git.iko.soy/typeable/oauth2-proxy
on master help sign in
Refactor GitLab to EnrichSessionState
commit0da45e97e163c2dd901a4d336c4fa14412c19406 authorNick Meves <nick.meves@greenhouse.io> dateSun 27 Sep 2020, 15:15 (6 years ago) parente51f5fe
2 files changed+23−79
compare with master
unifiedsplit
providers/gitlab.go+8−35 providers/gitlab_test.go+15−44
providers/gitlab.go+8−35
@@ -3,7 +3,6 @@ package providers
33import (
44 "context"
55 "fmt"
6− "strings"
76 "time"
87
98 oidc "github.com/coreos/go-oidc"
@@ -168,20 +167,6 @@ func (p *GitLabProvider) verifyGroupMembership(userInfo *gitlabUserInfo) error {
168167 return fmt.Errorf("user is not a member of '%s'", p.Groups)
169168}
170169
171−func (p *GitLabProvider) verifyEmailDomain(userInfo *gitlabUserInfo) error {
172− if len(p.EmailDomains) == 0 || p.EmailDomains[0] == "*" {
173− return nil
174− }
175−
176− for _, domain := range p.EmailDomains {
177− if strings.HasSuffix(userInfo.Email, domain) {
178− return nil
179− }
180− }
181−
182− return fmt.Errorf("user email is not one of the valid domains '%v'", p.EmailDomains)
183−}
184−
185170func (p *GitLabProvider) createSessionState(ctx context.Context, token *oauth2.Token) (*sessions.SessionState, error) {
186171 rawIDToken, ok := token.Extra("id_token").(string)
187172 if !ok {
@@ -211,39 +196,27 @@ func (p *GitLabProvider) ValidateSessionState(ctx context.Context, s *sessions.S
211196}
212197
213198// GetEmailAddress returns the Account email address
214−func (p *GitLabProvider) GetEmailAddress(ctx context.Context, s *sessions.SessionState) (string, error) {
199+func (p *GitLabProvider) EnrichSessionState(ctx context.Context, s *sessions.SessionState) error {
215200 // Retrieve user info
216201 userInfo, err := p.getUserInfo(ctx, s)
217202 if err != nil {
218− return "", fmt.Errorf("failed to retrieve user info: %v", err)
203+ return fmt.Errorf("failed to retrieve user info: %v", err)
219204 }
220205
221206 // Check if email is verified
222207 if !p.AllowUnverifiedEmail && !userInfo.EmailVerified {
223− return "", fmt.Errorf("user email is not verified")
224− }
225−
226− // Check if email has valid domain
227− err = p.verifyEmailDomain(userInfo)
228− if err != nil {
229− return "", fmt.Errorf("email domain check failed: %v", err)
208+ return fmt.Errorf("user email is not verified")
230209 }
231210
232211 // Check group membership
212+ // TODO (@NickMeves) - Refactor to Authorize
233213 err = p.verifyGroupMembership(userInfo)
234214 if err != nil {
235− return "", fmt.Errorf("group membership check failed: %v", err)
215+ return fmt.Errorf("group membership check failed: %v", err)
236216 }
237217
238− return userInfo.Email, nil
239−}
240−
241−// GetUserName returns the Account user name
242−func (p *GitLabProvider) GetUserName(ctx context.Context, s *sessions.SessionState) (string, error) {
243− userInfo, err := p.getUserInfo(ctx, s)
244− if err != nil {
245− return "", fmt.Errorf("failed to retrieve user info: %v", err)
246− }
218+ s.User = userInfo.Username
219+ s.Email = userInfo.Email
247220
248− return userInfo.Username, nil
221+ return nil
249222}
providers/gitlab_test.go+15−44
@@ -64,8 +64,8 @@ func TestGitLabProviderBadToken(t *testing.T) {
6464 p := testGitLabProvider(bURL.Host)
6565
6666 session := &sessions.SessionState{AccessToken: "unexpected_gitlab_access_token"}
67− _, err := p.GetEmailAddress(context.Background(), session)
68− assert.NotEqual(t, nil, err)
67+ err := p.EnrichSessionState(context.Background(), session)
68+ assert.Error(t, err)
6969}
