aa37564 · typeable/oauth2-proxy

.golangci.ymlnew file+13

compare with master

unifiedsplit

@@ -0,0 +1,13 @@

1+run:

2+ deadline: 120s

3+linters:

4+ enable:

5+ - govet

6+ - golint

7+ - ineffassign

8+ - goconst

9+ - deadcode

10+ - gofmt

11+ - goimports

12+ enable-all: false

13+ disable-all: true

.travis.yml+1−2

@@ -6,8 +6,7 @@ install:

6 - wget -O dep https://github.com/golang/dep/releases/download/v0.5.0/dep-linux-amd64

7 - chmod +x dep

8 - mv dep $GOPATH/bin/dep

9− - go get github.com/alecthomas/gometalinter

9+ - curl -sfL https://install.goreleaser.com/github.com/golangci/golangci-lint.sh | sh -s -- -b $GOPATH/bin v1.17.1

10− - gometalinter --install

11script:

10script:

12 - ./configure && make test

11 - ./configure && make test

13sudo: false

12sudo: false

CHANGELOG.md+1

@@ -63,6 +63,7 @@

63- [#141](https://github.com/pusher/oauth2_proxy/pull/141) Check google group membership based on email address (@bchess)

64 - Google Group membership is additionally checked via email address, allowing users outside a GSuite domain to be authorized.

65- [#195](https://github.com/pusher/outh2_proxy/pull/195) Add `-banner` flag for overriding the banner line that is displayed (@steakunderscore)

66+- [#198](https://github.com/pusher/outh2_proxy/pull/198) Switch from gometalinter to golangci-lint (@steakunderscore)

66

67

67# v3.2.0

68# v3.2.0

68

69

Dockerfile+1

@@ -3,6 +3,7 @@ FROM golang:1.12-stretch AS builder

3# Download tools

4RUN wget -O $GOPATH/bin/dep https://github.com/golang/dep/releases/download/v0.5.0/dep-linux-amd64

5RUN chmod +x $GOPATH/bin/dep

6+RUN curl -sfL https://install.goreleaser.com/github.com/golangci/golangci-lint.sh | sh -s -- -b $(go env GOPATH)/bin v1.17.1

6

7

7# Copy sources

8# Copy sources

8WORKDIR $GOPATH/src/github.com/pusher/oauth2_proxy

9WORKDIR $GOPATH/src/github.com/pusher/oauth2_proxy

Dockerfile.arm64+1

@@ -3,6 +3,7 @@ FROM golang:1.12-stretch AS builder

3# Download tools

4RUN wget -O $GOPATH/bin/dep https://github.com/golang/dep/releases/download/v0.5.0/dep-linux-amd64

5RUN chmod +x $GOPATH/bin/dep

6+RUN curl -sfL https://install.goreleaser.com/github.com/golangci/golangci-lint.sh | sh -s -- -b $(go env GOPATH)/bin v1.17.1

6

7

7# Copy sources

8# Copy sources

8WORKDIR $GOPATH/src/github.com/pusher/oauth2_proxy

9WORKDIR $GOPATH/src/github.com/pusher/oauth2_proxy

Dockerfile.armv6+1

@@ -3,6 +3,7 @@ FROM golang:1.12-stretch AS builder

3# Download tools

4RUN wget -O $GOPATH/bin/dep https://github.com/golang/dep/releases/download/v0.5.0/dep-linux-amd64

5RUN chmod +x $GOPATH/bin/dep

6+RUN curl -sfL https://install.goreleaser.com/github.com/golangci/golangci-lint.sh | sh -s -- -b $(go env GOPATH)/bin v1.17.1

6

7

7# Copy sources

8# Copy sources

8WORKDIR $GOPATH/src/github.com/pusher/oauth2_proxy

9WORKDIR $GOPATH/src/github.com/pusher/oauth2_proxy

Makefile+1−11

@@ -17,17 +17,7 @@ distclean: clean

17

18.PHONY: lint

19lint:

20− $(GOMETALINTER) --vendor --disable-all \

20+ $(GOLANGCILINT) run

21− --enable=vet \

22− --enable=vetshadow \

23− --enable=golint \

24− --enable=ineffassign \

25− --enable=goconst \

26− --enable=deadcode \

27− --enable=gofmt \

28− --enable=goimports \

29− --deadline=120s \

30− --tests ./...

