git.iko.soy/typeable/oauth2-proxy
on v2.2 help sign in
typeable/oauth2-proxy/providers/github.go
239 lines 5.5 kB history raw
1package providers
3import (
4 "encoding/json"
5 "fmt"
6 "io/ioutil"
7 "log"
8 "net/http"
9 "net/url"
10 "path"
11 "strings"
14type GitHubProvider struct {
15 *ProviderData
16 Org string
17 Team string
20func NewGitHubProvider(p *ProviderData) *GitHubProvider {
21 p.ProviderName = "GitHub"
22 if p.LoginURL == nil || p.LoginURL.String() == "" {
23 p.LoginURL = &url.URL{
24 Scheme: "https",
25 Host: "github.com",
26 Path: "/login/oauth/authorize",
27 }
28 }
29 if p.RedeemURL == nil || p.RedeemURL.String() == "" {
30 p.RedeemURL = &url.URL{
31 Scheme: "https",
32 Host: "github.com",
33 Path: "/login/oauth/access_token",
34 }
35 }
36 // ValidationURL is the API Base URL
37 if p.ValidateURL == nil || p.ValidateURL.String() == "" {
38 p.ValidateURL = &url.URL{
39 Scheme: "https",
40 Host: "api.github.com",
41 Path: "/",
42 }
43 }
44 if p.Scope == "" {
45 p.Scope = "user:email"
46 }
47 return &GitHubProvider{ProviderData: p}
49func (p *GitHubProvider) SetOrgTeam(org, team string) {
50 p.Org = org
51 p.Team = team
52 if org != "" || team != "" {
53 p.Scope += " read:org"
54 }
57func (p *GitHubProvider) hasOrg(accessToken string) (bool, error) {
58 // https://developer.github.com/v3/orgs/#list-your-organizations
60 var orgs []struct {
61 Login string `json:"login"`
62 }
64 params := url.Values{
65 "access_token": {accessToken},
66 "limit": {"100"},
67 }
69 endpoint := &url.URL{
70 Scheme: p.ValidateURL.Scheme,
71 Host: p.ValidateURL.Host,
72 Path: path.Join(p.ValidateURL.Path, "/user/orgs"),
73 RawQuery: params.Encode(),
74 }
75 req, _ := http.NewRequest("GET", endpoint.String(), nil)
76 req.Header.Set("Accept", "application/vnd.github.v3+json")
77 resp, err := http.DefaultClient.Do(req)
78 if err != nil {
79 return false, err
80 }
82 body, err := ioutil.ReadAll(resp.Body)
83 resp.Body.Close()
84 if err != nil {
85 return false, err
86 }
87 if resp.StatusCode != 200 {
88 return false, fmt.Errorf(
89 "got %d from %q %s", resp.StatusCode, stripToken(endpoint.String()), body)
90 }
92 if err := json.Unmarshal(body, &orgs); err != nil {
93 return false, err
94 }
96 var presentOrgs []string
97 for _, org := range orgs {
98 if p.Org == org.Login {
99 log.Printf("Found Github Organization: %q", org.Login)
100 return true, nil
101 }
102 presentOrgs = append(presentOrgs, org.Login)
103 }
105 log.Printf("Missing Organization:%q in %v", p.Org, presentOrgs)
106 return false, nil
109func (p *GitHubProvider) hasOrgAndTeam(accessToken string) (bool, error) {
110 // https://developer.github.com/v3/orgs/teams/#list-user-teams
112 var teams []struct {
113 Name string `json:"name"`
114 Slug string `json:"slug"`
115 Org struct {
116 Login string `json:"login"`
117 } `json:"organization"`
118 }
120 params := url.Values{
121 "access_token": {accessToken},
122 "limit": {"100"},
123 }
125 endpoint := &url.URL{
126 Scheme: p.ValidateURL.Scheme,
127 Host: p.ValidateURL.Host,
128 Path: path.Join(p.ValidateURL.Path, "/user/teams"),
129 RawQuery: params.Encode(),
130 }
131 req, _ := http.NewRequest("GET", endpoint.String(), nil)
132 req.Header.Set("Accept", "application/vnd.github.v3+json")
133 resp, err := http.DefaultClient.Do(req)
134 if err != nil {
135 return false, err
136 }
138 body, err := ioutil.ReadAll(resp.Body)
139 resp.Body.Close()
140 if err != nil {
141 return false, err
142 }
143 if resp.StatusCode != 200 {
144 return false, fmt.Errorf(
145 "got %d from %q %s", resp.StatusCode, stripToken(endpoint.String()), body)
146 }
148 if err := json.Unmarshal(body, &teams); err != nil {
149 return false, fmt.Errorf("%s unmarshaling %s", err, body)
150 }
152 var hasOrg bool
153 presentOrgs := make(map[string]bool)
154 var presentTeams []string
155 for _, team := range teams {
156 presentOrgs[team.Org.Login] = true
157 if p.Org == team.Org.Login {
158 hasOrg = true
159 ts := strings.Split(p.Team, ",")
160 for _, t := range ts {
161 if t == team.Slug {
162 log.Printf("Found Github Organization:%q Team:%q (Name:%q)", team.Org.Login, team.Slug, team.Name)
163 return true, nil
164 }
165 }
166 presentTeams = append(presentTeams, team.Slug)
167 }
168 }
169 if hasOrg {
170 log.Printf("Missing Team:%q from Org:%q in teams: %v", p.Team, p.Org, presentTeams)
171 } else {
172 var allOrgs []string
173 for org, _ := range presentOrgs {
174 allOrgs = append(allOrgs, org)
175 }
176 log.Printf("Missing Organization:%q in %#v", p.Org, allOrgs)
177 }
178 return false, nil
181func (p *GitHubProvider) GetEmailAddress(s *SessionState) (string, error) {
183 var emails []struct {
184 Email string `json:"email"`
185 Primary bool `json:"primary"`
186 }
188 // if we require an Org or Team, check that first
189 if p.Org != "" {
190 if p.Team != "" {
191 if ok, err := p.hasOrgAndTeam(s.AccessToken); err != nil || !ok {
192 return "", err
193 }
194 } else {
195 if ok, err := p.hasOrg(s.AccessToken); err != nil || !ok {
196 return "", err
197 }
198 }
199 }
201 params := url.Values{
202 "access_token": {s.AccessToken},
203 }
205 endpoint := &url.URL{
206 Scheme: p.ValidateURL.Scheme,
207 Host: p.ValidateURL.Host,
208 Path: path.Join(p.ValidateURL.Path, "/user/emails"),
209 RawQuery: params.Encode(),
210 }
211 resp, err := http.DefaultClient.Get(endpoint.String())
212 if err != nil {
213 return "", err
214 }
215 body, err := ioutil.ReadAll(resp.Body)
216 resp.Body.Close()
217 if err != nil {
218 return "", err
219 }
221 if resp.StatusCode != 200 {
222 return "", fmt.Errorf("got %d from %q %s",
223 resp.StatusCode, stripToken(endpoint.String()), body)
224 } else {
225 log.Printf("got %d from %q %s", resp.StatusCode, stripToken(endpoint.String()), body)
226 }
228 if err := json.Unmarshal(body, &emails); err != nil {
229 return "", fmt.Errorf("%s unmarshaling %s", err, body)
230 }
232 for _, email := range emails {
233 if email.Primary {
234 return email.Email, nil
235 }
236 }
238 return "", nil