2ab8a7d · typeable/oauth2-proxy

git.iko.soy/typeable/oauth2-proxy

Move SessionState to its own package

commit2ab8a7d95d172b4afd2b46823f4180734cc7794d authorJoel Speed <Joel.speed@hotmail.co.uk> dateSun 5 May 2019, 13:33 (7 years ago) parenta1130e4

20 files changed+127−109

compare with master

unifiedsplit

oauthproxy.go+7−6

@@ -16,6 +16,7 @@ import (

1616 "github.com/mbland/hmacauth"

1717 "github.com/pusher/oauth2_proxy/cookie"

1818 "github.com/pusher/oauth2_proxy/logger"

19+ "github.com/pusher/oauth2_proxy/pkg/apis/sessions"

1920 "github.com/pusher/oauth2_proxy/providers"

2021 "github.com/yhat/wsutil"

2122)

@@ -292,7 +293,7 @@ func (p *OAuthProxy) displayCustomLoginForm() bool {

292293 return p.HtpasswdFile != nil && p.DisplayHtpasswdForm

293294}

294295

295−func (p *OAuthProxy) redeemCode(host, code string) (s *providers.SessionState, err error) {

296+func (p *OAuthProxy) redeemCode(host, code string) (s *sessions.SessionState, err error) {

296297 if code == "" {

297298 return nil, errors.New("missing code")

298299 }

@@ -484,7 +485,7 @@ func (p *OAuthProxy) SetSessionCookie(rw http.ResponseWriter, req *http.Request,

484485}

485486

486487// LoadCookiedSession reads the user's authentication details from the request

487−func (p *OAuthProxy) LoadCookiedSession(req *http.Request) (*providers.SessionState, time.Duration, error) {

488+func (p *OAuthProxy) LoadCookiedSession(req *http.Request) (*sessions.SessionState, time.Duration, error) {

488489 var age time.Duration

489490 c, err := loadCookie(req, p.CookieName)

490491 if err != nil {

@@ -506,7 +507,7 @@ func (p *OAuthProxy) LoadCookiedSession(req *http.Request) (*providers.SessionSt

506507}

507508

508509// SaveSession creates a new session cookie value and sets this on the response

509−func (p *OAuthProxy) SaveSession(rw http.ResponseWriter, req *http.Request, s *providers.SessionState) error {

510+func (p *OAuthProxy) SaveSession(rw http.ResponseWriter, req *http.Request, s *sessions.SessionState) error {

510511 value, err := p.provider.CookieForSession(s, p.CookieCipher)

511512 if err != nil {

512513 return err

@@ -693,7 +694,7 @@ func (p *OAuthProxy) SignIn(rw http.ResponseWriter, req *http.Request) {

693694

694695 user, ok := p.ManualSignIn(rw, req)

695696 if ok {

696− session := &providers.SessionState{User: user}

697+ session := &sessions.SessionState{User: user}

697698 p.SaveSession(rw, req, session)

698699 http.Redirect(rw, req, redirect, 302)

699700 } else {

@@ -944,7 +945,7 @@ func (p *OAuthProxy) Authenticate(rw http.ResponseWriter, req *http.Request) int

944945

945946// CheckBasicAuth checks the requests Authorization header for basic auth

946947// credentials and authenticates these against the proxies HtpasswdFile

947−func (p *OAuthProxy) CheckBasicAuth(req *http.Request) (*providers.SessionState, error) {

948+func (p *OAuthProxy) CheckBasicAuth(req *http.Request) (*sessions.SessionState, error) {

948949 if p.HtpasswdFile == nil {

949950 return nil, nil

950951 }

@@ -966,7 +967,7 @@ func (p *OAuthProxy) CheckBasicAuth(req *http.Request) (*providers.SessionState,

966967 }

967968 if p.HtpasswdFile.Validate(pair[0], pair[1]) {

968969 logger.PrintAuthf(pair[0], req, logger.AuthSuccess, "Authenticated via basic auth and HTpasswd File")

969− return &providers.SessionState{User: pair[0]}, nil

970+ return &sessions.SessionState{User: pair[0]}, nil

970971 }

971972 logger.PrintAuthf(pair[0], req, logger.AuthFailure, "Invalid authentication via basic auth: not in Htpasswd File")

972973 return nil, nil

oauthproxy_test.go+14−13

@@ -16,6 +16,7 @@ import (

1616

1717 "github.com/mbland/hmacauth"

1818 "github.com/pusher/oauth2_proxy/logger"

19+ "github.com/pusher/oauth2_proxy/pkg/apis/sessions"

1920 "github.com/pusher/oauth2_proxy/providers"

2021 "github.com/stretchr/testify/assert"

2122 "github.com/stretchr/testify/require"

@@ -253,11 +254,11 @@ func NewTestProvider(providerURL *url.URL, emailAddress string) *TestProvider {

253254 }

254255}

255256

256−func (tp *TestProvider) GetEmailAddress(session *providers.SessionState) (string, error) {

257+func (tp *TestProvider) GetEmailAddress(session *sessions.SessionState) (string, error) {

257258 return tp.EmailAddress, nil

258259}

259260

260−func (tp *TestProvider) ValidateSessionState(session *providers.SessionState) bool {

261+func (tp *TestProvider) ValidateSessionState(session *sessions.SessionState) bool {

261262 return tp.ValidToken

262263}

263264

@@ -637,7 +638,7 @@ func (p *ProcessCookieTest) MakeCookie(value string, ref time.Time) []*http.Cook

637638 return p.proxy.MakeSessionCookie(p.req, value, p.opts.CookieExpire, ref)

638639}

639640

640−func (p *ProcessCookieTest) SaveSession(s *providers.SessionState, ref time.Time) error {

641+func (p *ProcessCookieTest) SaveSession(s *sessions.SessionState, ref time.Time) error {

641642 value, err := p.proxy.provider.CookieForSession(s, p.proxy.CookieCipher)

642643 if err != nil {

643644 return err

@@ -648,14 +649,14 @@ func (p *ProcessCookieTest) SaveSession(s *providers.SessionState, ref time.Time

648649 return nil

649650}

650651

651−func (p *ProcessCookieTest) LoadCookiedSession() (*providers.SessionState, time.Duration, error) {

652+func (p *ProcessCookieTest) LoadCookiedSession() (*sessions.SessionState, time.Duration, error) {

652653 return p.proxy.LoadCookiedSession(p.req)

653654}

654655

655656func TestLoadCookiedSession(t *testing.T) {

656657 pcTest := NewProcessCookieTestWithDefaults()

657658

658− startSession := &providers.SessionState{Email: "john.doe@example.com", AccessToken: "my_access_token"}

