@@ -1197,18 +1197,20 @@ func TestUserInfoEndpointUnauthorizedOnNoCookieSetError(t *testing.T) {
11971197 assert.Equal(t, http.StatusUnauthorized, test.rw.Code)
11981198}
11991199
1200−func NewAuthOnlyEndpointTest(modifiers ...OptionsModifier) (*ProcessCookieTest, error) {
1200+func NewAuthOnlyEndpointTest(querystring string, modifiers ...OptionsModifier) (*ProcessCookieTest, error) {
12011201 pcTest, err := NewProcessCookieTestWithOptionsModifiers(modifiers...)
12021202 if err != nil {
12031203 return nil, err
12041204 }
1205− pcTest.req, _ = http.NewRequest("GET",
1206− pcTest.opts.ProxyPrefix+"/auth", nil)
1205+ pcTest.req, _ = http.NewRequest(
1206+ "GET",
1207+ fmt.Sprintf("%s/auth%s", pcTest.opts.ProxyPrefix, querystring),
1208+ nil)
12071209 return pcTest, nil
12081210}
12091211
12101212func TestAuthOnlyEndpointAccepted(t *testing.T) {
1211− test, err := NewAuthOnlyEndpointTest()
1213+ test, err := NewAuthOnlyEndpointTest("")
12121214 if err != nil {
12131215 t.Fatal(err)
12141216 }
@@ -1226,7 +1228,7 @@ func TestAuthOnlyEndpointAccepted(t *testing.T) {
12261228}
12271229
12281230func TestAuthOnlyEndpointUnauthorizedOnNoCookieSetError(t *testing.T) {
1229− test, err := NewAuthOnlyEndpointTest()
1231+ test, err := NewAuthOnlyEndpointTest("")
12301232 if err != nil {
12311233 t.Fatal(err)
12321234 }
@@ -1234,11 +1236,11 @@ func TestAuthOnlyEndpointUnauthorizedOnNoCookieSetError(t *testing.T) {
12341236 test.proxy.ServeHTTP(test.rw, test.req)
12351237 assert.Equal(t, http.StatusUnauthorized, test.rw.Code)
12361238 bodyBytes, _ := ioutil.ReadAll(test.rw.Body)
1237− assert.Equal(t, "unauthorized request\n", string(bodyBytes))
1239+ assert.Equal(t, "Unauthorized\n", string(bodyBytes))
12381240}
12391241
12401242func TestAuthOnlyEndpointUnauthorizedOnExpiration(t *testing.T) {
1241− test, err := NewAuthOnlyEndpointTest(func(opts *options.Options) {
1243+ test, err := NewAuthOnlyEndpointTest("", func(opts *options.Options) {
12421244 opts.Cookie.Expire = time.Duration(24) * time.Hour
12431245 })
12441246 if err != nil {
@@ -1254,11 +1256,11 @@ func TestAuthOnlyEndpointUnauthorizedOnExpiration(t *testing.T) {
12541256 test.proxy.ServeHTTP(test.rw, test.req)
12551257 assert.Equal(t, http.StatusUnauthorized, test.rw.Code)
12561258 bodyBytes, _ := ioutil.ReadAll(test.rw.Body)
1257− assert.Equal(t, "unauthorized request\n", string(bodyBytes))
1259+ assert.Equal(t, "Unauthorized\n", string(bodyBytes))
12581260}
12591261
12601262func TestAuthOnlyEndpointUnauthorizedOnEmailValidationFailure(t *testing.T) {
1261− test, err := NewAuthOnlyEndpointTest()
1263+ test, err := NewAuthOnlyEndpointTest("")
12621264 if err != nil {
12631265 t.Fatal(err)
12641266 }
@@ -1273,7 +1275,7 @@ func TestAuthOnlyEndpointUnauthorizedOnEmailValidationFailure(t *testing.T) {
12731275 test.proxy.ServeHTTP(test.rw, test.req)
12741276 assert.Equal(t, http.StatusUnauthorized, test.rw.Code)
12751277 bodyBytes, _ := ioutil.ReadAll(test.rw.Body)
1276− assert.Equal(t, "unauthorized request\n", string(bodyBytes))
1278+ assert.Equal(t, "Unauthorized\n", string(bodyBytes))
12771279}
12781280
12791281func TestAuthOnlyEndpointSetXAuthRequestHeaders(t *testing.T) {
@@ -1960,7 +1962,7 @@ func TestGetJwtSession(t *testing.T) {
19601962 verifier := oidc.NewVerifier("https://issuer.example.com", keyset,
19611963 &oidc.Config{ClientID: "https://test.myapp.com", SkipExpiryCheck: true})
19621964
1963− test, err := NewAuthOnlyEndpointTest(func(opts *options.Options) {
1965+ test, err := NewAuthOnlyEndpointTest("", func(opts *options.Options) {
19641966 opts.InjectRequestHeaders = []options.Header{
19651967 {
19661968 Name: "Authorization",
@@ -2028,7 +2030,6 @@ func TestGetJwtSession(t *testing.T) {
20282030 },
20292031 },
20302032 }
2031−
20322033 opts.SkipJwtBearerTokens = true
20332034 opts.SetJWTBearerVerifiers(append(opts.GetJWTBearerVerifiers(), verifier))
20342035 })
@@ -2692,32 +2693,106 @@ func TestProxyAllowedGroups(t *testing.T) {
26922693}
26932694
26942695func TestAuthOnlyAllowedGroups(t *testing.T) {
