6311fa2 · typeable/oauth2-proxy

CHANGELOG.md+2−1

compare with master

unifiedsplit

@@ -14,6 +14,7 @@

14

15## Changes since v3.2.0

16

17+- [#187](https://github.com/pusher/oauth2_proxy/pull/187) Move root packages to pkg folder (@JoelSpeed)

17- [#65](https://github.com/pusher/oauth2_proxy/pull/65) Improvements to authenticate requests with a JWT bearer token in the `Authorization` header via

18- [#65](https://github.com/pusher/oauth2_proxy/pull/65) Improvements to authenticate requests with a JWT bearer token in the `Authorization` header via

18 the `-skip-jwt-bearer-token` options.

19 the `-skip-jwt-bearer-token` options.

19 - Additional verifiers can be configured via the `-extra-jwt-issuers` flag if the JWT issuers is either an OpenID provider or has a JWKS URL

20 - Additional verifiers can be configured via the `-extra-jwt-issuers` flag if the JWT issuers is either an OpenID provider or has a JWKS URL

@@ -29,7 +30,7 @@

29 - `-redis-sentinel-master-name` Sets the Sentinel master name, if sentinel is enabled

30 - `-redis-sentinel-master-name` Sets the Sentinel master name, if sentinel is enabled

30 - `-redis-sentinel-connection-urls` Defines the Redis Sentinel Connection URLs, if sentinel is enabled

31 - `-redis-sentinel-connection-urls` Defines the Redis Sentinel Connection URLs, if sentinel is enabled

31 - Introduces the concept of a session ticket. Tickets are composed of the cookie name, a session ID, and a secret.

32 - Introduces the concept of a session ticket. Tickets are composed of the cookie name, a session ID, and a secret.

32− - Redis Sessions are stored encrypted with a per-session secret

33+ - Redis Sessions are stored encrypted with a per-session secret

33 - Added tests for server based session stores

34 - Added tests for server based session stores

34- [#168](https://github.com/pusher/outh2_proxy/pull/168) Drop Go 1.11 support in Travis (@JoelSpeed)

35- [#168](https://github.com/pusher/outh2_proxy/pull/168) Drop Go 1.11 support in Travis (@JoelSpeed)

35- [#169](https://github.com/pusher/outh2_proxy/pull/169) Update Alpine to 3.9 (@kskewes)

36- [#169](https://github.com/pusher/outh2_proxy/pull/169) Update Alpine to 3.9 (@kskewes)

htpasswd.go+1−1

@@ -7,7 +7,7 @@ import (

7 "io"

8 "os"

9

10− "github.com/pusher/oauth2_proxy/logger"

10+ "github.com/pusher/oauth2_proxy/pkg/logger"

11 "golang.org/x/crypto/bcrypt"

12)

13

http.go+1−1

@@ -7,7 +7,7 @@ import (

7 "strings"

8 "time"

9

10− "github.com/pusher/oauth2_proxy/logger"

10+ "github.com/pusher/oauth2_proxy/pkg/logger"

11)

12

13// Server represents an HTTP server

logging_handler.go+1−1

@@ -10,7 +10,7 @@ import (

10 "net/http"

11 "time"

12

13− "github.com/pusher/oauth2_proxy/logger"

13+ "github.com/pusher/oauth2_proxy/pkg/logger"

14)

15

16// responseLogger is wrapper of http.ResponseWriter that keeps track of its HTTP status

logging_handler_test.go+1−1

@@ -9,7 +9,7 @@ import (

9 "testing"

10 "time"

11

12− "github.com/pusher/oauth2_proxy/logger"

12+ "github.com/pusher/oauth2_proxy/pkg/logger"

13)

14

15func TestLoggingHandler_ServeHTTP(t *testing.T) {

main.go+1−1

@@ -12,7 +12,7 @@ import (

12

13 "github.com/BurntSushi/toml"

14 options "github.com/mreiferson/go-options"

15− "github.com/pusher/oauth2_proxy/logger"

15+ "github.com/pusher/oauth2_proxy/pkg/logger"

16)

17

18func main() {

oauthproxy.go+3−3

@@ -16,9 +16,9 @@ import (

16

17 "github.com/coreos/go-oidc"

18 "github.com/mbland/hmacauth"

19− "github.com/pusher/oauth2_proxy/cookie"