31

21

32.PHONY: dep

22.PHONY: dep

33dep:

23dep:

configure+2−2

@@ -126,7 +126,7 @@ check_for go

126check_go_version

127check_go_env

128check_for dep

129−check_for gometalinter

129+check_for golangci-lint

130

131echo

132

@@ -135,7 +135,7 @@ cat <<- EOF > .env

135 GO := "${tools[go]}"

136 GO_VERSION := ${tools[go_version]}

137 DEP := "${tools[dep]}"

138− GOMETALINTER := "${tools[gometalinter]}"

138+ GOLANGCILINT := "${tools[golangci-lint]}"

139EOF

140

141echo "Environment configuration written to .env"

http_test.go+15−12

@@ -8,6 +8,9 @@ import (

8 "github.com/stretchr/testify/assert"

9)

10

11+const localhost = "127.0.0.1"

12+const host = "test-server"

13+

11func TestGCPHealthcheckLiveness(t *testing.T) {

14func TestGCPHealthcheckLiveness(t *testing.T) {

12 handler := func(w http.ResponseWriter, req *http.Request) {

15 handler := func(w http.ResponseWriter, req *http.Request) {

13 w.Write([]byte("test"))

16 w.Write([]byte("test"))

@@ -16,8 +19,8 @@ func TestGCPHealthcheckLiveness(t *testing.T) {

16 h := gcpHealthcheck(http.HandlerFunc(handler))

19 h := gcpHealthcheck(http.HandlerFunc(handler))

17 rw := httptest.NewRecorder()

20 rw := httptest.NewRecorder()

18 r, _ := http.NewRequest("GET", "/liveness_check", nil)

21 r, _ := http.NewRequest("GET", "/liveness_check", nil)

19− r.RemoteAddr = "127.0.0.1"

22+ r.RemoteAddr = localhost

20− r.Host = "test-server"

23+ r.Host = host

21 h.ServeHTTP(rw, r)

24 h.ServeHTTP(rw, r)

22

25

23 assert.Equal(t, 200, rw.Code)

26 assert.Equal(t, 200, rw.Code)

@@ -32,8 +35,8 @@ func TestGCPHealthcheckReadiness(t *testing.T) {

32 h := gcpHealthcheck(http.HandlerFunc(handler))

35 h := gcpHealthcheck(http.HandlerFunc(handler))

33 rw := httptest.NewRecorder()

36 rw := httptest.NewRecorder()

34 r, _ := http.NewRequest("GET", "/readiness_check", nil)

37 r, _ := http.NewRequest("GET", "/readiness_check", nil)

35− r.RemoteAddr = "127.0.0.1"

38+ r.RemoteAddr = localhost

36− r.Host = "test-server"

39+ r.Host = host

37 h.ServeHTTP(rw, r)

40 h.ServeHTTP(rw, r)

38

41

39 assert.Equal(t, 200, rw.Code)

42 assert.Equal(t, 200, rw.Code)

@@ -48,8 +51,8 @@ func TestGCPHealthcheckNotHealthcheck(t *testing.T) {

48 h := gcpHealthcheck(http.HandlerFunc(handler))

51 h := gcpHealthcheck(http.HandlerFunc(handler))

49 rw := httptest.NewRecorder()

52 rw := httptest.NewRecorder()

50 r, _ := http.NewRequest("GET", "/not_any_check", nil)

53 r, _ := http.NewRequest("GET", "/not_any_check", nil)

51− r.RemoteAddr = "127.0.0.1"

54+ r.RemoteAddr = localhost

52− r.Host = "test-server"

55+ r.Host = host

53 h.ServeHTTP(rw, r)

56 h.ServeHTTP(rw, r)

54

57

55 assert.Equal(t, "test", rw.Body.String())

58 assert.Equal(t, "test", rw.Body.String())

