git.iko.soy/typeable/oauth2-proxy
on 71dc702 help sign in
typeable/oauth2-proxy/providers/github_test.go
395 lines 13 kB history raw
1package providers
3import (
4 "context"
5 "net/http"
6 "net/http/httptest"
7 "net/url"
8 "testing"
10 "github.com/oauth2-proxy/oauth2-proxy/pkg/apis/sessions"
11 "github.com/stretchr/testify/assert"
14func testGitHubProvider(hostname string) *GitHubProvider {
15 p := NewGitHubProvider(
16 &ProviderData{
17 ProviderName: "",
18 LoginURL: &url.URL{},
19 RedeemURL: &url.URL{},
20 ProfileURL: &url.URL{},
21 ValidateURL: &url.URL{},
22 Scope: ""})
23 if hostname != "" {
24 updateURL(p.Data().LoginURL, hostname)
25 updateURL(p.Data().RedeemURL, hostname)
26 updateURL(p.Data().ProfileURL, hostname)
27 updateURL(p.Data().ValidateURL, hostname)
28 }
29 return p
32func testGitHubBackend(payloads map[string][]string) *httptest.Server {
33 pathToQueryMap := map[string][]string{
34 "/repo/oauth2-proxy/oauth2-proxy": {""},
35 "/repos/oauth2-proxy/oauth2-proxy/collaborators/mbland": {""},
36 "/user": {""},
37 "/user/emails": {""},
38 "/user/orgs": {"page=1&per_page=100", "page=2&per_page=100", "page=3&per_page=100"},
39 }
41 return httptest.NewServer(http.HandlerFunc(
42 func(w http.ResponseWriter, r *http.Request) {
43 query, ok := pathToQueryMap[r.URL.Path]
44 validQuery := false
45 index := 0
46 for i, q := range query {
47 if q == r.URL.RawQuery {
48 validQuery = true
49 index = i
50 }
51 }
52 payload := []string{}
53 if ok && validQuery {
54 payload, ok = payloads[r.URL.Path]
55 }
56 if !ok {
57 w.WriteHeader(404)
58 } else if !validQuery {
59 w.WriteHeader(404)
60 } else if payload[index] == "" {
61 w.WriteHeader(204)
62 } else {
63 w.WriteHeader(200)
64 w.Write([]byte(payload[index]))
65 }
66 }))
69func TestGitHubProviderDefaults(t *testing.T) {
70 p := testGitHubProvider("")
71 assert.NotEqual(t, nil, p)
72 assert.Equal(t, "GitHub", p.Data().ProviderName)
73 assert.Equal(t, "https://github.com/login/oauth/authorize",
74 p.Data().LoginURL.String())
75 assert.Equal(t, "https://github.com/login/oauth/access_token",
76 p.Data().RedeemURL.String())
77 assert.Equal(t, "https://api.github.com/",
78 p.Data().ValidateURL.String())
79 assert.Equal(t, "user:email", p.Data().Scope)
82func TestGitHubProviderOverrides(t *testing.T) {
83 p := NewGitHubProvider(
84 &ProviderData{
85 LoginURL: &url.URL{
86 Scheme: "https",
87 Host: "example.com",
88 Path: "/login/oauth/authorize"},
89 RedeemURL: &url.URL{
90 Scheme: "https",
91 Host: "example.com",
92 Path: "/login/oauth/access_token"},
93 ValidateURL: &url.URL{
94 Scheme: "https",
95 Host: "api.example.com",
96 Path: "/"},
97 Scope: "profile"})
98 assert.NotEqual(t, nil, p)
99 assert.Equal(t, "GitHub", p.Data().ProviderName)
100 assert.Equal(t, "https://example.com/login/oauth/authorize",
101 p.Data().LoginURL.String())
102 assert.Equal(t, "https://example.com/login/oauth/access_token",
103 p.Data().RedeemURL.String())
104 assert.Equal(t, "https://api.example.com/",
105 p.Data().ValidateURL.String())
106 assert.Equal(t, "profile", p.Data().Scope)
109func TestGitHubProviderGetEmailAddress(t *testing.T) {
110 b := testGitHubBackend(map[string][]string{
111 "/user/emails": {`[ {"email": "michael.bland@gsa.gov", "verified": true, "primary": true} ]`},