20− "github.com/pusher/oauth2_proxy/logger"

21 sessionsapi "github.com/pusher/oauth2_proxy/pkg/apis/sessions"

19 sessionsapi "github.com/pusher/oauth2_proxy/pkg/apis/sessions"

20+ "github.com/pusher/oauth2_proxy/pkg/encryption"

21+ "github.com/pusher/oauth2_proxy/pkg/logger"

22 "github.com/pusher/oauth2_proxy/providers"

23 "github.com/yhat/wsutil"

24)

@@ -584,7 +584,7 @@ func (p *OAuthProxy) SignOut(rw http.ResponseWriter, req *http.Request) {

584

585// OAuthStart starts the OAuth2 authentication flow

586func (p *OAuthProxy) OAuthStart(rw http.ResponseWriter, req *http.Request) {

587− nonce, err := cookie.Nonce()

587+ nonce, err := encryption.Nonce()

588 if err != nil {

589 logger.Printf("Error obtaining nonce: %s", err.Error())

590 p.ErrorPage(rw, 500, "Internal Error", err.Error())

oauthproxy_test.go+1−1

@@ -18,8 +18,8 @@ import (

18

19 "github.com/coreos/go-oidc"

20 "github.com/mbland/hmacauth"

21− "github.com/pusher/oauth2_proxy/logger"

22 "github.com/pusher/oauth2_proxy/pkg/apis/sessions"

21 "github.com/pusher/oauth2_proxy/pkg/apis/sessions"

22+ "github.com/pusher/oauth2_proxy/pkg/logger"

23 "github.com/pusher/oauth2_proxy/pkg/sessions/cookie"

24 "github.com/pusher/oauth2_proxy/providers"

25 "github.com/stretchr/testify/assert"

options.go+4−4

@@ -17,10 +17,10 @@ import (

17 oidc "github.com/coreos/go-oidc"

18 "github.com/dgrijalva/jwt-go"

19 "github.com/mbland/hmacauth"

20− "github.com/pusher/oauth2_proxy/cookie"

21− "github.com/pusher/oauth2_proxy/logger"

22 "github.com/pusher/oauth2_proxy/pkg/apis/options"

20 "github.com/pusher/oauth2_proxy/pkg/apis/options"

23 sessionsapi "github.com/pusher/oauth2_proxy/pkg/apis/sessions"

21 sessionsapi "github.com/pusher/oauth2_proxy/pkg/apis/sessions"

22+ "github.com/pusher/oauth2_proxy/pkg/encryption"

23+ "github.com/pusher/oauth2_proxy/pkg/logger"

24 "github.com/pusher/oauth2_proxy/pkg/sessions"

25 "github.com/pusher/oauth2_proxy/providers"

26 "gopkg.in/natefinch/lumberjack.v2"

@@ -299,7 +299,7 @@ func (o *Options) Validate() error {

299 }

300 msgs = parseProviderInfo(o, msgs)

301

302− var cipher *cookie.Cipher

302+ var cipher *encryption.Cipher

303 if o.PassAccessToken || o.SetAuthorization || o.PassAuthorization || (o.CookieRefresh != time.Duration(0)) {

304 validCookieSecretSize := false

305 for _, i := range []int{16, 24, 32} {

@@ -324,7 +324,7 @@ func (o *Options) Validate() error {

324 len(secretBytes(o.CookieSecret)), suffix))

325 } else {

326 var err error

327− cipher, err = cookie.NewCipher(secretBytes(o.CookieSecret))

327+ cipher, err = encryption.NewCipher(secretBytes(o.CookieSecret))

328 if err != nil {

329 msgs = append(msgs, fmt.Sprintf("cookie-secret error: %v", err))

330 }

pkg/apis/options/sessions.go+2−4

@@ -1,13 +1,11 @@

1package options

2

3−import (

4− "github.com/pusher/oauth2_proxy/cookie"

3+import "github.com/pusher/oauth2_proxy/pkg/encryption"

5−)

6

4

7// SessionOptions contains configuration options for the SessionStore providers.

5// SessionOptions contains configuration options for the SessionStore providers.