7070
7171func TestGitLabProviderUnverifiedEmailDenied(t *testing.T) {
@@ -76,8 +76,8 @@ func TestGitLabProviderUnverifiedEmailDenied(t *testing.T) {
7676 p := testGitLabProvider(bURL.Host)
7777
7878 session := &sessions.SessionState{AccessToken: "gitlab_access_token"}
79− _, err := p.GetEmailAddress(context.Background(), session)
80− assert.NotEqual(t, nil, err)
79+ err := p.EnrichSessionState(context.Background(), session)
80+ assert.Error(t, err)
8181}
8282
8383func TestGitLabProviderUnverifiedEmailAllowed(t *testing.T) {
@@ -89,9 +89,9 @@ func TestGitLabProviderUnverifiedEmailAllowed(t *testing.T) {
8989 p.AllowUnverifiedEmail = true
9090
9191 session := &sessions.SessionState{AccessToken: "gitlab_access_token"}
92− email, err := p.GetEmailAddress(context.Background(), session)
93− assert.Equal(t, nil, err)
94− assert.Equal(t, "foo@bar.com", email)
92+ err := p.EnrichSessionState(context.Background(), session)
93+ assert.NoError(t, err)
94+ assert.Equal(t, "foo@bar.com", session.Email)
9595}
9696
9797func TestGitLabProviderUsername(t *testing.T) {
@@ -103,9 +103,9 @@ func TestGitLabProviderUsername(t *testing.T) {
103103 p.AllowUnverifiedEmail = true
104104
105105 session := &sessions.SessionState{AccessToken: "gitlab_access_token"}
106− username, err := p.GetUserName(context.Background(), session)
107− assert.Equal(t, nil, err)
108− assert.Equal(t, "FooBar", username)
106+ err := p.EnrichSessionState(context.Background(), session)
107+ assert.NoError(t, err)
108+ assert.Equal(t, "FooBar", session.User)
109109}
110110
111111func TestGitLabProviderGroupMembershipValid(t *testing.T) {
@@ -118,9 +118,9 @@ func TestGitLabProviderGroupMembershipValid(t *testing.T) {
118118 p.Groups = []string{"foo"}
119119
120120 session := &sessions.SessionState{AccessToken: "gitlab_access_token"}
121− email, err := p.GetEmailAddress(context.Background(), session)
122− assert.Equal(t, nil, err)
123− assert.Equal(t, "foo@bar.com", email)
121+ err := p.EnrichSessionState(context.Background(), session)
122+ assert.NoError(t, err)
123+ assert.Equal(t, "FooBar", session.User)
124124}
125125
126126func TestGitLabProviderGroupMembershipMissing(t *testing.T) {
@@ -133,35 +133,6 @@ func TestGitLabProviderGroupMembershipMissing(t *testing.T) {
133133 p.Groups = []string{"baz"}
134134
135135 session := &sessions.SessionState{AccessToken: "gitlab_access_token"}
136− _, err := p.GetEmailAddress(context.Background(), session)
137− assert.NotEqual(t, nil, err)
138−}
139−
140−func TestGitLabProviderEmailDomainValid(t *testing.T) {
141− b := testGitLabBackend()
142− defer b.Close()
143−
144− bURL, _ := url.Parse(b.URL)
145− p := testGitLabProvider(bURL.Host)
146− p.AllowUnverifiedEmail = true
147− p.EmailDomains = []string{"bar.com"}
148−
149− session := &sessions.SessionState{AccessToken: "gitlab_access_token"}
150− email, err := p.GetEmailAddress(context.Background(), session)
151− assert.Equal(t, nil, err)
152− assert.Equal(t, "foo@bar.com", email)
153−}
154−
155−func TestGitLabProviderEmailDomainInvalid(t *testing.T) {
156− b := testGitLabBackend()
157− defer b.Close()
158−
159− bURL, _ := url.Parse(b.URL)
160− p := testGitLabProvider(bURL.Host)
161− p.AllowUnverifiedEmail = true
162− p.EmailDomains = []string{"baz.com"}
163−
164− session := &sessions.SessionState{AccessToken: "gitlab_access_token"}
165− _, err := p.GetEmailAddress(context.Background(), session)
166− assert.NotEqual(t, nil, err)
136+ err := p.EnrichSessionState(context.Background(), session)
137+ assert.Error(t, err)
167138}