112 })
113 defer b.Close()
115 bURL, _ := url.Parse(b.URL)
116 p := testGitHubProvider(bURL.Host)
118 session := CreateAuthorizedSession()
119 email, err := p.GetEmailAddress(context.Background(), session)
120 assert.Equal(t, nil, err)
121 assert.Equal(t, "michael.bland@gsa.gov", email)
124func TestGitHubProviderGetEmailAddressNotVerified(t *testing.T) {
125 b := testGitHubBackend(map[string][]string{
126 "/user/emails": {`[ {"email": "michael.bland@gsa.gov", "verified": true, "primary": true} ]`},
127 })
128 defer b.Close()
130 bURL, _ := url.Parse(b.URL)
131 p := testGitHubProvider(bURL.Host)
133 session := CreateAuthorizedSession()
134 email, err := p.GetEmailAddress(context.Background(), session)
135 assert.Equal(t, nil, err)
136 assert.Empty(t, "", email)
139func TestGitHubProviderGetEmailAddressWithOrg(t *testing.T) {
140 b := testGitHubBackend(map[string][]string{
141 "/user/emails": {`[ {"email": "michael.bland@gsa.gov", "verified": true, "primary": true} ]`},
142 "/user/orgs": {
143 `[ {"login":"testorg"} ]`,
144 `[ {"login":"testorg1"} ]`,
145 `[ ]`,
146 },
147 })
148 defer b.Close()
150 bURL, _ := url.Parse(b.URL)
151 p := testGitHubProvider(bURL.Host)
152 p.Org = "testorg1"
154 session := CreateAuthorizedSession()
155 email, err := p.GetEmailAddress(context.Background(), session)
156 assert.Equal(t, nil, err)
157 assert.Equal(t, "michael.bland@gsa.gov", email)
160func TestGitHubProviderGetEmailAddressWithWriteAccessToPublicRepo(t *testing.T) {
161 b := testGitHubBackend(map[string][]string{
162 "/repo/oauth2-proxy/oauth2-proxy": {`{"permissions": {"pull": true, "push": true}, "private": false}`},
163 "/user/emails": {`[ {"email": "michael.bland@gsa.gov", "verified": true, "primary": true} ]`},
164 })
165 defer b.Close()
167 bURL, _ := url.Parse(b.URL)
168 p := testGitHubProvider(bURL.Host)
169 p.SetRepo("oauth2-proxy/oauth2-proxy", "")
171 session := CreateAuthorizedSession()
172 email, err := p.GetEmailAddress(context.Background(), session)
173 assert.Equal(t, nil, err)
174 assert.Equal(t, "michael.bland@gsa.gov", email)
177func TestGitHubProviderGetEmailAddressWithReadOnlyAccessToPrivateRepo(t *testing.T) {
178 b := testGitHubBackend(map[string][]string{
179 "/repo/oauth2-proxy/oauth2-proxy": {`{"permissions": {"pull": true, "push": false}, "private": true}`},
180 "/user/emails": {`[ {"email": "michael.bland@gsa.gov", "verified": true, "primary": true} ]`},
181 })
182 defer b.Close()
184 bURL, _ := url.Parse(b.URL)
185 p := testGitHubProvider(bURL.Host)
186 p.SetRepo("oauth2-proxy/oauth2-proxy", "")
188 session := CreateAuthorizedSession()
189 email, err := p.GetEmailAddress(context.Background(), session)
190 assert.Equal(t, nil, err)
191 assert.Equal(t, "michael.bland@gsa.gov", email)
194func TestGitHubProviderGetEmailAddressWithWriteAccessToPrivateRepo(t *testing.T) {
195 b := testGitHubBackend(map[string][]string{
196 "/repo/oauth2-proxy/oauth2-proxy": {`{"permissions": {"pull": true, "push": true}, "private": true}`},
197 "/user/emails": {`[ {"email": "michael.bland@gsa.gov", "verified": true, "primary": true} ]`},
198 })
199 defer b.Close()
201 bURL, _ := url.Parse(b.URL)
202 p := testGitHubProvider(bURL.Host)
203 p.SetRepo("oauth2-proxy/oauth2-proxy", "")
205 session := CreateAuthorizedSession()