8type SessionOptions struct {

6type SessionOptions struct {

9 Type string `flag:"session-store-type" cfg:"session_store_type" env:"OAUTH2_PROXY_SESSION_STORE_TYPE"`

7 Type string `flag:"session-store-type" cfg:"session_store_type" env:"OAUTH2_PROXY_SESSION_STORE_TYPE"`

10− Cipher *cookie.Cipher

8+ Cipher *encryption.Cipher

11 CookieStoreOptions

9 CookieStoreOptions

12 RedisStoreOptions

10 RedisStoreOptions

13}

11}

pkg/apis/sessions/session_state.go+4−4

@@ -7,7 +7,7 @@ import (

7 "strings"

8 "time"

9

10− "github.com/pusher/oauth2_proxy/cookie"

10+ "github.com/pusher/oauth2_proxy/pkg/encryption"

11)

12

13// SessionState is used to store information about the currently authenticated user session

@@ -66,7 +66,7 @@ func (s *SessionState) String() string {

66}

67

68// EncodeSessionState returns string representation of the current session

69−func (s *SessionState) EncodeSessionState(c *cookie.Cipher) (string, error) {

69+func (s *SessionState) EncodeSessionState(c *encryption.Cipher) (string, error) {

70 var ss SessionState

71 if c == nil {

72 // Store only Email and User when cipher is unavailable

@@ -133,7 +133,7 @@ func legacyDecodeSessionStatePlain(v string) (*SessionState, error) {

133

134// legacyDecodeSessionState attempts to decode the session state string

135// generated by v3.1.0 or older

136−func legacyDecodeSessionState(v string, c *cookie.Cipher) (*SessionState, error) {

136+func legacyDecodeSessionState(v string, c *encryption.Cipher) (*SessionState, error) {

137 chunks := strings.Split(v, "|")

138

139 if c == nil {

@@ -176,7 +176,7 @@ func legacyDecodeSessionState(v string, c *cookie.Cipher) (*SessionState, error)

176}

177

178// DecodeSessionState decodes the session cookie string into a SessionState

179−func DecodeSessionState(v string, c *cookie.Cipher) (*SessionState, error) {

179+func DecodeSessionState(v string, c *encryption.Cipher) (*SessionState, error) {

180 var ssj SessionStateJSON

181 var ss *SessionState

182 err := json.Unmarshal([]byte(v), &ssj)

pkg/apis/sessions/session_state_test.go+7−7

@@ -5,8 +5,8 @@ import (

5 "testing"

6 "time"

7

8− "github.com/pusher/oauth2_proxy/cookie"

9 "github.com/pusher/oauth2_proxy/pkg/apis/sessions"

8 "github.com/pusher/oauth2_proxy/pkg/apis/sessions"

9+ "github.com/pusher/oauth2_proxy/pkg/encryption"

10 "github.com/stretchr/testify/assert"

11)

12

@@ -14,9 +14,9 @@ const secret = "0123456789abcdefghijklmnopqrstuv"

14const altSecret = "0000000000abcdefghijklmnopqrstuv"

15

16func TestSessionStateSerialization(t *testing.T) {

17− c, err := cookie.NewCipher([]byte(secret))

17+ c, err := encryption.NewCipher([]byte(secret))

18 assert.Equal(t, nil, err)

19− c2, err := cookie.NewCipher([]byte(altSecret))

19+ c2, err := encryption.NewCipher([]byte(altSecret))

20 assert.Equal(t, nil, err)

21 s := &sessions.SessionState{

22 Email: "user@domain.com",

@@ -54,9 +54,9 @@ func TestSessionStateSerialization(t *testing.T) {

54}

55

56func TestSessionStateSerializationWithUser(t *testing.T) {

57− c, err := cookie.NewCipher([]byte(secret))

57+ c, err := encryption.NewCipher([]byte(secret))

58 assert.Equal(t, nil, err)

59− c2, err := cookie.NewCipher([]byte(altSecret))

59+ c2, err := encryption.NewCipher([]byte(altSecret))

60 assert.Equal(t, nil, err)

61 s := &sessions.SessionState{

62 User: "just-user",

@@ -146,7 +146,7 @@ func TestExpired(t *testing.T) {

146type testCase struct {

147 sessions.SessionState

148 Encoded string

149− Cipher *cookie.Cipher

149+ Cipher *encryption.Cipher

150 Error bool

151}

152

@@ -203,7 +203,7 @@ func TestDecodeSessionState(t *testing.T) {

203 eString := string(eJSON)