659+ startSession := &sessions.SessionState{Email: "john.doe@example.com", AccessToken: "my_access_token"}

659660 pcTest.SaveSession(startSession, time.Now())

660661

661662 session, _, err := pcTest.LoadCookiedSession()

@@ -680,7 +681,7 @@ func TestProcessCookieRefreshNotSet(t *testing.T) {

680681 pcTest.proxy.CookieExpire = time.Duration(23) * time.Hour

681682 reference := time.Now().Add(time.Duration(-2) * time.Hour)

682683

683− startSession := &providers.SessionState{Email: "michael.bland@gsa.gov", AccessToken: "my_access_token"}

684+ startSession := &sessions.SessionState{Email: "michael.bland@gsa.gov", AccessToken: "my_access_token"}

684685 pcTest.SaveSession(startSession, reference)

685686

686687 session, age, err := pcTest.LoadCookiedSession()

@@ -695,7 +696,7 @@ func TestProcessCookieFailIfCookieExpired(t *testing.T) {

695696 pcTest := NewProcessCookieTestWithDefaults()

696697 pcTest.proxy.CookieExpire = time.Duration(24) * time.Hour

697698 reference := time.Now().Add(time.Duration(25) * time.Hour * -1)

698− startSession := &providers.SessionState{Email: "michael.bland@gsa.gov", AccessToken: "my_access_token"}

699+ startSession := &sessions.SessionState{Email: "michael.bland@gsa.gov", AccessToken: "my_access_token"}

699700 pcTest.SaveSession(startSession, reference)

700701

701702 session, _, err := pcTest.LoadCookiedSession()

@@ -709,7 +710,7 @@ func TestProcessCookieFailIfRefreshSetAndCookieExpired(t *testing.T) {

709710 pcTest := NewProcessCookieTestWithDefaults()

710711 pcTest.proxy.CookieExpire = time.Duration(24) * time.Hour

711712 reference := time.Now().Add(time.Duration(25) * time.Hour * -1)

712− startSession := &providers.SessionState{Email: "michael.bland@gsa.gov", AccessToken: "my_access_token"}

713+ startSession := &sessions.SessionState{Email: "michael.bland@gsa.gov", AccessToken: "my_access_token"}

713714 pcTest.SaveSession(startSession, reference)

714715

715716 pcTest.proxy.CookieRefresh = time.Hour

@@ -729,7 +730,7 @@ func NewAuthOnlyEndpointTest() *ProcessCookieTest {

729730

730731func TestAuthOnlyEndpointAccepted(t *testing.T) {

731732 test := NewAuthOnlyEndpointTest()

732− startSession := &providers.SessionState{

733+ startSession := &sessions.SessionState{

733734 Email: "michael.bland@gsa.gov", AccessToken: "my_access_token"}

734735 test.SaveSession(startSession, time.Now())

735736

@@ -752,7 +753,7 @@ func TestAuthOnlyEndpointUnauthorizedOnExpiration(t *testing.T) {

752753 test := NewAuthOnlyEndpointTest()

753754 test.proxy.CookieExpire = time.Duration(24) * time.Hour

754755 reference := time.Now().Add(time.Duration(25) * time.Hour * -1)

755− startSession := &providers.SessionState{

756+ startSession := &sessions.SessionState{

756757 Email: "michael.bland@gsa.gov", AccessToken: "my_access_token"}

757758 test.SaveSession(startSession, reference)

758759

@@ -764,7 +765,7 @@ func TestAuthOnlyEndpointUnauthorizedOnExpiration(t *testing.T) {

764765

765766func TestAuthOnlyEndpointUnauthorizedOnEmailValidationFailure(t *testing.T) {

766767 test := NewAuthOnlyEndpointTest()

767− startSession := &providers.SessionState{

768+ startSession := &sessions.SessionState{

768769 Email: "michael.bland@gsa.gov", AccessToken: "my_access_token"}

769770 test.SaveSession(startSession, time.Now())

770771 test.validateUser = false

@@ -795,7 +796,7 @@ func TestAuthOnlyEndpointSetXAuthRequestHeaders(t *testing.T) {

795796 pcTest.req, _ = http.NewRequest("GET",

796797 pcTest.opts.ProxyPrefix+"/auth", nil)

797798

798− startSession := &providers.SessionState{

799+ startSession := &sessions.SessionState{

799800 User: "oauth_user", Email: "oauth_user@example.com", AccessToken: "oauth_token"}

800801 pcTest.SaveSession(startSession, time.Now())

801802

@@ -927,7 +928,7 @@ func (st *SignatureTest) MakeRequestWithExpectedKey(method, body, key string) {

927928 req := httptest.NewRequest(method, "/foo/bar", bodyBuf)

928929 req.Header = st.header

929930

930− state := &providers.SessionState{

931+ state := &sessions.SessionState{

931932 Email: "mbland@acm.org", AccessToken: "my_access_token"}

932933 value, err := proxy.provider.CookieForSession(state, proxy.CookieCipher)

933934 if err != nil {

providers/session_state.go → pkg/apis/sessions/session_state.gorenamed+1−1

@@ -1,4 +1,4 @@

1−package providers

1+package sessions

33import (

44 "encoding/json"

providers/session_state_test.go → pkg/apis/sessions/session_state_test.gorenamed+31−30

@@ -1,4 +1,4 @@

1−package providers

1+package sessions_test

33import (

44 "fmt"

@@ -6,6 +6,7 @@ import (

66 "time"

88 "github.com/pusher/oauth2_proxy/cookie"

9+ "github.com/pusher/oauth2_proxy/pkg/apis/sessions"

910 "github.com/stretchr/testify/assert"

1011)

1112

@@ -17,7 +18,7 @@ func TestSessionStateSerialization(t *testing.T) {

1718 assert.Equal(t, nil, err)

1819 c2, err := cookie.NewCipher([]byte(altSecret))

1920 assert.Equal(t, nil, err)

20− s := &SessionState{

21+ s := &sessions.SessionState{

2122 Email: "user@domain.com",

2223 AccessToken: "token1234",

2324 IDToken: "rawtoken1234",

@@ -27,7 +28,7 @@ func TestSessionStateSerialization(t *testing.T) {

2728 encoded, err := s.EncodeSessionState(c)

2829 assert.Equal(t, nil, err)

2930

30− ss, err := DecodeSessionState(encoded, c)

31+ ss, err := sessions.DecodeSessionState(encoded, c)

3132 t.Logf("%#v", ss)

3233 assert.Equal(t, nil, err)

3334 assert.Equal(t, "user@domain.com", ss.User)

@@ -38,7 +39,7 @@ func TestSessionStateSerialization(t *testing.T) {

3839 assert.Equal(t, s.RefreshToken, ss.RefreshToken)