206 email, err := p.GetEmailAddress(context.Background(), session)
207 assert.Equal(t, nil, err)
208 assert.Equal(t, "michael.bland@gsa.gov", email)
211func TestGitHubProviderGetEmailAddressWithNoAccessToPrivateRepo(t *testing.T) {
212 b := testGitHubBackend(map[string][]string{
213 "/repo/oauth2-proxy/oauth2-proxy": {},
214 })
215 defer b.Close()
217 bURL, _ := url.Parse(b.URL)
218 p := testGitHubProvider(bURL.Host)
219 p.SetRepo("oauth2-proxy/oauth2-proxy", "")
221 session := CreateAuthorizedSession()
222 email, err := p.GetEmailAddress(context.Background(), session)
223 assert.NotEqual(t, nil, err)
224 assert.Equal(t, "", email)
227func TestGitHubProviderGetEmailAddressWithToken(t *testing.T) {
228 b := testGitHubBackend(map[string][]string{
229 "/user/emails": {`[ {"email": "michael.bland@gsa.gov", "verified": true, "primary": true} ]`},
230 })
231 defer b.Close()
233 bURL, _ := url.Parse(b.URL)
234 p := testGitHubProvider(bURL.Host)
235 p.SetRepo("oauth2-proxy/oauth2-proxy", "token")
237 session := CreateAuthorizedSession()
238 email, err := p.GetEmailAddress(context.Background(), session)
239 assert.Equal(t, nil, err)
240 assert.Equal(t, "michael.bland@gsa.gov", email)
243// Note that trying to trigger the "failed building request" case is not
244// practical, since the only way it can fail is if the URL fails to parse.
245func TestGitHubProviderGetEmailAddressFailedRequest(t *testing.T) {
246 b := testGitHubBackend(map[string][]string{})
247 defer b.Close()
249 bURL, _ := url.Parse(b.URL)
250 p := testGitHubProvider(bURL.Host)
252 // We'll trigger a request failure by using an unexpected access
253 // token. Alternatively, we could allow the parsing of the payload as
254 // JSON to fail.
255 session := &sessions.SessionState{AccessToken: "unexpected_access_token"}
256 email, err := p.GetEmailAddress(context.Background(), session)
257 assert.NotEqual(t, nil, err)
258 assert.Equal(t, "", email)
261func TestGitHubProviderGetEmailAddressEmailNotPresentInPayload(t *testing.T) {
262 b := testGitHubBackend(map[string][]string{
263 "/user/emails": {`{"foo": "bar"}`},
264 })
265 defer b.Close()
267 bURL, _ := url.Parse(b.URL)
268 p := testGitHubProvider(bURL.Host)
270 session := CreateAuthorizedSession()
271 email, err := p.GetEmailAddress(context.Background(), session)
272 assert.NotEqual(t, nil, err)
273 assert.Equal(t, "", email)
276func TestGitHubProviderGetUserName(t *testing.T) {
277 b := testGitHubBackend(map[string][]string{
278 "/user": {`{"email": "michael.bland@gsa.gov", "login": "mbland"}`},
279 })
280 defer b.Close()
282 bURL, _ := url.Parse(b.URL)
283 p := testGitHubProvider(bURL.Host)
285 session := CreateAuthorizedSession()
286 email, err := p.GetUserName(context.Background(), session)
287 assert.Equal(t, nil, err)
288 assert.Equal(t, "mbland", email)
291func TestGitHubProviderGetUserNameWithRepoAndToken(t *testing.T) {
292 b := testGitHubBackend(map[string][]string{
293 "/user": {`{"email": "michael.bland@gsa.gov", "login": "mbland"}`},
294 "/repos/oauth2-proxy/oauth2-proxy/collaborators/mbland": {""},
295 })
296 defer b.Close()
298 bURL, _ := url.Parse(b.URL)
299 p := testGitHubProvider(bURL.Host)
300 p.SetRepo("oauth2-proxy/oauth2-proxy", "token")
302 session := CreateAuthorizedSession()