204 eUnix := e.Unix()

205

206− c, err := cookie.NewCipher([]byte(secret))

206+ c, err := encryption.NewCipher([]byte(secret))

207 assert.NoError(t, err)

208

209 testCases := []testCase{

pkg/cookies/cookies.go+1−1

@@ -6,8 +6,8 @@ import (

6 "strings"

7 "time"

8

9− "github.com/pusher/oauth2_proxy/logger"

10 "github.com/pusher/oauth2_proxy/pkg/apis/options"

9 "github.com/pusher/oauth2_proxy/pkg/apis/options"

10+ "github.com/pusher/oauth2_proxy/pkg/logger"

11)

12

13// MakeCookie constructs a cookie from the given parameters,

cookie/cookies.go → pkg/encryption/cipher.gorenamed+1−1

@@ -1,4 +1,4 @@

1−package cookie

1+package encryption

2

3import (

4 "crypto/aes"

cookie/cookies_test.go → pkg/encryption/cipher_test.gorenamed+1−1

@@ -1,4 +1,4 @@

1−package cookie

1+package encryption

2

3import (

4 "encoding/base64"

cookie/nonce.go → pkg/encryption/nonce.gorenamed+1−1

@@ -1,4 +1,4 @@

1−package cookie

1+package encryption

2

3import (

4 "crypto/rand"

logger/logger.go → pkg/logger/logger.gorenamed

The content is the same.

api/api.go → pkg/requests/requests.gorenamed+2−2

@@ -1,4 +1,4 @@

1−package api

1+package requests

2

3import (

4 "encoding/json"

@@ -7,7 +7,7 @@ import (

7 "net/http"

8

9 "github.com/bitly/go-simplejson"

10− "github.com/pusher/oauth2_proxy/logger"

10+ "github.com/pusher/oauth2_proxy/pkg/logger"

11)

12

13// Request parses the request body into a simplejson.Json object

api/api_test.go → pkg/requests/requests_test.gorenamed+1−1

@@ -1,4 +1,4 @@

1−package api

1+package requests

2

3import (

4 "io/ioutil"

pkg/sessions/cookie/session_store.go+4−4

@@ -8,10 +8,10 @@ import (

8 "strings"

9 "time"

10

11− "github.com/pusher/oauth2_proxy/cookie"

12 "github.com/pusher/oauth2_proxy/pkg/apis/options"

11 "github.com/pusher/oauth2_proxy/pkg/apis/options"

13 "github.com/pusher/oauth2_proxy/pkg/apis/sessions"

12 "github.com/pusher/oauth2_proxy/pkg/apis/sessions"

14 "github.com/pusher/oauth2_proxy/pkg/cookies"

13 "github.com/pusher/oauth2_proxy/pkg/cookies"

14+ "github.com/pusher/oauth2_proxy/pkg/encryption"

15 "github.com/pusher/oauth2_proxy/pkg/sessions/utils"

16)

17

@@ -28,7 +28,7 @@ var _ sessions.SessionStore = &SessionStore{}

28// interface that stores sessions in client side cookies

29type SessionStore struct {

30 CookieOptions *options.CookieOptions

31− CookieCipher *cookie.Cipher

31+ CookieCipher *encryption.Cipher

32}

33

34// Save takes a sessions.SessionState and stores the information from it

@@ -53,7 +53,7 @@ func (s *SessionStore) Load(req *http.Request) (*sessions.SessionState, error) {

53 // always http.ErrNoCookie

54 return nil, fmt.Errorf("Cookie %q not present", s.CookieOptions.CookieName)

55 }

56− val, _, ok := cookie.Validate(c, s.CookieOptions.CookieSecret, s.CookieOptions.CookieExpire)

56+ val, _, ok := encryption.Validate(c, s.CookieOptions.CookieSecret, s.CookieOptions.CookieExpire)

57 if !ok {

58 return nil, errors.New("Cookie Signature not valid")

59 }

@@ -96,7 +96,7 @@ func (s *SessionStore) setSessionCookie(rw http.ResponseWriter, req *http.Reques

96// authentication details

97func (s *SessionStore) makeSessionCookie(req *http.Request, value string, now time.Time) []*http.Cookie {

