git.iko.soy/typeable/oauth2-proxy
on master help sign in
Merge pull request #66 from 18F/enforce-cookie-secret
ade9502Jehiah Czebotar
options.go+17−8
compare with master
unifiedsplit
@@ -1,10 +1,10 @@
1package main
1package main
2
2
3import (
3import (
4− "errors"
5 "fmt"
4 "fmt"
6 "net/url"
5 "net/url"
7 "regexp"
6 "regexp"
7+ "strings"
8 "time"
8 "time"
9)
9)
10
10
@@ -45,29 +45,33 @@ func NewOptions() *Options {
45}
45}
46
46
47func (o *Options) Validate() error {
47func (o *Options) Validate() error {
48+ msgs := make([]string, 0)
48 if len(o.Upstreams) < 1 {
49 if len(o.Upstreams) < 1 {
49− return errors.New("missing setting: upstream")
50+ msgs = append(msgs, "missing setting: upstream")
50 }
51 }
51 if o.CookieSecret == "" {
52 if o.CookieSecret == "" {
52− errors.New("missing setting: cookie-secret")
53+ msgs = append(msgs, "missing setting: cookie-secret")
53 }
54 }
54 if o.ClientID == "" {
55 if o.ClientID == "" {
55− return errors.New("missing setting: client-id")
56+ msgs = append(msgs, "missing setting: client-id")
56 }
57 }
57 if o.ClientSecret == "" {
58 if o.ClientSecret == "" {
58− return errors.New("missing setting: client-secret")
59+ msgs = append(msgs, "missing setting: client-secret")
59 }
60 }
60
61
61 redirectUrl, err := url.Parse(o.RedirectUrl)
62 redirectUrl, err := url.Parse(o.RedirectUrl)
62 if err != nil {
63 if err != nil {
64+ msgs = append(msgs, fmt.Sprintf(
63− return fmt.Errorf("error parsing redirect-url=%q %s", o.RedirectUrl, err)
65+ "error parsing redirect-url=%q %s", o.RedirectUrl, err))
64 }
66 }
65 o.redirectUrl = redirectUrl
67 o.redirectUrl = redirectUrl
66
68
67 for _, u := range o.Upstreams {
69 for _, u := range o.Upstreams {
68 upstreamUrl, err := url.Parse(u)
70 upstreamUrl, err := url.Parse(u)
69 if err != nil {
71 if err != nil {
72+ msgs = append(msgs, fmt.Sprintf(
70− return fmt.Errorf("error parsing upstream=%q %s", upstreamUrl, err)
73+ "error parsing upstream=%q %s",
74+ upstreamUrl, err))
71 }
75 }
72 if upstreamUrl.Path == "" {
76 if upstreamUrl.Path == "" {
73 upstreamUrl.Path = "/"
77 upstreamUrl.Path = "/"
@@ -78,10 +82,15 @@ func (o *Options) Validate() error {
78 for _, u := range o.SkipAuthRegex {
82 for _, u := range o.SkipAuthRegex {
79 CompiledRegex, err := regexp.Compile(u)
83 CompiledRegex, err := regexp.Compile(u)
80 if err != nil {
84 if err != nil {
85+ msgs = append(msgs, fmt.Sprintf(
81− return fmt.Errorf("error compiling regex=%q %s", u, err)
86+ "error compiling regex=%q %s", u, err))
82 }
87 }
83 o.CompiledRegex = append(o.CompiledRegex, CompiledRegex)
88 o.CompiledRegex = append(o.CompiledRegex, CompiledRegex)
84 }
89 }
85
90
91+ if len(msgs) != 0 {
92+ return fmt.Errorf("Invalid configuration:\n %s",
93+ strings.Join(msgs, "\n "))
94+ }
86 return nil
95 return nil
87}
96}
options_test.gonew file+92
@@ -0,0 +1,92 @@
1+package main
2+
3+import (
4+ "strings"
5+ "testing"
6+ "net/url"
7+
8+ "github.com/bmizerany/assert"
9+)
10+
11+func testOptions() (*Options) {
12+ o := NewOptions()
13+ o.Upstreams = append(o.Upstreams, "http://127.0.0.1:8080/")
14+ o.CookieSecret = "foobar"
15+ o.ClientID = "bazquux"
16+ o.ClientSecret = "xyzzyplugh"
17+ return o
18+}
19+
20+func errorMsg(msgs []string)(string) {
21+ result := make([]string, 0)
22+ result = append(result, "Invalid configuration:")
23+ result = append(result, msgs...)
24+ return strings.Join(result, "\n ")
25+}
26+
27+func TestNewOptions(t *testing.T) {
28+ o := NewOptions()
29+ err := o.Validate()
30+ assert.NotEqual(t, nil, err)
31+
32+ expected := errorMsg([]string{
33+ "missing setting: upstream",
34+ "missing setting: cookie-secret",
35+ "missing setting: client-id",
36+ "missing setting: client-secret"})
37+ assert.Equal(t, expected, err.Error())
38+}
39+
40+func TestInitializedOptions(t *testing.T) {
41+ o := testOptions()
42+ assert.Equal(t, nil, o.Validate())
43+}
44+
45+// Note that it's not worth testing nonparseable URLs, since url.Parse()
46+// seems to parse damn near anything.
47+func TestRedirectUrl(t *testing.T) {
48+ o := testOptions()
49+ o.RedirectUrl = "https://myhost.com/oauth2/callback"
50+ assert.Equal(t, nil, o.Validate())
51+ expected := &url.URL{
52+ Scheme: "https", Host: "myhost.com", Path: "/oauth2/callback"}
53+ assert.Equal(t, expected, o.redirectUrl)
54+}
55+
56+func TestProxyUrls(t *testing.T) {
57+ o := testOptions()
58+ o.Upstreams = append(o.Upstreams, "http://127.0.0.1:8081")
59+ assert.Equal(t, nil, o.Validate())
60+ expected := []*url.URL{
61+ &url.URL{Scheme: "http", Host: "127.0.0.1:8080", Path: "/"},
62+ // note the '/' was added
63+ &url.URL{Scheme: "http", Host: "127.0.0.1:8081", Path: "/"},
64+ }
65+ assert.Equal(t, expected, o.proxyUrls)
66+}
67+
68+func TestCompiledRegex(t *testing.T) {
69+ o := testOptions()
70+ regexps := []string{"/foo/.*", "/ba[rz]/quux"}
71+ o.SkipAuthRegex = regexps
72+ assert.Equal(t, nil, o.Validate())
73+ actual := make([]string, 0)
74+ for _, regex := range o.CompiledRegex {
75+ actual = append(actual, regex.String())
76+ }
77+ assert.Equal(t, regexps, actual)
78+}
79+
80+func TestCompiledRegexError(t *testing.T) {
81+ o := testOptions()
82+ o.SkipAuthRegex = []string{"(foobaz", "barquux)"}
83+ err := o.Validate()
84+ assert.NotEqual(t, nil, err)
85+
86+ expected := errorMsg([]string{
87+ "error compiling regex=\"(foobaz\" error parsing regexp: " +
88+ "missing closing ): `(foobaz`",
89+ "error compiling regex=\"barquux)\" error parsing regexp: " +
90+ "unexpected ): `barquux)`"})
91+ assert.Equal(t, expected, err.Error())
92+}