303 email, err := p.GetUserName(context.Background(), session)
304 assert.Equal(t, nil, err)
305 assert.Equal(t, "mbland", email)
308func TestGitHubProviderGetUserNameWithRepoAndTokenWithoutPushAccess(t *testing.T) {
309 b := testGitHubBackend(map[string][]string{})
310 defer b.Close()
312 bURL, _ := url.Parse(b.URL)
313 p := testGitHubProvider(bURL.Host)
314 p.SetRepo("oauth2-proxy/oauth2-proxy", "token")
316 session := CreateAuthorizedSession()
317 email, err := p.GetUserName(context.Background(), session)
318 assert.NotEqual(t, nil, err)
319 assert.Equal(t, "", email)
322func TestGitHubProviderGetEmailAddressWithUsername(t *testing.T) {
323 b := testGitHubBackend(map[string][]string{
324 "/user": {`{"email": "michael.bland@gsa.gov", "login": "mbland"}`},
325 "/user/emails": {`[ {"email": "michael.bland@gsa.gov", "verified": true, "primary": true} ]`},
326 })
327 defer b.Close()
329 bURL, _ := url.Parse(b.URL)
330 p := testGitHubProvider(bURL.Host)
331 p.SetUsers([]string{"mbland", "octocat"})
333 session := CreateAuthorizedSession()
334 email, err := p.GetEmailAddress(context.Background(), session)
335 assert.Equal(t, nil, err)
336 assert.Equal(t, "michael.bland@gsa.gov", email)
339func TestGitHubProviderGetEmailAddressWithNotAllowedUsername(t *testing.T) {
340 b := testGitHubBackend(map[string][]string{
341 "/user": {`{"email": "michael.bland@gsa.gov", "login": "mbland"}`},
342 "/user/emails": {`[ {"email": "michael.bland@gsa.gov", "verified": true, "primary": true} ]`},
343 })
344 defer b.Close()
346 bURL, _ := url.Parse(b.URL)
347 p := testGitHubProvider(bURL.Host)
348 p.SetUsers([]string{"octocat"})
350 session := CreateAuthorizedSession()
351 email, err := p.GetEmailAddress(context.Background(), session)
352 assert.NotEqual(t, nil, err)
353 assert.Equal(t, "", email)
356func TestGitHubProviderGetEmailAddressWithUsernameAndNotBelongToOrg(t *testing.T) {
357 b := testGitHubBackend(map[string][]string{
358 "/user": {`{"email": "michael.bland@gsa.gov", "login": "mbland"}`},
359 "/user/emails": {`[ {"email": "michael.bland@gsa.gov", "verified": true, "primary": true} ]`},
360 "/user/orgs": {
361 `[ {"login":"testorg"} ]`,
362 `[ ]`,
363 },
364 })
365 defer b.Close()
367 bURL, _ := url.Parse(b.URL)
368 p := testGitHubProvider(bURL.Host)
369 p.SetOrgTeam("not_belong_to", "")
370 p.SetUsers([]string{"mbland"})
372 session := CreateAuthorizedSession()
373 email, err := p.GetEmailAddress(context.Background(), session)
374 assert.Equal(t, nil, err)
375 assert.Equal(t, "michael.bland@gsa.gov", email)
378func TestGitHubProviderGetEmailAddressWithUsernameAndNoAccessToPrivateRepo(t *testing.T) {
379 b := testGitHubBackend(map[string][]string{
380 "/user": {`{"email": "michael.bland@gsa.gov", "login": "mbland"}`},
381 "/user/emails": {`[ {"email": "michael.bland@gsa.gov", "verified": true, "primary": true} ]`},
382 "/repo/oauth2-proxy/oauth2-proxy": {},
383 })
384 defer b.Close()
386 bURL, _ := url.Parse(b.URL)
387 p := testGitHubProvider(bURL.Host)
388 p.SetRepo("oauth2-proxy/oauth2-proxy", "")
389 p.SetUsers([]string{"mbland"})
391 session := CreateAuthorizedSession()
392 email, err := p.GetEmailAddress(context.Background(), session)
393 assert.Equal(t, nil, err)
394 assert.Equal(t, "michael.bland@gsa.gov", email)