98 if value != "" {

99− value = cookie.SignedValue(s.CookieOptions.CookieSecret, s.CookieOptions.CookieName, value, now)

99+ value = encryption.SignedValue(s.CookieOptions.CookieSecret, s.CookieOptions.CookieName, value, now)

100 }

101 c := s.makeCookie(req, s.CookieOptions.CookieName, value, s.CookieOptions.CookieExpire, now)

102 if len(c.Value) > 4096-len(s.CookieOptions.CookieName) {

pkg/sessions/redis/redis_store.go+6−6

@@ -13,10 +13,10 @@ import (

13 "time"

14

15 "github.com/go-redis/redis"

16− "github.com/pusher/oauth2_proxy/cookie"

17 "github.com/pusher/oauth2_proxy/pkg/apis/options"

16 "github.com/pusher/oauth2_proxy/pkg/apis/options"

18 "github.com/pusher/oauth2_proxy/pkg/apis/sessions"

17 "github.com/pusher/oauth2_proxy/pkg/apis/sessions"

19 "github.com/pusher/oauth2_proxy/pkg/cookies"

18 "github.com/pusher/oauth2_proxy/pkg/cookies"

19+ "github.com/pusher/oauth2_proxy/pkg/encryption"

20)

21

22// TicketData is a structure representing the ticket used in server session storage

@@ -28,7 +28,7 @@ type TicketData struct {

28// SessionStore is an implementation of the sessions.SessionStore

29// interface that stores sessions in redis

30type SessionStore struct {

31− CookieCipher *cookie.Cipher

31+ CookieCipher *encryption.Cipher

32 CookieOptions *options.CookieOptions

33 Client *redis.Client

34}

@@ -106,7 +106,7 @@ func (store *SessionStore) Load(req *http.Request) (*sessions.SessionState, erro

106 return nil, fmt.Errorf("error loading session: %s", err)

107 }

108

109− val, _, ok := cookie.Validate(requestCookie, store.CookieOptions.CookieSecret, store.CookieOptions.CookieExpire)

109+ val, _, ok := encryption.Validate(requestCookie, store.CookieOptions.CookieSecret, store.CookieOptions.CookieExpire)

110 if !ok {

111 return nil, fmt.Errorf("Cookie Signature not valid")

112 }

@@ -166,7 +166,7 @@ func (store *SessionStore) Clear(rw http.ResponseWriter, req *http.Request) erro

166 return fmt.Errorf("error retrieving cookie: %v", err)

167 }

168

169− val, _, ok := cookie.Validate(requestCookie, store.CookieOptions.CookieSecret, store.CookieOptions.CookieExpire)

169+ val, _, ok := encryption.Validate(requestCookie, store.CookieOptions.CookieSecret, store.CookieOptions.CookieExpire)

170 if !ok {

171 return fmt.Errorf("Cookie Signature not valid")

172 }

@@ -186,7 +186,7 @@ func (store *SessionStore) Clear(rw http.ResponseWriter, req *http.Request) erro

186// makeCookie makes a cookie, signing the value if present

187func (store *SessionStore) makeCookie(req *http.Request, value string, expires time.Duration, now time.Time) *http.Cookie {

188 if value != "" {

189− value = cookie.SignedValue(store.CookieOptions.CookieSecret, store.CookieOptions.CookieName, value, now)

189+ value = encryption.SignedValue(store.CookieOptions.CookieSecret, store.CookieOptions.CookieName, value, now)

190 }

191 return cookies.MakeCookieFromOptions(

192 req,

@@ -230,7 +230,7 @@ func (store *SessionStore) getTicket(requestCookie *http.Cookie) (*TicketData, e

230 }

231

232 // An existing cookie exists, try to retrieve the ticket

233− val, _, ok := cookie.Validate(requestCookie, store.CookieOptions.CookieSecret, store.CookieOptions.CookieExpire)

233+ val, _, ok := encryption.Validate(requestCookie, store.CookieOptions.CookieSecret, store.CookieOptions.CookieExpire)

234 if !ok {

235 // Cookie is invalid, create a new ticket

236 return newTicket()

pkg/sessions/session_store_test.go+3−3

@@ -13,10 +13,10 @@ import (

13 "github.com/alicebob/miniredis"

14 . "github.com/onsi/ginkgo"

15 . "github.com/onsi/gomega"