3940

4041 // ensure a different cipher can't decode properly (ie: it gets gibberish)

41− ss, err = DecodeSessionState(encoded, c2)

42+ ss, err = sessions.DecodeSessionState(encoded, c2)

4243 t.Logf("%#v", ss)

4344 assert.Equal(t, nil, err)

4445 assert.NotEqual(t, "user@domain.com", ss.User)

@@ -54,7 +55,7 @@ func TestSessionStateSerializationWithUser(t *testing.T) {

5455 assert.Equal(t, nil, err)

5556 c2, err := cookie.NewCipher([]byte(altSecret))

5657 assert.Equal(t, nil, err)

57− s := &SessionState{

58+ s := &sessions.SessionState{

5859 User: "just-user",

5960 Email: "user@domain.com",

6061 AccessToken: "token1234",

@@ -64,7 +65,7 @@ func TestSessionStateSerializationWithUser(t *testing.T) {

6465 encoded, err := s.EncodeSessionState(c)

6566 assert.Equal(t, nil, err)

6667

67− ss, err := DecodeSessionState(encoded, c)

68+ ss, err := sessions.DecodeSessionState(encoded, c)

6869 t.Logf("%#v", ss)

6970 assert.Equal(t, nil, err)

7071 assert.Equal(t, s.User, ss.User)

@@ -74,7 +75,7 @@ func TestSessionStateSerializationWithUser(t *testing.T) {

7475 assert.Equal(t, s.RefreshToken, ss.RefreshToken)

7576

7677 // ensure a different cipher can't decode properly (ie: it gets gibberish)

77− ss, err = DecodeSessionState(encoded, c2)

78+ ss, err = sessions.DecodeSessionState(encoded, c2)

7879 t.Logf("%#v", ss)

7980 assert.Equal(t, nil, err)

8081 assert.NotEqual(t, s.User, ss.User)

@@ -85,7 +86,7 @@ func TestSessionStateSerializationWithUser(t *testing.T) {

8586}

8687

8788func TestSessionStateSerializationNoCipher(t *testing.T) {

88− s := &SessionState{

89+ s := &sessions.SessionState{

8990 Email: "user@domain.com",

9091 AccessToken: "token1234",

9192 ExpiresOn: time.Now().Add(time.Duration(1) * time.Hour),

@@ -95,7 +96,7 @@ func TestSessionStateSerializationNoCipher(t *testing.T) {

9596 assert.Equal(t, nil, err)

9697

9798 // only email should have been serialized

98− ss, err := DecodeSessionState(encoded, nil)

99+ ss, err := sessions.DecodeSessionState(encoded, nil)

99100 assert.Equal(t, nil, err)

100101 assert.Equal(t, "user@domain.com", ss.User)

101102 assert.Equal(t, s.Email, ss.Email)

@@ -104,7 +105,7 @@ func TestSessionStateSerializationNoCipher(t *testing.T) {

104105}

105106

106107func TestSessionStateSerializationNoCipherWithUser(t *testing.T) {

107− s := &SessionState{

108+ s := &sessions.SessionState{

108109 User: "just-user",

109110 Email: "user@domain.com",

110111 AccessToken: "token1234",

@@ -115,7 +116,7 @@ func TestSessionStateSerializationNoCipherWithUser(t *testing.T) {

115116 assert.Equal(t, nil, err)

116117

117118 // only email should have been serialized

118− ss, err := DecodeSessionState(encoded, nil)

119+ ss, err := sessions.DecodeSessionState(encoded, nil)

119120 assert.Equal(t, nil, err)

120121 assert.Equal(t, s.User, ss.User)

121122 assert.Equal(t, s.Email, ss.Email)

@@ -124,18 +125,18 @@ func TestSessionStateSerializationNoCipherWithUser(t *testing.T) {

124125}

125126

126127func TestExpired(t *testing.T) {

127− s := &SessionState{ExpiresOn: time.Now().Add(time.Duration(-1) * time.Minute)}

128+ s := &sessions.SessionState{ExpiresOn: time.Now().Add(time.Duration(-1) * time.Minute)}

128129 assert.Equal(t, true, s.IsExpired())

129130

130− s = &SessionState{ExpiresOn: time.Now().Add(time.Duration(1) * time.Minute)}

131+ s = &sessions.SessionState{ExpiresOn: time.Now().Add(time.Duration(1) * time.Minute)}

131132 assert.Equal(t, false, s.IsExpired())

132133

133− s = &SessionState{}

134+ s = &sessions.SessionState{}

134135 assert.Equal(t, false, s.IsExpired())

135136}

136137

137138type testCase struct {

138− SessionState

139+ sessions.SessionState

139140 Encoded string

140141 Cipher *cookie.Cipher

141142 Error bool

@@ -150,14 +151,14 @@ func TestEncodeSessionState(t *testing.T) {

150151

151152 testCases := []testCase{

152153 {

153− SessionState: SessionState{

154+ SessionState: sessions.SessionState{

154155 Email: "user@domain.com",

155156 User: "just-user",

156157 },

157158 Encoded: `{"Email":"user@domain.com","User":"just-user"}`,

158159 },

159160 {

160− SessionState: SessionState{

161+ SessionState: sessions.SessionState{

161162 Email: "user@domain.com",

162163 User: "just-user",

163164 AccessToken: "token1234",

@@ -171,7 +172,7 @@ func TestEncodeSessionState(t *testing.T) {

171172

172173 for i, tc := range testCases {

173174 encoded, err := tc.EncodeSessionState(tc.Cipher)

174− t.Logf("i:%d Encoded:%#v SessionState:%#v Error:%#v", i, encoded, tc.SessionState, err)

175+ t.Logf("i:%d Encoded:%#vsessions.SessionState:%#v Error:%#v", i, encoded, tc.SessionState, err)

175176 if tc.Error {

176177 assert.Error(t, err)

177178 assert.Empty(t, encoded)

@@ -182,7 +183,7 @@ func TestEncodeSessionState(t *testing.T) {

182183 }

183184}

184185

185−// TestDecodeSessionState tests DecodeSessionState with the test vector

186+// TestDecodeSessionState testssessions.DecodeSessionState with the test vector

186187func TestDecodeSessionState(t *testing.T) {

187188 e := time.Now().Add(time.Duration(1) * time.Hour)

188189 eJSON, _ := e.MarshalJSON()

