@@ -2594,3 +2594,92 @@ func TestAuthOnlyAllowedGroups(t *testing.T) {
25942594 })
25952595 }
25962596}
2597+
2598+func TestAuthOnlyAllowedGroupsWithSkipMethods(t *testing.T) {
2599+ testCases := []struct {
2600+ name string
2601+ groups []string
2602+ method string
2603+ ip string
2604+ withSession bool
2605+ expectedStatusCode int
2606+ }{
2607+ {
2608+ name: "UserWithGroupSkipAuthPreflight",
2609+ groups: []string{"a", "c"},
2610+ method: "OPTIONS",
2611+ ip: "1.2.3.5:43670",
2612+ withSession: true,
2613+ expectedStatusCode: http.StatusAccepted,
2614+ },
2615+ {
2616+ name: "UserWithGroupTrustedIp",
2617+ groups: []string{"a", "c"},
2618+ method: "GET",
2619+ ip: "1.2.3.4:43670",
2620+ withSession: true,
2621+ expectedStatusCode: http.StatusAccepted,
2622+ },
2623+ {
2624+ name: "UserWithoutGroupSkipAuthPreflight",
2625+ groups: []string{"c"},
2626+ method: "OPTIONS",
2627+ ip: "1.2.3.5:43670",
2628+ withSession: true,
2629+ expectedStatusCode: http.StatusForbidden,
2630+ },
2631+ {
2632+ name: "UserWithoutGroupTrustedIp",
2633+ groups: []string{"c"},
2634+ method: "GET",
2635+ ip: "1.2.3.4:43670",
2636+ withSession: true,
2637+ expectedStatusCode: http.StatusForbidden,
2638+ },
2639+ {
2640+ name: "UserWithoutSessionSkipAuthPreflight",
2641+ method: "OPTIONS",
2642+ ip: "1.2.3.5:43670",
2643+ withSession: false,
2644+ expectedStatusCode: http.StatusAccepted,
2645+ },
2646+ {
2647+ name: "UserWithoutSessionTrustedIp",
2648+ method: "GET",
2649+ ip: "1.2.3.4:43670",
2650+ withSession: false,
2651+ expectedStatusCode: http.StatusAccepted,
2652+ },
2653+ }
2654+
2655+ for _, tc := range testCases {
2656+ t.Run(tc.name, func(t *testing.T) {
2657+ test, err := NewAuthOnlyEndpointTest("?allowed_groups=a,b", func(opts *options.Options) {
2658+ opts.SkipAuthPreflight = true
2659+ opts.TrustedIPs = []string{"1.2.3.4"}
2660+ })
2661+ if err != nil {
2662+ t.Fatal(err)
2663+ }
2664+
2665+ test.req.Method = tc.method
2666+ test.req.RemoteAddr = tc.ip
2667+
2668+ if tc.withSession {
2669+ created := time.Now()
2670+ session := &sessions.SessionState{
2671+ Groups: tc.groups,
2672+ Email: "test",
2673+ AccessToken: "oauth_token",
2674+ CreatedAt: &created,
2675+ }
2676+ err = test.SaveSession(session)
2677+ }
2678+ assert.NoError(t, err)
2679+
2680+ test.proxy.ServeHTTP(test.rw, test.req)
2681+
2682+ assert.Equal(t, tc.expectedStatusCode, test.rw.Code)
2683+ })
2684+ }
2685+}