@@ -63,8 +66,8 @@ func TestGCPHealthcheckIngress(t *testing.T) {

63 h := gcpHealthcheck(http.HandlerFunc(handler))

66 h := gcpHealthcheck(http.HandlerFunc(handler))

64 rw := httptest.NewRecorder()

67 rw := httptest.NewRecorder()

65 r, _ := http.NewRequest("GET", "/", nil)

68 r, _ := http.NewRequest("GET", "/", nil)

66− r.RemoteAddr = "127.0.0.1"

69+ r.RemoteAddr = localhost

67− r.Host = "test-server"

70+ r.Host = host

68 r.Header.Set(userAgentHeader, googleHealthCheckUserAgent)

71 r.Header.Set(userAgentHeader, googleHealthCheckUserAgent)

69 h.ServeHTTP(rw, r)

72 h.ServeHTTP(rw, r)

70

73

@@ -80,8 +83,8 @@ func TestGCPHealthcheckNotIngress(t *testing.T) {

80 h := gcpHealthcheck(http.HandlerFunc(handler))

83 h := gcpHealthcheck(http.HandlerFunc(handler))

81 rw := httptest.NewRecorder()

84 rw := httptest.NewRecorder()

82 r, _ := http.NewRequest("GET", "/foo", nil)

85 r, _ := http.NewRequest("GET", "/foo", nil)

83− r.RemoteAddr = "127.0.0.1"

86+ r.RemoteAddr = localhost

84− r.Host = "test-server"

87+ r.Host = host

85 r.Header.Set(userAgentHeader, googleHealthCheckUserAgent)

88 r.Header.Set(userAgentHeader, googleHealthCheckUserAgent)

86 h.ServeHTTP(rw, r)

89 h.ServeHTTP(rw, r)

87

90

@@ -96,8 +99,8 @@ func TestGCPHealthcheckNotIngressPut(t *testing.T) {

96 h := gcpHealthcheck(http.HandlerFunc(handler))

99 h := gcpHealthcheck(http.HandlerFunc(handler))

97 rw := httptest.NewRecorder()

100 rw := httptest.NewRecorder()

98 r, _ := http.NewRequest("PUT", "/", nil)

101 r, _ := http.NewRequest("PUT", "/", nil)

99− r.RemoteAddr = "127.0.0.1"

102+ r.RemoteAddr = localhost

100− r.Host = "test-server"

103+ r.Host = host

101 r.Header.Set(userAgentHeader, googleHealthCheckUserAgent)

104 r.Header.Set(userAgentHeader, googleHealthCheckUserAgent)

102 h.ServeHTTP(rw, r)

105 h.ServeHTTP(rw, r)

103

106

oauthproxy.go+14−3

@@ -161,7 +161,7 @@ func NewFileServer(path string, filesystemPath string) (proxy http.Handler) {

161}

162

163// NewWebSocketOrRestReverseProxy creates a reverse proxy for REST or websocket based on url

164−func NewWebSocketOrRestReverseProxy(u *url.URL, opts *Options, auth hmacauth.HmacAuth) (restProxy http.Handler) {

164+func NewWebSocketOrRestReverseProxy(u *url.URL, opts *Options, auth hmacauth.HmacAuth) http.Handler {

165 u.Path = ""

166 proxy := NewReverseProxy(u, opts.FlushInterval)

167 if !opts.PassHostHeader {

@@ -177,7 +177,12 @@ func NewWebSocketOrRestReverseProxy(u *url.URL, opts *Options, auth hmacauth.Hma

177 wsURL := &url.URL{Scheme: wsScheme, Host: u.Host}

178 wsProxy = wsutil.NewSingleHostReverseProxy(wsURL)

179 }

180− return &UpstreamProxy{u.Host, proxy, wsProxy, auth}

180+ return &UpstreamProxy{

181+ upstream: u.Host,

182+ handler: proxy,

183+ wsHandler: wsProxy,

184+ auth: auth,

185+ }

181}

186}

182

187

183// NewOAuthProxy creates a new instance of OOuthProxy from the options provided

188// NewOAuthProxy creates a new instance of OOuthProxy from the options provided

