microstore.Store,
 	traceProvider trace.TracerProvider, metrics metrics.Metrics,
 	userProvider backend.UserBackend, publisher events.Publisher,
-	gatewaySelector pool.Selectable[gateway.GatewayAPIClient], serviceSelector selector.Selector) alice.Chain {
+	gatewaySelector pool.Selectable[gateway.GatewayAPIClient], serviceSelector selector.Selector,
+	oidcClient oidc.OIDCClient, oidcHTTPClient *http.Client) alice.Chain {
 
 	rolesClient := settingssvc.NewRoleService("eu.opencloud.api.settings", cfg.GrpcClient)
 	policiesProviderClient := policiessvc.NewPoliciesProviderService("eu.opencloud.api.policies", cfg.GrpcClient)
@@ -272,17 +277,6 @@ func loadMiddlewares(logger log.Logger, cfg *config.Config,
 		logger.Fatal().Msgf("Invalid role assignment driver '%s'", cfg.RoleAssignment.Driver)
 	}
 
-	oidcHTTPClient := &http.Client{
-		Transport: &http.Transport{
-			TLSClientConfig: &tls.Config{
-				MinVersion:         tls.VersionTLS12,
-				InsecureSkipVerify: cfg.OIDC.Insecure, //nolint:gosec
-			},
-			DisableKeepAlives: true,
-		},
-		Timeout: time.Second * 10,
-	}
-
 	var authenticators []middleware.Authenticator
 	if cfg.EnableBasicAuth {
 		logger.Warn().Msg("basic auth enabled, use only for testing or development")
@@ -306,13 +300,7 @@ func loadMiddlewares(logger log.Logger, cfg *config.Config,
 		middleware.HTTPClient(oidcHTTPClient),
 		middleware.OIDCIss(cfg.OIDC.Issuer),
 		middleware.AccessTokenVerifyMethod(cfg.OIDC.AccessTokenVerifyMethod),
-		middleware.OIDCClient(oidc.NewOIDCClient(
-			oidc.WithAccessTokenVerifyMethod(cfg.OIDC.AccessTokenVerifyMethod),
-			oidc.WithLogger(logger),
-			oidc.WithHTTPClient(oidcHTTPClient),
-			oidc.WithOidcIssuer(cfg.OIDC.Issuer),
-			oidc.WithJWKSOptions(cfg.OIDC.JWKS),
-		)),
+		middleware.OIDCClient(oidcClient),
 		middleware.SkipUserInfo(cfg.OIDC.SkipUserInfo),
 	))
 	authenticators = append(authenticators, middleware.PublicShareAuthenticator{

services/webfinger/pkg/server/http/server.go

@@ -72,15 +72,19 @@ func Server(opts ...Option) (ohttp.Service, error) {
 		),
 	)
 
+	// Clone the default transport so that the proxy configuration from the
+	// environment (HTTP_PROXY, HTTPS_PROXY, NO_PROXY) is honored when talking
+	// to the IDP. A bare &http.Transport{} leaves Proxy nil and never proxies.
+	oidcTransport := http.DefaultTransport.(*http.Transport).Clone()
+	oidcTransport.TLSClientConfig = &tls.Config{
+		MinVersion:         tls.VersionTLS12,
+		InsecureSkipVerify: options.Config.Insecure, //nolint:gosec
+	}
+	oidcTransport.DisableKeepAlives = true
+
 	var oidcHTTPClient = &http.Client{
-		Transport: &http.Transport{
-			TLSClientConfig: &tls.Config{
-				MinVersion:         tls.VersionTLS12,
-				InsecureSkipVerify: options.Config.Insecure, //nolint:gosec
-			},
-			DisableKeepAlives: true,
-		},
-		Timeout: time.Second * 10,
+		Transport: oidcTransport,
+		Timeout:   time.Second * 10,
 	}
 
 	mux.Use(middleware.OidcAuth(