16− "github.com/pusher/oauth2_proxy/cookie"

17 "github.com/pusher/oauth2_proxy/pkg/apis/options"

16 "github.com/pusher/oauth2_proxy/pkg/apis/options"

18 sessionsapi "github.com/pusher/oauth2_proxy/pkg/apis/sessions"

17 sessionsapi "github.com/pusher/oauth2_proxy/pkg/apis/sessions"

19 "github.com/pusher/oauth2_proxy/pkg/cookies"

18 "github.com/pusher/oauth2_proxy/pkg/cookies"

19+ "github.com/pusher/oauth2_proxy/pkg/encryption"

20 "github.com/pusher/oauth2_proxy/pkg/sessions"

21 sessionscookie "github.com/pusher/oauth2_proxy/pkg/sessions/cookie"

22 "github.com/pusher/oauth2_proxy/pkg/sessions/redis"

@@ -158,7 +158,7 @@ var _ = Describe("NewSessionStore", func() {

158 BeforeEach(func() {

159 By("Using a valid cookie with a different providers session encoding")

160 broken := "BrokenSessionFromADifferentSessionImplementation"

161− value := cookie.SignedValue(cookieOpts.CookieSecret, cookieOpts.CookieName, broken, time.Now())

161+ value := encryption.SignedValue(cookieOpts.CookieSecret, cookieOpts.CookieName, broken, time.Now())

162 cookie := cookies.MakeCookieFromOptions(request, cookieOpts.CookieName, value, cookieOpts, cookieOpts.CookieExpire, time.Now())

163 request.AddCookie(cookie)

164

@@ -354,7 +354,7 @@ var _ = Describe("NewSessionStore", func() {

354 _, err := rand.Read(secret)

355 Expect(err).ToNot(HaveOccurred())

356 cookieOpts.CookieSecret = base64.URLEncoding.EncodeToString(secret)

357− cipher, err := cookie.NewCipher(utils.SecretBytes(cookieOpts.CookieSecret))

357+ cipher, err := encryption.NewCipher(utils.SecretBytes(cookieOpts.CookieSecret))

358 Expect(err).ToNot(HaveOccurred())

359 Expect(cipher).ToNot(BeNil())

360 opts.Cipher = cipher

pkg/sessions/utils/utils.go+3−3

@@ -3,17 +3,17 @@ package utils

3import (

4 "encoding/base64"

5

6− "github.com/pusher/oauth2_proxy/cookie"

7 "github.com/pusher/oauth2_proxy/pkg/apis/sessions"

6 "github.com/pusher/oauth2_proxy/pkg/apis/sessions"

7+ "github.com/pusher/oauth2_proxy/pkg/encryption"

8)

9

10// CookieForSession serializes a session state for storage in a cookie

11−func CookieForSession(s *sessions.SessionState, c *cookie.Cipher) (string, error) {

11+func CookieForSession(s *sessions.SessionState, c *encryption.Cipher) (string, error) {

12 return s.EncodeSessionState(c)

13}

14

15// SessionFromCookie deserializes a session from a cookie value

16−func SessionFromCookie(v string, c *cookie.Cipher) (s *sessions.SessionState, err error) {

16+func SessionFromCookie(v string, c *encryption.Cipher) (s *sessions.SessionState, err error) {

17 return sessions.DecodeSessionState(v, c)

18}

19

providers/azure.go+3−3

@@ -7,9 +7,9 @@ import (

7 "net/url"

8

9 "github.com/bitly/go-simplejson"

10− "github.com/pusher/oauth2_proxy/api"

11− "github.com/pusher/oauth2_proxy/logger"

12 "github.com/pusher/oauth2_proxy/pkg/apis/sessions"

10 "github.com/pusher/oauth2_proxy/pkg/apis/sessions"

11+ "github.com/pusher/oauth2_proxy/pkg/logger"

12+ "github.com/pusher/oauth2_proxy/pkg/requests"

13)

14

15// AzureProvider represents an Azure based Identity Provider

@@ -102,7 +102,7 @@ func (p *AzureProvider) GetEmailAddress(s *sessions.SessionState) (string, error

102 }

103 req.Header = getAzureHeader(s.AccessToken)

104

105− json, err := api.Request(req)

105+ json, err := requests.Request(req)