@@ -194,34 +195,34 @@ func TestDecodeSessionState(t *testing.T) {

194195

195196 testCases := []testCase{

196197 {

197− SessionState: SessionState{

198+ SessionState: sessions.SessionState{

198199 Email: "user@domain.com",

199200 User: "just-user",

200201 },

201202 Encoded: `{"Email":"user@domain.com","User":"just-user"}`,

202203 },

203204 {

204− SessionState: SessionState{

205+ SessionState: sessions.SessionState{

205206 Email: "user@domain.com",

206207 User: "user@domain.com",

207208 },

208209 Encoded: `{"Email":"user@domain.com"}`,

209210 },

210211 {

211− SessionState: SessionState{

212+ SessionState: sessions.SessionState{

212213 User: "just-user",

213214 },

214215 Encoded: `{"User":"just-user"}`,

215216 },

216217 {

217− SessionState: SessionState{

218+ SessionState: sessions.SessionState{

218219 Email: "user@domain.com",

219220 User: "just-user",

220221 },

221222 Encoded: fmt.Sprintf(`{"Email":"user@domain.com","User":"just-user","AccessToken":"I6s+ml+/MldBMgHIiC35BTKTh57skGX24w==","IDToken":"xojNdyyjB1HgYWh6XMtXY/Ph5eCVxa1cNsklJw==","RefreshToken":"qEX0x6RmASxo4dhlBG6YuRs9Syn/e9sHu/+K","ExpiresOn":%s}`, eString),

222223 },

223224 {

224− SessionState: SessionState{

225+ SessionState: sessions.SessionState{

225226 Email: "user@domain.com",

226227 User: "just-user",

227228 AccessToken: "token1234",

@@ -233,7 +234,7 @@ func TestDecodeSessionState(t *testing.T) {

233234 Cipher: c,

234235 },

235236 {

236− SessionState: SessionState{

237+ SessionState: sessions.SessionState{

237238 Email: "user@domain.com",

238239 User: "just-user",

239240 },

@@ -251,7 +252,7 @@ func TestDecodeSessionState(t *testing.T) {

251252 Error: true,

252253 },

253254 {

254− SessionState: SessionState{

255+ SessionState: sessions.SessionState{

255256 User: "just-user",

256257 Email: "user@domain.com",

257258 },

@@ -272,7 +273,7 @@ func TestDecodeSessionState(t *testing.T) {

272273 Error: true,

273274 },

274275 {

275− SessionState: SessionState{

276+ SessionState: sessions.SessionState{

276277 Email: "user@domain.com",

277278 User: "just-user",

278279 AccessToken: "token1234",

@@ -283,7 +284,7 @@ func TestDecodeSessionState(t *testing.T) {

283284 Cipher: c,

284285 },

285286 {

286− SessionState: SessionState{

287+ SessionState: sessions.SessionState{

287288 Email: "user@domain.com",

288289 User: "just-user",

289290 AccessToken: "token1234",

@@ -297,8 +298,8 @@ func TestDecodeSessionState(t *testing.T) {

297298 }

298299

299300 for i, tc := range testCases {

300− ss, err := DecodeSessionState(tc.Encoded, tc.Cipher)

301− t.Logf("i:%d Encoded:%#v SessionState:%#v Error:%#v", i, tc.Encoded, ss, err)

301+ ss, err := sessions.DecodeSessionState(tc.Encoded, tc.Cipher)

302+ t.Logf("i:%d Encoded:%#vsessions.SessionState:%#v Error:%#v", i, tc.Encoded, ss, err)

302303 if tc.Error {

303304 assert.Error(t, err)

304305 assert.Nil(t, ss)

providers/azure.go+2−1

@@ -9,6 +9,7 @@ import (

99 "github.com/bitly/go-simplejson"

1010 "github.com/pusher/oauth2_proxy/api"

1111 "github.com/pusher/oauth2_proxy/logger"

12+ "github.com/pusher/oauth2_proxy/pkg/apis/sessions"

1213)

1314

1415// AzureProvider represents an Azure based Identity Provider

@@ -88,7 +89,7 @@ func getEmailFromJSON(json *simplejson.Json) (string, error) {

8889}

8990

9091// GetEmailAddress returns the Account email address

91−func (p *AzureProvider) GetEmailAddress(s *SessionState) (string, error) {

92+func (p *AzureProvider) GetEmailAddress(s *sessions.SessionState) (string, error) {

9293 var email string

9394 var err error

9495

providers/azure_test.go+7−6

@@ -6,6 +6,7 @@ import (

66 "net/url"

77 "testing"

9+ "github.com/pusher/oauth2_proxy/pkg/apis/sessions"

910 "github.com/stretchr/testify/assert"

1011)

1112

@@ -128,7 +129,7 @@ func TestAzureProviderGetEmailAddress(t *testing.T) {

128129 bURL, _ := url.Parse(b.URL)

129130 p := testAzureProvider(bURL.Host)

130131

131− session := &SessionState{AccessToken: "imaginary_access_token"}

132+ session := &sessions.SessionState{AccessToken: "imaginary_access_token"}

132133 email, err := p.GetEmailAddress(session)

133134 assert.Equal(t, nil, err)

134135 assert.Equal(t, "user@windows.net", email)

@@ -141,7 +142,7 @@ func TestAzureProviderGetEmailAddressMailNull(t *testing.T) {

141142 bURL, _ := url.Parse(b.URL)

142143 p := testAzureProvider(bURL.Host)

143144

144− session := &SessionState{AccessToken: "imaginary_access_token"}

145+ session := &sessions.SessionState{AccessToken: "imaginary_access_token"}

145146 email, err := p.GetEmailAddress(session)

146147 assert.Equal(t, nil, err)

147148 assert.Equal(t, "user@windows.net", email)

@@ -154,7 +155,7 @@ func TestAzureProviderGetEmailAddressGetUserPrincipalName(t *testing.T) {

154155 bURL, _ := url.Parse(b.URL)

155156 p := testAzureProvider(bURL.Host)

156157

157− session := &SessionState{AccessToken: "imaginary_access_token"}

158+ session := &sessions.SessionState{AccessToken: "imaginary_access_token"}

158159 email, err := p.GetEmailAddress(session)

159160 assert.Equal(t, nil, err)

160161 assert.Equal(t, "user@windows.net", email)

@@ -167,7 +168,7 @@ func TestAzureProviderGetEmailAddressFailToGetEmailAddress(t *testing.T) {

167168 bURL, _ := url.Parse(b.URL)

168169 p := testAzureProvider(bURL.Host)

169170

170− session := &SessionState{AccessToken: "imaginary_access_token"}

171+ session := &sessions.SessionState{AccessToken: "imaginary_access_token"}

171172 email, err := p.GetEmailAddress(session)

172173 assert.Equal(t, "type assertion to string failed", err.Error())

173174 assert.Equal(t, "", email)

@@ -180,7 +181,7 @@ func TestAzureProviderGetEmailAddressEmptyUserPrincipalName(t *testing.T) {

180181 bURL, _ := url.Parse(b.URL)

