Merge commit from fork

* Add DenyLists parsing

* Remove unneeded returned error

* Plug global denylist into Command

* app creation: apply denylist to backchannel logout URI

* Inject denylist to backchannel logout worker

* webhook config: validate against blocked URLs

* Add notificationsWebhook denylist target

* command: Add SMTP endpoint validation against blocklist

* command: Add SMS endpoint validation against blocklist

* Validate webhook endpoint against denylist on channel notification

* Remove unused tests

* handle deprecated denylists

* remove unintended denylist entry in deprecated list

* use single http client

* fix tests

* update comments

* fixes

* cleanup

* address comments

* fix merge

---------

Co-authored-by: Livio Spring <[email protected]>

internal/command/command.go

@@ -106,9 +106,9 @@ type Commands struct {
 	// so the query and cache overhead can be completely eliminated.
 	milestonesCompleted sync.Map
 
-	loginPaths        LoginPaths
-	ActionsV2DenyList []denylist.AddressChecker
-	IPLookupFunction  internal_net.IPLookupFunc
+	loginPaths       LoginPaths
+	ipLookupFunction internal_net.IPLookupFunc
+	denyList         []denylist.AddressChecker
 }
 
 //go:generate mockgen -package command -destination ./mock_login_paths.go . LoginPaths
@@ -138,7 +138,7 @@ func StartCommands(
 	defaultAccessTokenLifetime, defaultRefreshTokenLifetime, defaultRefreshTokenIdleLifetime time.Duration,
 	defaultSecretGenerators *SecretGenerators,
 	loginPaths LoginPaths,
-	actionsDeniedHostList []denylist.AddressChecker,
+	denyList []denylist.AddressChecker,
 ) (repo *Commands, err error) {
 	if externalDomain == "" {
 		return nil, zerrors.ThrowInvalidArgument(nil, "COMMAND-Df21s", "no external domain specified")
@@ -162,6 +162,7 @@ func StartCommands(
 	if err != nil {
 		return nil, fmt.Errorf("caches: %w", err)
 	}
+	ipLookupFunction := net.LookupIP
 	repo = &Commands{
 		eventstore:                      es,
 		static:                          staticStore,
@@ -228,11 +229,11 @@ func StartCommands(
 				WithHyphen: defaults.Multifactors.RecoveryCodes.WithHyphen,
 			},
 		},
-		GenerateDomain:    domain.NewGeneratedInstanceDomain,
-		caches:            caches,
-		loginPaths:        loginPaths,
-		ActionsV2DenyList: actionsDeniedHostList,
-		IPLookupFunction:  net.LookupIP,
+		GenerateDomain:   domain.NewGeneratedInstanceDomain,
+		caches:           caches,
+		loginPaths:       loginPaths,
+		ipLookupFunction: ipLookupFunction,
+		denyList:         denyList,
 	}
 
 	if defaultSecretGenerators != nil && defaultSecretGenerators.ClientSecret != nil {