2695− tests := []struct {
2696+ testCases := []struct {
26962697 name string
26972698 allowedGroups []string
26982699 groups []string
2699− expectUnauthorized bool
2700+ querystring string
2701+ expectedStatusCode int
27002702 }{
2701− {"NoAllowedGroups", []string{}, []string{}, false},
2702− {"NoAllowedGroupsUserHasGroups", []string{}, []string{"a", "b"}, false},
2703− {"UserInAllowedGroup", []string{"a"}, []string{"a", "b"}, false},
2704− {"UserNotInAllowedGroup", []string{"a"}, []string{"c"}, true},
2703+ {
2704+ name: "NoAllowedGroups",
2705+ allowedGroups: []string{},
2706+ groups: []string{},
2707+ querystring: "",
2708+ expectedStatusCode: http.StatusAccepted,
2709+ },
2710+ {
2711+ name: "NoAllowedGroupsUserHasGroups",
2712+ allowedGroups: []string{},
2713+ groups: []string{"a", "b"},
2714+ querystring: "",
2715+ expectedStatusCode: http.StatusAccepted,
2716+ },
2717+ {
2718+ name: "UserInAllowedGroup",
2719+ allowedGroups: []string{"a"},
2720+ groups: []string{"a", "b"},
2721+ querystring: "",
2722+ expectedStatusCode: http.StatusAccepted,
2723+ },
2724+ {
2725+ name: "UserNotInAllowedGroup",
2726+ allowedGroups: []string{"a"},
2727+ groups: []string{"c"},
2728+ querystring: "",
2729+ expectedStatusCode: http.StatusUnauthorized,
2730+ },
2731+ {
2732+ name: "UserInQuerystringGroup",
2733+ allowedGroups: []string{"a", "b"},
2734+ groups: []string{"a", "c"},
2735+ querystring: "?allowed_groups=a",
2736+ expectedStatusCode: http.StatusAccepted,
2737+ },
2738+ {
2739+ name: "UserInMultiParamQuerystringGroup",
2740+ allowedGroups: []string{"a", "b"},
2741+ groups: []string{"b"},
2742+ querystring: "?allowed_groups=a&allowed_groups=b,d",
2743+ expectedStatusCode: http.StatusAccepted,
2744+ },
2745+ {
2746+ name: "UserInOnlyQuerystringGroup",
2747+ allowedGroups: []string{},
2748+ groups: []string{"a", "c"},
2749+ querystring: "?allowed_groups=a,b",
2750+ expectedStatusCode: http.StatusAccepted,
2751+ },
2752+ {
2753+ name: "UserInDelimitedQuerystringGroup",
2754+ allowedGroups: []string{"a", "b", "c"},
2755+ groups: []string{"c"},
2756+ querystring: "?allowed_groups=a,c",
2757+ expectedStatusCode: http.StatusAccepted,
2758+ },
2759+ {
2760+ name: "UserNotInQuerystringGroup",
2761+ allowedGroups: []string{},
2762+ groups: []string{"c"},
2763+ querystring: "?allowed_groups=a,b",
2764+ expectedStatusCode: http.StatusForbidden,
2765+ },
2766+ {
2767+ name: "UserInConfigGroupNotInQuerystringGroup",
2768+ allowedGroups: []string{"a", "b", "c"},
2769+ groups: []string{"c"},
2770+ querystring: "?allowed_groups=a,b",
2771+ expectedStatusCode: http.StatusForbidden,
2772+ },
2773+ {
2774+ name: "UserInQuerystringGroupNotInConfigGroup",
2775+ allowedGroups: []string{"a", "b"},
2776+ groups: []string{"c"},
2777+ querystring: "?allowed_groups=b,c",
2778+ expectedStatusCode: http.StatusUnauthorized,
2779+ },
27052780 }
27062781
2707− for _, tt := range tests {
2708− t.Run(tt.name, func(t *testing.T) {
2782+ for _, tc := range testCases {
2783+ t.Run(tc.name, func(t *testing.T) {
27092784 emailAddress := "test"
27102785 created := time.Now()
27112786
27122787 session := &sessions.SessionState{
2713− Groups: tt.groups,
2788+ Groups: tc.groups,
27142789 Email: emailAddress,
27152790 AccessToken: "oauth_token",
27162791 CreatedAt: &created,
27172792 }
27182793
2719− test, err := NewAuthOnlyEndpointTest(func(opts *options.Options) {
2720− opts.AllowedGroups = tt.allowedGroups
2794+ test, err := NewAuthOnlyEndpointTest(tc.querystring, func(opts *options.Options) {
2795+ opts.AllowedGroups = tc.allowedGroups
27212796 })
27222797 if err != nil {
27232798 t.Fatal(err)
@@ -2728,11 +2803,7 @@ func TestAuthOnlyAllowedGroups(t *testing.T) {
27282803
27292804 test.proxy.ServeHTTP(test.rw, test.req)
27302805
2731− if tt.expectUnauthorized {
2732− assert.Equal(t, http.StatusUnauthorized, test.rw.Code)
2733− } else {
2734− assert.Equal(t, http.StatusAccepted, test.rw.Code)
2735− }
2806+ assert.Equal(t, tc.expectedStatusCode, test.rw.Code)
27362807 })
27372808 }
27382809}