106

107 if err != nil {

108 return "", err

providers/facebook.go+2−2

@@ -6,8 +6,8 @@ import (

6 "net/http"

7 "net/url"

8

9− "github.com/pusher/oauth2_proxy/api"

10 "github.com/pusher/oauth2_proxy/pkg/apis/sessions"

9 "github.com/pusher/oauth2_proxy/pkg/apis/sessions"

10+ "github.com/pusher/oauth2_proxy/pkg/requests"

11)

12

13// FacebookProvider represents an Facebook based Identity Provider

@@ -69,7 +69,7 @@ func (p *FacebookProvider) GetEmailAddress(s *sessions.SessionState) (string, er

69 Email string

70 }

71 var r result

72− err = api.RequestJSON(req, &r)

72+ err = requests.RequestJSON(req, &r)

73 if err != nil {

74 return "", err

75 }

providers/github.go+1−1

@@ -10,8 +10,8 @@ import (

10 "strconv"

11 "strings"

12

13− "github.com/pusher/oauth2_proxy/logger"

14 "github.com/pusher/oauth2_proxy/pkg/apis/sessions"

13 "github.com/pusher/oauth2_proxy/pkg/apis/sessions"

14+ "github.com/pusher/oauth2_proxy/pkg/logger"

15)

16

17// GitHubProvider represents an GitHub based Identity Provider

providers/gitlab.go+3−3

@@ -4,9 +4,9 @@ import (

4 "net/http"

5 "net/url"

6

7− "github.com/pusher/oauth2_proxy/api"

8− "github.com/pusher/oauth2_proxy/logger"

9 "github.com/pusher/oauth2_proxy/pkg/apis/sessions"

7 "github.com/pusher/oauth2_proxy/pkg/apis/sessions"

8+ "github.com/pusher/oauth2_proxy/pkg/logger"

9+ "github.com/pusher/oauth2_proxy/pkg/requests"

10)

11

12// GitLabProvider represents an GitLab based Identity Provider

@@ -53,7 +53,7 @@ func (p *GitLabProvider) GetEmailAddress(s *sessions.SessionState) (string, erro

53 logger.Printf("failed building request %s", err)

54 return "", err

55 }

56− json, err := api.Request(req)

56+ json, err := requests.Request(req)

57 if err != nil {

58 logger.Printf("failed making request %s", err)

59 return "", err

providers/google.go+1−1

@@ -13,8 +13,8 @@ import (

13 "strings"

14 "time"

15

16− "github.com/pusher/oauth2_proxy/logger"

17 "github.com/pusher/oauth2_proxy/pkg/apis/sessions"

16 "github.com/pusher/oauth2_proxy/pkg/apis/sessions"

17+ "github.com/pusher/oauth2_proxy/pkg/logger"

18 "golang.org/x/oauth2"

19 "golang.org/x/oauth2/google"

20 admin "google.golang.org/api/admin/directory/v1"

providers/internal_util.go+3−3

@@ -5,8 +5,8 @@ import (

5 "net/http"

6 "net/url"

7

8− "github.com/pusher/oauth2_proxy/api"

8+ "github.com/pusher/oauth2_proxy/pkg/logger"

9− "github.com/pusher/oauth2_proxy/logger"

9+ "github.com/pusher/oauth2_proxy/pkg/requests"

10)

11

12// stripToken is a helper function to obfuscate "access_token"

@@ -55,7 +55,7 @@ func validateToken(p Provider, accessToken string, header http.Header) bool {

55 params := url.Values{"access_token": {accessToken}}

56 endpoint = endpoint + "?" + params.Encode()

57 }

58− resp, err := api.RequestUnparsedResponse(endpoint, header)

58+ resp, err := requests.RequestUnparsedResponse(endpoint, header)

59 if err != nil {

60 logger.Printf("GET %s", stripToken(endpoint))

61 logger.Printf("token validation request failed: %s", err)

providers/linkedin.go+2−2

@@ -6,8 +6,8 @@ import (

6 "net/http"

7 "net/url"

8

9− "github.com/pusher/oauth2_proxy/api"

10 "github.com/pusher/oauth2_proxy/pkg/apis/sessions"

9 "github.com/pusher/oauth2_proxy/pkg/apis/sessions"

10+ "github.com/pusher/oauth2_proxy/pkg/requests"