181182 p := testAzureProvider(bURL.Host)

182183

183− session := &SessionState{AccessToken: "imaginary_access_token"}

184+ session := &sessions.SessionState{AccessToken: "imaginary_access_token"}

184185 email, err := p.GetEmailAddress(session)

185186 assert.Equal(t, nil, err)

186187 assert.Equal(t, "", email)

@@ -193,7 +194,7 @@ func TestAzureProviderGetEmailAddressIncorrectOtherMails(t *testing.T) {

193194 bURL, _ := url.Parse(b.URL)

194195 p := testAzureProvider(bURL.Host)

195196

196− session := &SessionState{AccessToken: "imaginary_access_token"}

197+ session := &sessions.SessionState{AccessToken: "imaginary_access_token"}

197198 email, err := p.GetEmailAddress(session)

198199 assert.Equal(t, "type assertion to string failed", err.Error())

199200 assert.Equal(t, "", email)

providers/facebook.go+3−2

@@ -7,6 +7,7 @@ import (

77 "net/url"

99 "github.com/pusher/oauth2_proxy/api"

10+ "github.com/pusher/oauth2_proxy/pkg/apis/sessions"

1011)

1112

1213// FacebookProvider represents an Facebook based Identity Provider

@@ -54,7 +55,7 @@ func getFacebookHeader(accessToken string) http.Header {

5455}

5556

5657// GetEmailAddress returns the Account email address

57−func (p *FacebookProvider) GetEmailAddress(s *SessionState) (string, error) {

58+func (p *FacebookProvider) GetEmailAddress(s *sessions.SessionState) (string, error) {

5859 if s.AccessToken == "" {

5960 return "", errors.New("missing access token")

6061 }

@@ -79,6 +80,6 @@ func (p *FacebookProvider) GetEmailAddress(s *SessionState) (string, error) {

7980}

8081

8182// ValidateSessionState validates the AccessToken

82−func (p *FacebookProvider) ValidateSessionState(s *SessionState) bool {

83+func (p *FacebookProvider) ValidateSessionState(s *sessions.SessionState) bool {

8384 return validateToken(p, s.AccessToken, getFacebookHeader(s.AccessToken))

8485}

providers/github.go+3−2

@@ -11,6 +11,7 @@ import (

1111 "strings"

1212

1313 "github.com/pusher/oauth2_proxy/logger"

14+ "github.com/pusher/oauth2_proxy/pkg/apis/sessions"

1415)

1516

1617// GitHubProvider represents an GitHub based Identity Provider

@@ -200,7 +201,7 @@ func (p *GitHubProvider) hasOrgAndTeam(accessToken string) (bool, error) {

200201}

201202

202203// GetEmailAddress returns the Account email address

203−func (p *GitHubProvider) GetEmailAddress(s *SessionState) (string, error) {

204+func (p *GitHubProvider) GetEmailAddress(s *sessions.SessionState) (string, error) {

204205

205206 var emails []struct {

206207 Email string `json:"email"`

@@ -259,7 +260,7 @@ func (p *GitHubProvider) GetEmailAddress(s *SessionState) (string, error) {

259260}

260261

261262// GetUserName returns the Account user name

262−func (p *GitHubProvider) GetUserName(s *SessionState) (string, error) {

263+func (p *GitHubProvider) GetUserName(s *sessions.SessionState) (string, error) {

263264 var user struct {

264265 Login string `json:"login"`

265266 Email string `json:"email"`

providers/github_test.go+7−6

@@ -6,6 +6,7 @@ import (

66 "net/url"

77 "testing"

9+ "github.com/pusher/oauth2_proxy/pkg/apis/sessions"

910 "github.com/stretchr/testify/assert"

1011)

1112

@@ -103,7 +104,7 @@ func TestGitHubProviderGetEmailAddress(t *testing.T) {

103104 bURL, _ := url.Parse(b.URL)

104105 p := testGitHubProvider(bURL.Host)

105106

106− session := &SessionState{AccessToken: "imaginary_access_token"}

107+ session := &sessions.SessionState{AccessToken: "imaginary_access_token"}

107108 email, err := p.GetEmailAddress(session)

108109 assert.Equal(t, nil, err)

109110 assert.Equal(t, "michael.bland@gsa.gov", email)

@@ -116,7 +117,7 @@ func TestGitHubProviderGetEmailAddressNotVerified(t *testing.T) {

116117 bURL, _ := url.Parse(b.URL)

117118 p := testGitHubProvider(bURL.Host)

118119

119− session := &SessionState{AccessToken: "imaginary_access_token"}

120+ session := &sessions.SessionState{AccessToken: "imaginary_access_token"}

120121 email, err := p.GetEmailAddress(session)

121122 assert.Equal(t, nil, err)

122123 assert.Empty(t, "", email)

@@ -134,7 +135,7 @@ func TestGitHubProviderGetEmailAddressWithOrg(t *testing.T) {

134135 p := testGitHubProvider(bURL.Host)

135136 p.Org = "testorg1"

136137

137− session := &SessionState{AccessToken: "imaginary_access_token"}

138+ session := &sessions.SessionState{AccessToken: "imaginary_access_token"}

138139 email, err := p.GetEmailAddress(session)

139140 assert.Equal(t, nil, err)

140141 assert.Equal(t, "michael.bland@gsa.gov", email)

@@ -152,7 +153,7 @@ func TestGitHubProviderGetEmailAddressFailedRequest(t *testing.T) {

152153 // We'll trigger a request failure by using an unexpected access

153154 // token. Alternatively, we could allow the parsing of the payload as

154155 // JSON to fail.

155− session := &SessionState{AccessToken: "unexpected_access_token"}

156+ session := &sessions.SessionState{AccessToken: "unexpected_access_token"}

156157 email, err := p.GetEmailAddress(session)

157158 assert.NotEqual(t, nil, err)

158159 assert.Equal(t, "", email)

@@ -165,7 +166,7 @@ func TestGitHubProviderGetEmailAddressEmailNotPresentInPayload(t *testing.T) {

165166 bURL, _ := url.Parse(b.URL)

166167 p := testGitHubProvider(bURL.Host)

167168

168− session := &SessionState{AccessToken: "imaginary_access_token"}

169+ session := &sessions.SessionState{AccessToken: "imaginary_access_token"}

169170 email, err := p.GetEmailAddress(session)

170171 assert.NotEqual(t, nil, err)

171172 assert.Equal(t, "", email)

@@ -178,7 +179,7 @@ func TestGitHubProviderGetUserName(t *testing.T) {

178179 bURL, _ := url.Parse(b.URL)

179180 p := testGitHubProvider(bURL.Host)