@@ -202,7 +207,13 @@ func NewOAuthProxy(opts *Options, validator func(string) bool) *OAuthProxy {

202 }

207 }

203 logger.Printf("mapping path %q => file system %q", path, u.Path)

208 logger.Printf("mapping path %q => file system %q", path, u.Path)

204 proxy := NewFileServer(path, u.Path)

209 proxy := NewFileServer(path, u.Path)

210+ uProxy := UpstreamProxy{

211+ upstream: path,

212+ handler: proxy,

213+ wsHandler: nil,

214+ auth: nil,

215+ }

205− serveMux.Handle(path, &UpstreamProxy{path, proxy, nil, nil})

216+ serveMux.Handle(path, &uProxy)

206 default:

217 default:

207 panic(fmt.Sprintf("unknown upstream protocol %s", u.Scheme))

218 panic(fmt.Sprintf("unknown upstream protocol %s", u.Scheme))

208 }

219 }

oauthproxy_test.go+25−25

@@ -163,9 +163,9 @@ func TestEncodedSlashes(t *testing.T) {

163

164func TestRobotsTxt(t *testing.T) {

165 opts := NewOptions()

166− opts.ClientID = "bazquux"

166+ opts.ClientID = "asdlkjx"

167− opts.ClientSecret = "foobar"

167+ opts.ClientSecret = "alkgks"

168− opts.CookieSecret = "xyzzyplugh"

168+ opts.CookieSecret = "asdkugkj"

169 opts.Validate()

170

171 proxy := NewOAuthProxy(opts, func(string) bool { return true })

@@ -178,9 +178,9 @@ func TestRobotsTxt(t *testing.T) {

178

179func TestIsValidRedirect(t *testing.T) {

180 opts := NewOptions()

181− opts.ClientID = "bazquux"

181+ opts.ClientID = "skdlfj"

182− opts.ClientSecret = "foobar"

182+ opts.ClientSecret = "fgkdsgj"

183− opts.CookieSecret = "xyzzyplugh"

183+ opts.CookieSecret = "ljgiogbj"

184 // Should match domains that are exactly foo.bar and any subdomain of bar.foo

185 opts.WhitelistDomains = []string{"foo.bar", ".bar.foo"}

186 opts.Validate()

@@ -298,8 +298,8 @@ func TestBasicAuthPassword(t *testing.T) {

298 // The CookieSecret must be 32 bytes in order to create the AES

299 // cipher.

300 opts.CookieSecret = "xyzzyplughxyzzyplughxyzzyplughxp"

301− opts.ClientID = "bazquux"

301+ opts.ClientID = "dlgkj"

302− opts.ClientSecret = "foobar"

302+ opts.ClientSecret = "alkgret"

303 opts.CookieSecure = false

304 opts.PassBasicAuth = true

305 opts.PassUserHeaders = true

@@ -392,8 +392,8 @@ func NewPassAccessTokenTest(opts PassAccessTokenTestOptions) *PassAccessTokenTes

392 // The CookieSecret must be 32 bytes in order to create the AES

393 // cipher.

394 t.opts.CookieSecret = "xyzzyplughxyzzyplughxyzzyplughxp"

395− t.opts.ClientID = "bazquux"

395+ t.opts.ClientID = "slgkj"

396− t.opts.ClientSecret = "foobar"

396+ t.opts.ClientSecret = "gfjgojl"

397 t.opts.CookieSecure = false

398 t.opts.PassAccessToken = opts.PassAccessToken

399 t.opts.Validate()

@@ -518,9 +518,9 @@ func NewSignInPageTest(skipProvider bool) *SignInPageTest {

518 var sipTest SignInPageTest

519

520 sipTest.opts = NewOptions()

521− sipTest.opts.CookieSecret = "foobar"

521+ sipTest.opts.CookieSecret = "adklsj2"

522− sipTest.opts.ClientID = "bazquux"

522+ sipTest.opts.ClientID = "lkdgj"

523− sipTest.opts.ClientSecret = "xyzzyplugh"

523+ sipTest.opts.ClientSecret = "sgiufgoi"

