add path param lure customization

Signed-off-by: RonniSkansing <rskansing@gmail.com>

backend/proxy/proxy.go

@@ -3041,11 +3041,19 @@ func (m *ProxyHandler) sameSiteToString(sameSite http.SameSite) string {
 func (m *ProxyHandler) getCampaignRecipientIDFromURLParams(req *http.Request) (*uuid.UUID, string) {
 	ctx := req.Context()
 
-	campaignRecipient, paramName, err := server.GetCampaignRecipientFromURLParams(
+	// on a proxy domain every path mirrors the target site, so a lure code
+	// shaped path segment could belong to the target rather than to a
+	// recipient. once a session cookie exists the recipient is already known,
+	// so the path form is switched off. this removes the misattribution risk and
+	// keeps every subresource of a proxied page from running an extra lookup.
+	allowPathLookup := !m.hasValidSessionCookie(req)
+
+	campaignRecipient, match, err := server.GetCampaignRecipientFromURLParams(
 		ctx,
 		req,
 		m.IdentifierRepository,
 		m.CampaignRecipientRepository,
+		allowPathLookup,
 	)
 	if err != nil {
 		m.logger.Errorw("failed to get identifiers for URL param extraction", "error", err)
@@ -3056,8 +3064,16 @@ func (m *ProxyHandler) getCampaignRecipientIDFromURLParams(req *http.Request) (*
 		return nil, ""
 	}
 
+	// take a consumed code back out of the path before anything downstream sees
+	// the URL. url rewrite rules compare the path exactly, and whatever is left
+	// here is forwarded to the target. the query form is stripped later through
+	// ParamName.
+	if match.PathSegment != "" {
+		req.URL.Path = server.TrimLastPathSegment(req.URL.Path)
+	}
+
 	campaignRecipientID := campaignRecipient.ID.MustGet()
-	return &campaignRecipientID, paramName
+	return &campaignRecipientID, match.ParamName
 }
 
 // applyEarlyRequestHeaderReplacements applies request header replacements before client creation
@@ -3878,6 +3894,16 @@ func (m *ProxyHandler) IsValidProxyCookie(cookie string) bool {
 	return m.isValidSessionCookie(cookie)
 }
 
+// hasValidSessionCookie reports whether the request already carries a live
+// proxy session, meaning the recipient behind it is established.
+func (m *ProxyHandler) hasValidSessionCookie(req *http.Request) bool {
+	sessionCookie, err := req.Cookie(m.cookieName)
+	if err != nil {
+		return false
+	}
+	return m.isValidSessionCookie(sessionCookie.Value)
+}
+
 // checkResponseRules checks if any response rules match the current request
 func (m *ProxyHandler) checkResponseRules(req *http.Request, reqCtx *RequestContext) *http.Response {
 	// check global response rules first