180181

181− session := &SessionState{AccessToken: "imaginary_access_token"}

182+ session := &sessions.SessionState{AccessToken: "imaginary_access_token"}

182183 email, err := p.GetUserName(session)

183184 assert.Equal(t, nil, err)

184185 assert.Equal(t, "mbland", email)

providers/gitlab.go+2−1

@@ -6,6 +6,7 @@ import (

77 "github.com/pusher/oauth2_proxy/api"

88 "github.com/pusher/oauth2_proxy/logger"

9+ "github.com/pusher/oauth2_proxy/pkg/apis/sessions"

910)

1011

1112// GitLabProvider represents an GitLab based Identity Provider

@@ -44,7 +45,7 @@ func NewGitLabProvider(p *ProviderData) *GitLabProvider {

4445}

4546

4647// GetEmailAddress returns the Account email address

47−func (p *GitLabProvider) GetEmailAddress(s *SessionState) (string, error) {

48+func (p *GitLabProvider) GetEmailAddress(s *sessions.SessionState) (string, error) {

4849

4950 req, err := http.NewRequest("GET",

5051 p.ValidateURL.String()+"?access_token="+s.AccessToken, nil)

providers/gitlab_test.go+4−3

@@ -6,6 +6,7 @@ import (

66 "net/url"

77 "testing"

9+ "github.com/pusher/oauth2_proxy/pkg/apis/sessions"

910 "github.com/stretchr/testify/assert"

1011)

1112

@@ -89,7 +90,7 @@ func TestGitLabProviderGetEmailAddress(t *testing.T) {

8990 bURL, _ := url.Parse(b.URL)

9091 p := testGitLabProvider(bURL.Host)

9192

92− session := &SessionState{AccessToken: "imaginary_access_token"}

93+ session := &sessions.SessionState{AccessToken: "imaginary_access_token"}

9394 email, err := p.GetEmailAddress(session)

9495 assert.Equal(t, nil, err)

9596 assert.Equal(t, "michael.bland@gsa.gov", email)

@@ -107,7 +108,7 @@ func TestGitLabProviderGetEmailAddressFailedRequest(t *testing.T) {

107108 // We'll trigger a request failure by using an unexpected access

108109 // token. Alternatively, we could allow the parsing of the payload as

109110 // JSON to fail.

110− session := &SessionState{AccessToken: "unexpected_access_token"}

111+ session := &sessions.SessionState{AccessToken: "unexpected_access_token"}

111112 email, err := p.GetEmailAddress(session)

112113 assert.NotEqual(t, nil, err)

113114 assert.Equal(t, "", email)

@@ -120,7 +121,7 @@ func TestGitLabProviderGetEmailAddressEmailNotPresentInPayload(t *testing.T) {

120121 bURL, _ := url.Parse(b.URL)

121122 p := testGitLabProvider(bURL.Host)

122123

123− session := &SessionState{AccessToken: "imaginary_access_token"}

124+ session := &sessions.SessionState{AccessToken: "imaginary_access_token"}

124125 email, err := p.GetEmailAddress(session)

125126 assert.NotEqual(t, nil, err)

126127 assert.Equal(t, "", email)

providers/google.go+4−3

@@ -14,6 +14,7 @@ import (

1414 "time"

1515

1616 "github.com/pusher/oauth2_proxy/logger"

17+ "github.com/pusher/oauth2_proxy/pkg/apis/sessions"

1718 "golang.org/x/oauth2"

1819 "golang.org/x/oauth2/google"

1920 admin "google.golang.org/api/admin/directory/v1"

@@ -96,7 +97,7 @@ func claimsFromIDToken(idToken string) (*claims, error) {

9697}

9798

9899// Redeem exchanges the OAuth2 authentication token for an ID token

99−func (p *GoogleProvider) Redeem(redirectURL, code string) (s *SessionState, err error) {

100+func (p *GoogleProvider) Redeem(redirectURL, code string) (s *sessions.SessionState, err error) {

100101 if code == "" {

101102 err = errors.New("missing code")

102103 return

@@ -145,7 +146,7 @@ func (p *GoogleProvider) Redeem(redirectURL, code string) (s *SessionState, err

145146 if err != nil {

146147 return

147148 }

148− s = &SessionState{

149+ s = &sessions.SessionState{

149150 AccessToken: jsonResponse.AccessToken,

150151 IDToken: jsonResponse.IDToken,

151152 ExpiresOn: time.Now().Add(time.Duration(jsonResponse.ExpiresIn) * time.Second).Truncate(time.Second),

@@ -258,7 +259,7 @@ func (p *GoogleProvider) ValidateGroup(email string) bool {

258259

259260// RefreshSessionIfNeeded checks if the session has expired and uses the

260261// RefreshToken to fetch a new ID token if required

261−func (p *GoogleProvider) RefreshSessionIfNeeded(s *SessionState) (bool, error) {

262+func (p *GoogleProvider) RefreshSessionIfNeeded(s *sessions.SessionState) (bool, error) {

262263 if s == nil || s.ExpiresOn.After(time.Now()) || s.RefreshToken == "" {

263264 return false, nil

264265 }

providers/internal_util_test.go+3−2

@@ -7,6 +7,7 @@ import (

77 "net/url"

88 "testing"

10+ "github.com/pusher/oauth2_proxy/pkg/apis/sessions"

1011 "github.com/stretchr/testify/assert"

1112)

1213

@@ -19,13 +20,13 @@ type ValidateSessionStateTestProvider struct {

1920 *ProviderData

2021}

2122

22−func (tp *ValidateSessionStateTestProvider) GetEmailAddress(s *SessionState) (string, error) {

23+func (tp *ValidateSessionStateTestProvider) GetEmailAddress(s *sessions.SessionState) (string, error) {

2324 return "", errors.New("not implemented")

2425}

2526

2627// Note that we're testing the internal validateToken() used to implement

2728// several Provider's ValidateSessionState() implementations

28−func (tp *ValidateSessionStateTestProvider) ValidateSessionState(s *SessionState) bool {

29+func (tp *ValidateSessionStateTestProvider) ValidateSessionState(s *sessions.SessionState) bool {

2930 return false

3031}

3132

providers/linkedin.go+3−2

@@ -7,6 +7,7 @@ import (

77 "net/url"

99 "github.com/pusher/oauth2_proxy/api"

10+ "github.com/pusher/oauth2_proxy/pkg/apis/sessions"

1011)

1112

1213// LinkedInProvider represents an LinkedIn based Identity Provider

@@ -50,7 +51,7 @@ func getLinkedInHeader(accessToken string) http.Header {

5051}

5152

5253// GetEmailAddress returns the Account email address

53−func (p *LinkedInProvider) GetEmailAddress(s *SessionState) (string, error) {

54+func (p *LinkedInProvider) GetEmailAddress(s *sessions.SessionState) (string, error) {

