@@ -0,0 +1,134 @@
1+package providers
2+
3+import (
4+ "net/http"
5+ "net/http/httptest"
6+ "net/url"
7+ "testing"
8+
9+ "github.com/pusher/oauth2_proxy/pkg/apis/sessions"
10+ "github.com/stretchr/testify/assert"
11+)
12+
13+func testDigitalOceanProvider(hostname string) *DigitalOceanProvider {
14+ p := NewDigitalOceanProvider(
15+ &ProviderData{
16+ ProviderName: "",
17+ LoginURL: &url.URL{},
18+ RedeemURL: &url.URL{},
19+ ProfileURL: &url.URL{},
20+ ValidateURL: &url.URL{},
21+ Scope: ""})
22+ if hostname != "" {
23+ updateURL(p.Data().LoginURL, hostname)
24+ updateURL(p.Data().RedeemURL, hostname)
25+ updateURL(p.Data().ProfileURL, hostname)
26+ }
27+ return p
28+}
29+
30+func testDigitalOceanBackend(payload string) *httptest.Server {
31+ path := "/v2/account"
32+
33+ return httptest.NewServer(http.HandlerFunc(
34+ func(w http.ResponseWriter, r *http.Request) {
35+ if r.URL.Path != path {
36+ w.WriteHeader(404)
37+ } else if r.Header.Get("Authorization") != "Bearer imaginary_access_token" {
38+ w.WriteHeader(403)
39+ } else {
40+ w.WriteHeader(200)
41+ w.Write([]byte(payload))
42+ }
43+ }))
44+}
45+
46+func TestDigitalOceanProviderDefaults(t *testing.T) {
47+ p := testDigitalOceanProvider("")
48+ assert.NotEqual(t, nil, p)
49+ assert.Equal(t, "DigitalOcean", p.Data().ProviderName)
50+ assert.Equal(t, "https://cloud.digitalocean.com/v1/oauth/authorize",
51+ p.Data().LoginURL.String())
52+ assert.Equal(t, "https://cloud.digitalocean.com/v1/oauth/token",
53+ p.Data().RedeemURL.String())
54+ assert.Equal(t, "https://api.digitalocean.com/v2/account",
55+ p.Data().ProfileURL.String())
56+ assert.Equal(t, "https://api.digitalocean.com/v2/account",
57+ p.Data().ValidateURL.String())
58+ assert.Equal(t, "read", p.Data().Scope)
59+}
60+
61+func TestDigitalOceanProviderOverrides(t *testing.T) {
62+ p := NewDigitalOceanProvider(
63+ &ProviderData{
64+ LoginURL: &url.URL{
65+ Scheme: "https",
66+ Host: "example.com",
67+ Path: "/oauth/auth"},
68+ RedeemURL: &url.URL{
69+ Scheme: "https",
70+ Host: "example.com",
71+ Path: "/oauth/token"},
72+ ProfileURL: &url.URL{
73+ Scheme: "https",
74+ Host: "example.com",
75+ Path: "/oauth/profile"},
76+ ValidateURL: &url.URL{
77+ Scheme: "https",
78+ Host: "example.com",
79+ Path: "/oauth/tokeninfo"},
80+ Scope: "profile"})
81+ assert.NotEqual(t, nil, p)
82+ assert.Equal(t, "DigitalOcean", p.Data().ProviderName)
83+ assert.Equal(t, "https://example.com/oauth/auth",
84+ p.Data().LoginURL.String())
85+ assert.Equal(t, "https://example.com/oauth/token",
86+ p.Data().RedeemURL.String())
87+ assert.Equal(t, "https://example.com/oauth/profile",
88+ p.Data().ProfileURL.String())
89+ assert.Equal(t, "https://example.com/oauth/tokeninfo",
90+ p.Data().ValidateURL.String())
91+ assert.Equal(t, "profile", p.Data().Scope)
92+}
93+
94+func TestDigitalOceanProviderGetEmailAddress(t *testing.T) {
95+ b := testDigitalOceanBackend(`{"account": {"email": "user@example.com"}}`)
96+ defer b.Close()
97+
98+ bURL, _ := url.Parse(b.URL)
99+ p := testDigitalOceanProvider(bURL.Host)
100+
101+ session := &sessions.SessionState{AccessToken: "imaginary_access_token"}
102+ email, err := p.GetEmailAddress(session)
103+ assert.Equal(t, nil, err)
104+ assert.Equal(t, "user@example.com", email)
105+}
106+
107+func TestDigitalOceanProviderGetEmailAddressFailedRequest(t *testing.T) {
108+ b := testDigitalOceanBackend("unused payload")
109+ defer b.Close()
110+
111+ bURL, _ := url.Parse(b.URL)
112+ p := testDigitalOceanProvider(bURL.Host)
113+
114+ // We'll trigger a request failure by using an unexpected access
115+ // token. Alternatively, we could allow the parsing of the payload as
116+ // JSON to fail.
117+ session := &sessions.SessionState{AccessToken: "unexpected_access_token"}
118+ email, err := p.GetEmailAddress(session)
119+ assert.NotEqual(t, nil, err)
120+ assert.Equal(t, "", email)
121+}
122+
123+func TestDigitalOceanProviderGetEmailAddressEmailNotPresentInPayload(t *testing.T) {
124+ b := testDigitalOceanBackend("{\"foo\": \"bar\"}")
125+ defer b.Close()
126+
127+ bURL, _ := url.Parse(b.URL)
128+ p := testDigitalOceanProvider(bURL.Host)
129+
130+ session := &sessions.SessionState{AccessToken: "imaginary_access_token"}
131+ email, err := p.GetEmailAddress(session)
132+ assert.NotEqual(t, nil, err)
133+ assert.Equal(t, "", email)
134+}