Reject requets with no tokenized data

tokenizer.go

@@ -59,7 +59,7 @@ func NewTokenizer(openKey string) *tokenizer {
 	proxy := goproxy.NewProxyHttpServer()
 	tkz := &tokenizer{ProxyHttpServer: proxy, priv: priv, pub: pub}
 
-	tkz.NonproxyHandler = http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+	proxy.NonproxyHandler = http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		fmt.Fprintln(w, "I'm not that kind of server")
 	})
 
@@ -156,6 +156,13 @@ func (t *tokenizer) HandleRequest(req *http.Request, ctx *goproxy.ProxyCtx) (*ht
 		processors = append(processors, reqProcessors...)
 	}
 
+	if len(processors) == 0 {
+		pud.reqLog.Warn("no processors")
+		return nil, errorResponse(ErrBadRequest)
+	}
+
+	pud.reqLog = pud.reqLog.WithField("processors", len(processors))
+
 	for _, processor := range processors {
 		if err := processor(req); err != nil {
 			pud.reqLog.WithError(err).Warn("run processor")

tokenizer_test.go

@@ -47,33 +47,30 @@ func TestTokenizer(t *testing.T) {
 	tkzServer := httptest.NewServer(tkz)
 	defer tkzServer.Close()
 
-	client, err := Client(tkzServer.URL)
+	req, err := http.NewRequest(http.MethodPost, appURL+"/foo", nil)
 	assert.NoError(t, err)
 
-	req, err := http.NewRequest(http.MethodPost, appURL+"/foo", nil)
+	auth := "trustno1"
+	token := "supersecret"
+	secret, err := (&Secret{AuthConfig: NewBearerAuthConfig(auth), ProcessorConfig: &InjectProcessorConfig{Token: token}}).Seal(sealKey)
 	assert.NoError(t, err)
 
 	// TLS error (proxy doesn't trust upstream)
+	client, err := Client(tkzServer.URL, WithAuth(auth), WithSecret(secret, nil))
+	assert.NoError(t, err)
 	resp, err := client.Get(appURL)
 	assert.NoError(t, err)
 	assert.Equal(t, http.StatusBadGateway, resp.StatusCode)
 
 	// make proxy trust upstream
 	UpstreamTrust.AddCert(appServer.Certificate())
 
-	// no proxy auth or secrets (good)
-	assert.Equal(t, &echoResponse{
-		Headers: http.Header{},
-		Body:    "",
-	}, doEcho(t, client, req))
-
-	// bad proxy auth doesn't matter if no secrets are used
-	client, err = Client(tkzServer.URL, WithAuth("bogus"))
+	// error if no secrets
+	client, err = Client(tkzServer.URL, WithAuth(auth))
+	assert.NoError(t, err)
+	resp, err = client.Get(appURL)
 	assert.NoError(t, err)
-	assert.Equal(t, &echoResponse{
-		Headers: http.Header{}, // proxy auth isn't leaked downstream
-		Body:    "",
-	}, doEcho(t, client, req))
+	assert.Equal(t, http.StatusBadRequest, resp.StatusCode)
 
 	t.Run("inject processor", func(t *testing.T) {
 		auth := "trustno1"