5455 if s.AccessToken == "" {

5556 return "", errors.New("missing access token")

5657 }

@@ -73,6 +74,6 @@ func (p *LinkedInProvider) GetEmailAddress(s *SessionState) (string, error) {

7374}

7475

7576// ValidateSessionState validates the AccessToken

76−func (p *LinkedInProvider) ValidateSessionState(s *SessionState) bool {

77+func (p *LinkedInProvider) ValidateSessionState(s *sessions.SessionState) bool {

7778 return validateToken(p, s.AccessToken, getLinkedInHeader(s.AccessToken))

7879}

providers/linkedin_test.go+4−3

@@ -6,6 +6,7 @@ import (

66 "net/url"

77 "testing"

9+ "github.com/pusher/oauth2_proxy/pkg/apis/sessions"

910 "github.com/stretchr/testify/assert"

1011)

1112

@@ -97,7 +98,7 @@ func TestLinkedInProviderGetEmailAddress(t *testing.T) {

9798 bURL, _ := url.Parse(b.URL)

9899 p := testLinkedInProvider(bURL.Host)

99100

100− session := &SessionState{AccessToken: "imaginary_access_token"}

101+ session := &sessions.SessionState{AccessToken: "imaginary_access_token"}

101102 email, err := p.GetEmailAddress(session)

102103 assert.Equal(t, nil, err)

103104 assert.Equal(t, "user@linkedin.com", email)

@@ -113,7 +114,7 @@ func TestLinkedInProviderGetEmailAddressFailedRequest(t *testing.T) {

113114 // We'll trigger a request failure by using an unexpected access

114115 // token. Alternatively, we could allow the parsing of the payload as

115116 // JSON to fail.

116− session := &SessionState{AccessToken: "unexpected_access_token"}

117+ session := &sessions.SessionState{AccessToken: "unexpected_access_token"}

117118 email, err := p.GetEmailAddress(session)

118119 assert.NotEqual(t, nil, err)

119120 assert.Equal(t, "", email)

@@ -126,7 +127,7 @@ func TestLinkedInProviderGetEmailAddressEmailNotPresentInPayload(t *testing.T) {

126127 bURL, _ := url.Parse(b.URL)

127128 p := testLinkedInProvider(bURL.Host)

128129

129− session := &SessionState{AccessToken: "imaginary_access_token"}

130+ session := &sessions.SessionState{AccessToken: "imaginary_access_token"}

130131 email, err := p.GetEmailAddress(session)

131132 assert.NotEqual(t, nil, err)

132133 assert.Equal(t, "", email)

providers/logingov.go+3−2

@@ -13,6 +13,7 @@ import (

1313 "time"

1414

1515 "github.com/dgrijalva/jwt-go"

16+ "github.com/pusher/oauth2_proxy/pkg/apis/sessions"

1617 "gopkg.in/square/go-jose.v2"

1718)

1819

@@ -173,7 +174,7 @@ func emailFromUserInfo(accessToken string, userInfoEndpoint string) (email strin

173174}

174175

175176// Redeem exchanges the OAuth2 authentication token for an ID token

176−func (p *LoginGovProvider) Redeem(redirectURL, code string) (s *SessionState, err error) {

177+func (p *LoginGovProvider) Redeem(redirectURL, code string) (s *sessions.SessionState, err error) {

177178 if code == "" {

178179 err = errors.New("missing code")

179180 return

@@ -248,7 +249,7 @@ func (p *LoginGovProvider) Redeem(redirectURL, code string) (s *SessionState, er

248249 }

249250

250251 // Store the data that we found in the session state

251− s = &SessionState{

252+ s = &sessions.SessionState{

252253 AccessToken: jsonResponse.AccessToken,

253254 IDToken: jsonResponse.IDToken,

254255 ExpiresOn: time.Now().Add(time.Duration(jsonResponse.ExpiresIn) * time.Second).Truncate(time.Second),

providers/oidc.go+8−8

@@ -5,9 +5,9 @@ import (

55 "fmt"

66 "time"

8− "golang.org/x/oauth2"

9−

108 oidc "github.com/coreos/go-oidc"

9+ "github.com/pusher/oauth2_proxy/pkg/apis/sessions"

10+ "golang.org/x/oauth2"

1111)

1212

1313// OIDCProvider represents an OIDC based Identity Provider

@@ -24,7 +24,7 @@ func NewOIDCProvider(p *ProviderData) *OIDCProvider {

2424}

2525

2626// Redeem exchanges the OAuth2 authentication token for an ID token

27−func (p *OIDCProvider) Redeem(redirectURL, code string) (s *SessionState, err error) {

27+func (p *OIDCProvider) Redeem(redirectURL, code string) (s *sessions.SessionState, err error) {

2828 ctx := context.Background()

2929 c := oauth2.Config{

3030 ClientID: p.ClientID,

@@ -47,7 +47,7 @@ func (p *OIDCProvider) Redeem(redirectURL, code string) (s *SessionState, err er

4747

4848// RefreshSessionIfNeeded checks if the session has expired and uses the

4949// RefreshToken to fetch a new ID token if required

50−func (p *OIDCProvider) RefreshSessionIfNeeded(s *SessionState) (bool, error) {

50+func (p *OIDCProvider) RefreshSessionIfNeeded(s *sessions.SessionState) (bool, error) {

5151 if s == nil || s.ExpiresOn.After(time.Now()) || s.RefreshToken == "" {

5252 return false, nil

5353 }

@@ -63,7 +63,7 @@ func (p *OIDCProvider) RefreshSessionIfNeeded(s *SessionState) (bool, error) {

6363 return true, nil

6464}

6565

66−func (p *OIDCProvider) redeemRefreshToken(s *SessionState) (err error) {

66+func (p *OIDCProvider) redeemRefreshToken(s *sessions.SessionState) (err error) {

6767 c := oauth2.Config{

6868 ClientID: p.ClientID,

6969 ClientSecret: p.ClientSecret,

@@ -92,7 +92,7 @@ func (p *OIDCProvider) redeemRefreshToken(s *SessionState) (err error) {

9292 return

9393}

9494

95−func (p *OIDCProvider) createSessionState(ctx context.Context, token *oauth2.Token) (*SessionState, error) {

95+func (p *OIDCProvider) createSessionState(ctx context.Context, token *oauth2.Token) (*sessions.SessionState, error) {

9696 rawIDToken, ok := token.Extra("id_token").(string)

9797 if !ok {

9898 return nil, fmt.Errorf("token response did not contain an id_token")

@@ -122,7 +122,7 @@ func (p *OIDCProvider) createSessionState(ctx context.Context, token *oauth2.Tok

