Merge commit from fork

* Add DenyLists parsing

* Remove unneeded returned error

* Plug global denylist into Command

* app creation: apply denylist to backchannel logout URI

* Inject denylist to backchannel logout worker

* webhook config: validate against blocked URLs

* Add notificationsWebhook denylist target

* command: Add SMTP endpoint validation against blocklist

* command: Add SMS endpoint validation against blocklist

* Validate webhook endpoint against denylist on channel notification

* Remove unused tests

* handle deprecated denylists

* remove unintended denylist entry in deprecated list

* use single http client

* fix tests

* update comments

* fixes

* cleanup

* address comments

* fix merge

---------

Co-authored-by: Livio Spring <[email protected]>

cmd/setup/03.go

@@ -3,6 +3,7 @@ package setup
 import (
 	"context"
 	"fmt"
+	"net/http"
 	"os"
 	"strings"
 
@@ -47,6 +48,8 @@ type FirstInstance struct {
 	externalPort      uint16
 	domain            string
 	defaultPaths      *login.DefaultPaths
+	httpClient        *http.Client
+	denylist          []denylist.AddressChecker
 }
 
 func (mig *FirstInstance) Execute(ctx context.Context, _ eventstore.Event) error {
@@ -89,7 +92,7 @@ func (mig *FirstInstance) Execute(ctx context.Context, _ eventstore.Event) error
 		nil,
 		nil,
 		oidcEncryption,
-		nil,
+		mig.httpClient,
 		nil,
 		nil,
 		0,
@@ -97,7 +100,7 @@ func (mig *FirstInstance) Execute(ctx context.Context, _ eventstore.Event) error
 		0,
 		nil,
 		mig.defaultPaths,
-		[]denylist.AddressChecker{},
+		mig.denylist,
 	)
 	if err != nil {
 		return err