exit with ngx.DECLINED when the request is allowed

[blotus]

Closes #61.

The bouncer is running in the access phase of nginx, and an access handler can have 3 different return code:

• ngx.OK: request is allowed to go through (and bypass any remaining handler in the phase)
• >= ngx.HTTP_OK: return this code to nginx and skip all remaining phases
• ngx.DECLINED: tell nginx we are not interested in handling the request (and so, we are not taken into account when resolving satisfy).

ngx.DECLINED is not really documented in the LUA module (best I could find is this and this

We didn't explicitly tell nginx we were not interested in handling the request in the following case:

• The bouncer is disabled in the configuration
• The bouncer has no decision for the IP

This caused any configuration using satisfy any to not behave as expected: because we were implicitly allowing the request, any other check (such as IP or credentials) was ignored.

We now explicitly exit the handler with ngx.DECLINED when:

• The bouncer is not enabled
• We are in an excluded location
• We have no decision for the IP

This slightly changes the behavior of the bouncer: if an IP is allowed (through an allow directive or correct HTTP credentials) AND nginx is configured with satisfy any, the request will be allowed to go through even if there's a decision for the IP or if the appsec component decided to block the request (this can be worked around by using satisfy all, but this is not suitable for all situations).

[LaurenceJJones]

LGTM