122122 return nil, fmt.Errorf("email in id_token (%s) isn't verified", claims.Email)

123123 }

124124

125− return &SessionState{

125+ return &sessions.SessionState{

126126 AccessToken: token.AccessToken,

127127 IDToken: rawIDToken,

128128 RefreshToken: token.RefreshToken,

@@ -133,7 +133,7 @@ func (p *OIDCProvider) createSessionState(ctx context.Context, token *oauth2.Tok

133133}

134134

135135// ValidateSessionState checks that the session's IDToken is still valid

136−func (p *OIDCProvider) ValidateSessionState(s *SessionState) bool {

136+func (p *OIDCProvider) ValidateSessionState(s *sessions.SessionState) bool {

137137 ctx := context.Background()

138138 _, err := p.Verifier.Verify(ctx, s.IDToken)

139139 if err != nil {

providers/provider_default.go+11−10

@@ -10,10 +10,11 @@ import (

1010 "net/url"

1111

1212 "github.com/pusher/oauth2_proxy/cookie"

13+ "github.com/pusher/oauth2_proxy/pkg/apis/sessions"

1314)

1415

1516// Redeem provides a default implementation of the OAuth2 token redemption process

16−func (p *ProviderData) Redeem(redirectURL, code string) (s *SessionState, err error) {

17+func (p *ProviderData) Redeem(redirectURL, code string) (s *sessions.SessionState, err error) {

1718 if code == "" {

1819 err = errors.New("missing code")

1920 return

@@ -59,7 +60,7 @@ func (p *ProviderData) Redeem(redirectURL, code string) (s *SessionState, err er

5960 }

6061 err = json.Unmarshal(body, &jsonResponse)

6162 if err == nil {

62− s = &SessionState{

63+ s = &sessions.SessionState{

6364 AccessToken: jsonResponse.AccessToken,

6465 }

6566 return

@@ -71,7 +72,7 @@ func (p *ProviderData) Redeem(redirectURL, code string) (s *SessionState, err er

7172 return

7273 }

7374 if a := v.Get("access_token"); a != "" {

74− s = &SessionState{AccessToken: a}

75+ s = &sessions.SessionState{AccessToken: a}

7576 } else {

7677 err = fmt.Errorf("no access token found %s", body)

7778 }

@@ -94,22 +95,22 @@ func (p *ProviderData) GetLoginURL(redirectURI, state string) string {

9495}

9596

9697// CookieForSession serializes a session state for storage in a cookie

97−func (p *ProviderData) CookieForSession(s *SessionState, c *cookie.Cipher) (string, error) {

98+func (p *ProviderData) CookieForSession(s *sessions.SessionState, c *cookie.Cipher) (string, error) {

9899 return s.EncodeSessionState(c)

99100}

100101

101102// SessionFromCookie deserializes a session from a cookie value

102−func (p *ProviderData) SessionFromCookie(v string, c *cookie.Cipher) (s *SessionState, err error) {

103− return DecodeSessionState(v, c)

103+func (p *ProviderData) SessionFromCookie(v string, c *cookie.Cipher) (s *sessions.SessionState, err error) {

104+ return sessions.DecodeSessionState(v, c)

104105}

105106

106107// GetEmailAddress returns the Account email address

107−func (p *ProviderData) GetEmailAddress(s *SessionState) (string, error) {

108+func (p *ProviderData) GetEmailAddress(s *sessions.SessionState) (string, error) {

108109 return "", errors.New("not implemented")

109110}

110111

111112// GetUserName returns the Account username

112−func (p *ProviderData) GetUserName(s *SessionState) (string, error) {

113+func (p *ProviderData) GetUserName(s *sessions.SessionState) (string, error) {

113114 return "", errors.New("not implemented")

114115}

115116

@@ -120,12 +121,12 @@ func (p *ProviderData) ValidateGroup(email string) bool {

120121}

121122

122123// ValidateSessionState validates the AccessToken

123−func (p *ProviderData) ValidateSessionState(s *SessionState) bool {

124+func (p *ProviderData) ValidateSessionState(s *sessions.SessionState) bool {

124125 return validateToken(p, s.AccessToken, nil)

125126}

126127

127128// RefreshSessionIfNeeded should refresh the user's session if required and

128129// do nothing if a refresh is not required

129−func (p *ProviderData) RefreshSessionIfNeeded(s *SessionState) (bool, error) {

130+func (p *ProviderData) RefreshSessionIfNeeded(s *sessions.SessionState) (bool, error) {

130131 return false, nil

131132}

providers/provider_default_test.go+2−1

@@ -4,12 +4,13 @@ import (

44 "testing"

55 "time"

7+ "github.com/pusher/oauth2_proxy/pkg/apis/sessions"

78 "github.com/stretchr/testify/assert"

89)

910

1011func TestRefresh(t *testing.T) {

1112 p := &ProviderData{}

12− refreshed, err := p.RefreshSessionIfNeeded(&SessionState{

13+ refreshed, err := p.RefreshSessionIfNeeded(&sessions.SessionState{

1314 ExpiresOn: time.Now().Add(time.Duration(-11) * time.Minute),

1415 })

1516 assert.Equal(t, false, refreshed)

providers/providers.go+8−7

@@ -2,20 +2,21 @@ package providers

33import (

44 "github.com/pusher/oauth2_proxy/cookie"

5+ "github.com/pusher/oauth2_proxy/pkg/apis/sessions"

56)

78// Provider represents an upstream identity provider implementation

89type Provider interface {

910 Data() *ProviderData

10− GetEmailAddress(*SessionState) (string, error)

11− GetUserName(*SessionState) (string, error)

12− Redeem(string, string) (*SessionState, error)

11+ GetEmailAddress(*sessions.SessionState) (string, error)

12+ GetUserName(*sessions.SessionState) (string, error)

13+ Redeem(string, string) (*sessions.SessionState, error)

1314 ValidateGroup(string) bool

14− ValidateSessionState(*SessionState) bool

15+ ValidateSessionState(*sessions.SessionState) bool

1516 GetLoginURL(redirectURI, finalRedirect string) string

16− RefreshSessionIfNeeded(*SessionState) (bool, error)

17− SessionFromCookie(string, *cookie.Cipher) (*SessionState, error)

18− CookieForSession(*SessionState, *cookie.Cipher) (string, error)

17+ RefreshSessionIfNeeded(*sessions.SessionState) (bool, error)

18+ SessionFromCookie(string, *cookie.Cipher) (*sessions.SessionState, error)

19+ CookieForSession(*sessions.SessionState, *cookie.Cipher) (string, error)

1920}

2021

2122// New provides a new Provider based on the configured provider string