Access phase cut off if cs disabled or no-decision

[rhiznomad]

I have multiple things happening in my access phase, cs.Allow() being one of them.
Yet when cs is disabled or there's no decision, this bouncer will call ngx.exit(ngx.DECLINED)

Doing so, nothing after cs.allow() in the access phase is processed anymore. I believe crowdsec being disabled or having no decision, should not exit the access phase completely.

Noted this issue from @blotus by searching for lua-cs-bouncer access phase and brought me in the right direction to this point; thank you for good docs. Im not aware about the satisfy any or such items and don't have a solution for that issue, yet yea; declined and thereby stopping the access phase from continuing is unfortunately not the answer either I think.

Edit: ngx.declined is also set for enable_internal and exclude_location (whitelist) related use cases.

[rhiznomad]

According to copilot, replacing nginx.exit(ngx.DECLINED) with return ngx.DECLINED is the way to work with satisfy any mentioned in the original issue. For now seems to solve my issue of access phase being cut off completely at least.

Further message below is the copilot response;

1. In the access phase, returning ngx.OK or ngx.HTTP_OK will short-circuit all further access handlers—this is why your auth_basic is bypassed.
2. To allow other access handlers (like auth_basic, allow, deny) to run, your Lua handler must return ngx.DECLINED when it does not want to make a decision (i.e., “I don’t want to do anything with this request; continue the access phase”).
3. This is the correct and intended way to cooperate with satisfy any and other access logic in NGINX/OpenResty.

Actionable fix:

• In your Lua handler, whenever you want to “pass” and let NGINX continue evaluating other access handlers, use:

  return ngx.DECLINED

• Do NOT use ngx.exit(ngx.DECLINED) unless you want to immediately abort Lua execution (which is fine if you want to stop your script right there).

Example pattern:

if not is_bouncer_enabled() then
    ngx.log(ngx.ERR, "bouncer disabled by user")
    return ngx.DECLINED
end

TLDR:

• Use return ngx.DECLINED in your access_by_lua handler to “do nothing and continue the access phase.”
• This is required for correct satisfy any/auth_basic/allow/deny behavior.