524 sipTest.opts.SkipProviderButton = skipProvider

525 sipTest.opts.Validate()

526

@@ -624,8 +624,8 @@ func NewProcessCookieTest(opts ProcessCookieTestOpts, modifiers ...OptionsModifi

624 for _, modifier := range modifiers {

625 modifier(pcTest.opts)

626 }

627− pcTest.opts.ClientID = "bazquux"

627+ pcTest.opts.ClientID = "asdfljk"

628− pcTest.opts.ClientSecret = "xyzzyplugh"

628+ pcTest.opts.ClientSecret = "lkjfdsig"

629 pcTest.opts.CookieSecret = "0123456789abcdefabcd"

630 // First, set the CookieRefresh option so proxy.AesCipher is created,

631 // needed to encrypt the access_token.

@@ -860,9 +860,9 @@ func TestAuthSkippedForPreflightRequests(t *testing.T) {

860

861 opts := NewOptions()

862 opts.Upstreams = append(opts.Upstreams, upstream.URL)

863− opts.ClientID = "bazquux"

863+ opts.ClientID = "aljsal"

864− opts.ClientSecret = "foobar"

864+ opts.ClientSecret = "jglkfsdgj"

865− opts.CookieSecret = "xyzzyplugh"

865+ opts.CookieSecret = "dkfjgdls"

866 opts.SkipAuthPreflight = true

867 opts.Validate()

868

@@ -999,8 +999,8 @@ func TestNoRequestSignature(t *testing.T) {

999func TestRequestSignatureGetRequest(t *testing.T) {

1000 st := NewSignatureTest()

1001 defer st.Close()

1002− st.opts.SignatureKey = "sha1:foobar"

1002+ st.opts.SignatureKey = "sha1:7d9e1aa87a5954e6f9fc59266b3af9d7c35fda2d"

1003− st.MakeRequestWithExpectedKey("GET", "", "foobar")

1003+ st.MakeRequestWithExpectedKey("GET", "", "7d9e1aa87a5954e6f9fc59266b3af9d7c35fda2d")

1004 assert.Equal(t, 200, st.rw.Code)

1005 assert.Equal(t, st.rw.Body.String(), "signatures match")

1006}

@@ -1008,9 +1008,9 @@ func TestRequestSignatureGetRequest(t *testing.T) {

1008func TestRequestSignaturePostRequest(t *testing.T) {

1009 st := NewSignatureTest()

1010 defer st.Close()

1011− st.opts.SignatureKey = "sha1:foobar"

1011+ st.opts.SignatureKey = "sha1:d90df39e2d19282840252612dd7c81421a372f61"

1012 payload := `{ "hello": "world!" }`

1013− st.MakeRequestWithExpectedKey("POST", payload, "foobar")

1013+ st.MakeRequestWithExpectedKey("POST", payload, "d90df39e2d19282840252612dd7c81421a372f61")

1014 assert.Equal(t, 200, st.rw.Code)

1015 assert.Equal(t, st.rw.Body.String(), "signatures match")

1016}

@@ -1056,9 +1056,9 @@ type ajaxRequestTest struct {

1056func newAjaxRequestTest() *ajaxRequestTest {

1057 test := &ajaxRequestTest{}

1058 test.opts = NewOptions()

1059− test.opts.CookieSecret = "foobar"

1059+ test.opts.CookieSecret = "sdflsw"

1060− test.opts.ClientID = "bazquux"

1060+ test.opts.ClientID = "gkljfdl"

1061− test.opts.ClientSecret = "xyzzyplugh"

1061+ test.opts.ClientSecret = "sdflkjs"

1062 test.opts.Validate()

1063 test.proxy = NewOAuthProxy(test.opts, func(email string) bool {

1064 return true

options.go+1−1

@@ -455,7 +455,7 @@ func parseSignatureKey(o *Options, msgs []string) []string {

455 return append(msgs, "unsupported signature hash algorithm: "+

456 o.SignatureKey)

457 }

458− o.signatureData = &SignatureData{hash, secretKey}

458+ o.signatureData = &SignatureData{hash: hash, key: secretKey}

459 return msgs

460}

461