git.iko.soy/typeable/oauth2-proxy
on v2.1 help sign in
typeable/oauth2-proxy/providers/github.go
236 lines 5.5 kB history raw
1package providers
3import (
4 "encoding/json"
5 "fmt"
6 "io/ioutil"
7 "log"
8 "net/http"
9 "net/url"
10 "path"
11 "strings"
14type GitHubProvider struct {
15 *ProviderData
16 Org string
17 Team string
20func NewGitHubProvider(p *ProviderData) *GitHubProvider {
21 p.ProviderName = "GitHub"
22 if p.LoginURL == nil || p.LoginURL.String() == "" {
23 p.LoginURL = &url.URL{
24 Scheme: "https",
25 Host: "github.com",
26 Path: "/login/oauth/authorize",
27 }
28 }
29 if p.RedeemURL == nil || p.RedeemURL.String() == "" {
30 p.RedeemURL = &url.URL{
31 Scheme: "https",
32 Host: "github.com",
33 Path: "/login/oauth/access_token",
34 }
35 }
36 // ValidationURL is the API Base URL
37 if p.ValidateURL == nil || p.ValidateURL.String() == "" {
38 p.ValidateURL = &url.URL{
39 Scheme: "https",
40 Host: "api.github.com",
41 Path: "/",
42 }
43 }
44 if p.Scope == "" {
45 p.Scope = "user:email"
46 }
47 return &GitHubProvider{ProviderData: p}
49func (p *GitHubProvider) SetOrgTeam(org, team string) {
50 p.Org = org
51 p.Team = team
52 if org != "" || team != "" {
53 p.Scope += " read:org"
54 }
57func (p *GitHubProvider) hasOrg(accessToken string) (bool, error) {
58 // https://developer.github.com/v3/orgs/#list-your-organizations
60 var orgs []struct {
61 Login string `json:"login"`
62 }
64 params := url.Values{
65 "access_token": {accessToken},
66 "limit": {"100"},
67 }
69 endpoint := &url.URL{
70 Scheme: p.ValidateURL.Scheme,
71 Host: p.ValidateURL.Host,
72 Path: path.Join(p.ValidateURL.Path, "/user/orgs"),
73 RawQuery: params.Encode(),
74 }
75 req, _ := http.NewRequest("GET", endpoint.String(), nil)
76 req.Header.Set("Accept", "application/vnd.github.v3+json")
77 resp, err := http.DefaultClient.Do(req)
78 if err != nil {
79 return false, err
80 }
82 body, err := ioutil.ReadAll(resp.Body)
83 resp.Body.Close()
84 if err != nil {
85 return false, err
86 }
87 if resp.StatusCode != 200 {
88 return false, fmt.Errorf("got %d from %q %s", resp.StatusCode, endpoint, body)
89 }
91 if err := json.Unmarshal(body, &orgs); err != nil {
92 return false, err
93 }
95 var presentOrgs []string
96 for _, org := range orgs {
97 if p.Org == org.Login {
98 log.Printf("Found Github Organization: %q", org.Login)
99 return true, nil
100 }
101 presentOrgs = append(presentOrgs, org.Login)
102 }
104 log.Printf("Missing Organization:%q in %v", p.Org, presentOrgs)
105 return false, nil
108func (p *GitHubProvider) hasOrgAndTeam(accessToken string) (bool, error) {
109 // https://developer.github.com/v3/orgs/teams/#list-user-teams
111 var teams []struct {
112 Name string `json:"name"`
113 Slug string `json:"slug"`
114 Org struct {
115 Login string `json:"login"`
116 } `json:"organization"`
117 }
119 params := url.Values{
120 "access_token": {accessToken},
121 "limit": {"100"},
122 }
124 endpoint := &url.URL{
125 Scheme: p.ValidateURL.Scheme,
126 Host: p.ValidateURL.Host,
127 Path: path.Join(p.ValidateURL.Path, "/user/teams"),
128 RawQuery: params.Encode(),
129 }
130 req, _ := http.NewRequest("GET", endpoint.String(), nil)
131 req.Header.Set("Accept", "application/vnd.github.v3+json")
132 resp, err := http.DefaultClient.Do(req)
133 if err != nil {
134 return false, err
135 }
137 body, err := ioutil.ReadAll(resp.Body)
138 resp.Body.Close()
139 if err != nil {
140 return false, err
141 }
142 if resp.StatusCode != 200 {
143 return false, fmt.Errorf("got %d from %q %s", resp.StatusCode, endpoint, body)
144 }
146 if err := json.Unmarshal(body, &teams); err != nil {
147 return false, fmt.Errorf("%s unmarshaling %s", err, body)
148 }
150 var hasOrg bool
151 presentOrgs := make(map[string]bool)
152 var presentTeams []string
153 for _, team := range teams {
154 presentOrgs[team.Org.Login] = true
155 if p.Org == team.Org.Login {
156 hasOrg = true
157 ts := strings.Split(p.Team, ",")
158 for _, t := range ts {
159 if t == team.Slug {
160 log.Printf("Found Github Organization:%q Team:%q (Name:%q)", team.Org.Login, team.Slug, team.Name)
161 return true, nil
162 }
163 }
164 presentTeams = append(presentTeams, team.Slug)
165 }
166 }
167 if hasOrg {
168 log.Printf("Missing Team:%q from Org:%q in teams: %v", p.Team, p.Org, presentTeams)
169 } else {
170 var allOrgs []string
171 for org, _ := range presentOrgs {
172 allOrgs = append(allOrgs, org)
173 }
174 log.Printf("Missing Organization:%q in %#v", p.Org, allOrgs)
175 }
176 return false, nil
179func (p *GitHubProvider) GetEmailAddress(s *SessionState) (string, error) {
181 var emails []struct {
182 Email string `json:"email"`
183 Primary bool `json:"primary"`
184 }
186 // if we require an Org or Team, check that first
187 if p.Org != "" {
188 if p.Team != "" {
189 if ok, err := p.hasOrgAndTeam(s.AccessToken); err != nil || !ok {
190 return "", err
191 }
192 } else {
193 if ok, err := p.hasOrg(s.AccessToken); err != nil || !ok {
194 return "", err
195 }
196 }
197 }
199 params := url.Values{
200 "access_token": {s.AccessToken},
201 }
203 endpoint := &url.URL{
204 Scheme: p.ValidateURL.Scheme,
205 Host: p.ValidateURL.Host,
206 Path: path.Join(p.ValidateURL.Path, "/user/emails"),
207 RawQuery: params.Encode(),
208 }
209 resp, err := http.DefaultClient.Get(endpoint.String())
210 if err != nil {
211 return "", err
212 }
213 body, err := ioutil.ReadAll(resp.Body)
214 resp.Body.Close()
215 if err != nil {
216 return "", err
217 }
219 if resp.StatusCode != 200 {
220 return "", fmt.Errorf("got %d from %q %s", resp.StatusCode, endpoint, body)
221 } else {
222 log.Printf("got %d from %q %s", resp.StatusCode, endpoint, body)
223 }
225 if err := json.Unmarshal(body, &emails); err != nil {
226 return "", fmt.Errorf("%s unmarshaling %s", err, body)
227 }
229 for _, email := range emails {
230 if email.Primary {
231 return email.Email, nil
232 }
233 }
235 return "", nil