11)

12

13// LinkedInProvider represents an LinkedIn based Identity Provider

@@ -61,7 +61,7 @@ func (p *LinkedInProvider) GetEmailAddress(s *sessions.SessionState) (string, er

61 }

62 req.Header = getLinkedInHeader(s.AccessToken)

63

64− json, err := api.Request(req)

64+ json, err := requests.Request(req)

65 if err != nil {

66 return "", err

67 }

providers/provider_default.go+3−3

@@ -10,8 +10,8 @@ import (

10 "net/url"

11 "time"

12

13− "github.com/pusher/oauth2_proxy/cookie"

14 "github.com/pusher/oauth2_proxy/pkg/apis/sessions"

13 "github.com/pusher/oauth2_proxy/pkg/apis/sessions"

14+ "github.com/pusher/oauth2_proxy/pkg/encryption"

15)

16

17// Redeem provides a default implementation of the OAuth2 token redemption process

@@ -96,12 +96,12 @@ func (p *ProviderData) GetLoginURL(redirectURI, state string) string {

96}

97

98// CookieForSession serializes a session state for storage in a cookie

99−func (p *ProviderData) CookieForSession(s *sessions.SessionState, c *cookie.Cipher) (string, error) {

99+func (p *ProviderData) CookieForSession(s *sessions.SessionState, c *encryption.Cipher) (string, error) {

100 return s.EncodeSessionState(c)

101}

102

103// SessionFromCookie deserializes a session from a cookie value

104−func (p *ProviderData) SessionFromCookie(v string, c *cookie.Cipher) (s *sessions.SessionState, err error) {

104+func (p *ProviderData) SessionFromCookie(v string, c *encryption.Cipher) (s *sessions.SessionState, err error) {

105 return sessions.DecodeSessionState(v, c)

106}

107

providers/providers.go+3−3

@@ -1,8 +1,8 @@

1package providers

2

3import (

4− "github.com/pusher/oauth2_proxy/cookie"

5 "github.com/pusher/oauth2_proxy/pkg/apis/sessions"

4 "github.com/pusher/oauth2_proxy/pkg/apis/sessions"

5+ "github.com/pusher/oauth2_proxy/pkg/encryption"

6)

7

8// Provider represents an upstream identity provider implementation

@@ -15,8 +15,8 @@ type Provider interface {

15 ValidateSessionState(*sessions.SessionState) bool

16 GetLoginURL(redirectURI, finalRedirect string) string

17 RefreshSessionIfNeeded(*sessions.SessionState) (bool, error)

18− SessionFromCookie(string, *cookie.Cipher) (*sessions.SessionState, error)

18+ SessionFromCookie(string, *encryption.Cipher) (*sessions.SessionState, error)

19− CookieForSession(*sessions.SessionState, *cookie.Cipher) (string, error)

19+ CookieForSession(*sessions.SessionState, *encryption.Cipher) (string, error)

20}

21

22// New provides a new Provider based on the configured provider string

templates.go+1−1

@@ -4,7 +4,7 @@ import (

4 "html/template"

5 "path"

6

7− "github.com/pusher/oauth2_proxy/logger"

7+ "github.com/pusher/oauth2_proxy/pkg/logger"

8)

9

10func loadTemplates(dir string) *template.Template {

validator.go+1−1

@@ -8,7 +8,7 @@ import (

8 "sync/atomic"

9 "unsafe"

10

11− "github.com/pusher/oauth2_proxy/logger"

11+ "github.com/pusher/oauth2_proxy/pkg/logger"

12)

13

14// UserMap holds information from the authenticated emails file

watcher.go+1−1

@@ -7,7 +7,7 @@ import (

7 "path/filepath"

8 "time"

9

10− "github.com/pusher/oauth2_proxy/logger"

10+ "github.com/pusher/oauth2_proxy/pkg/logger"

11 fsnotify "gopkg.in/fsnotify/fsnotify.v1"

12)

13

watcher_unsupported.go+1−1

@@ -2,7 +2,7 @@

2

3package main

4

5−import "github.com/pusher/oauth2_proxy/logger"

5+import "github.com/pusher/oauth2_proxy/pkg/logger"

6

7func WatchForUpdates(filename string, done <-chan bool, action func()) {

8 logger.Printf("file watching not implemented on this platform")