cfc2daa · typeable/oauth2-proxy

providers/auth_test.gonew file+23

compare with master

unifiedsplit

@@ -0,0 +1,23 @@

1+package providers

2+

3+import (

4+ "fmt"

5+ "net/http"

6+ "net/url"

7+

8+ "github.com/pusher/oauth2_proxy/pkg/apis/sessions"

9+)

10+

11+var authorizedAccessToken = "imaginary_access_token"

12+

13+func CreateAuthorizedSession() *sessions.SessionState {

14+ return &sessions.SessionState{AccessToken: authorizedAccessToken}

15+}

16+

17+func IsAuthorizedInHeader(reqHeader http.Header) bool {

18+ return reqHeader.Get("Authorization") == fmt.Sprintf("Bearer %s", authorizedAccessToken)

19+}

20+

21+func IsAuthorizedInURL(reqURL *url.URL) bool {

22+ return reqURL.Query().Get("access_token") == authorizedAccessToken

23+}

providers/azure_test.go+7−8

@@ -7,7 +7,6 @@ import (

7 "testing"

8 "time"

9

10− "github.com/pusher/oauth2_proxy/pkg/apis/sessions"

11 "github.com/stretchr/testify/assert"

10 "github.com/stretchr/testify/assert"

12)

11)

13

12

@@ -118,7 +117,7 @@ func testAzureBackend(payload string) *httptest.Server {

118 } else if r.Method == "POST" && r.Body != nil {

117 } else if r.Method == "POST" && r.Body != nil {

119 w.WriteHeader(200)

118 w.WriteHeader(200)

120 w.Write([]byte(payload))

119 w.Write([]byte(payload))

121− } else if r.Header.Get("Authorization") != "Bearer imaginary_access_token" {

120+ } else if !IsAuthorizedInHeader(r.Header) {

122 w.WriteHeader(403)

121 w.WriteHeader(403)

123 } else {

122 } else {

124 w.WriteHeader(200)

123 w.WriteHeader(200)

@@ -134,7 +133,7 @@ func TestAzureProviderGetEmailAddress(t *testing.T) {

134 bURL, _ := url.Parse(b.URL)

133 bURL, _ := url.Parse(b.URL)

135 p := testAzureProvider(bURL.Host)

134 p := testAzureProvider(bURL.Host)

136

135

137− session := &sessions.SessionState{AccessToken: "imaginary_access_token"}

136+ session := CreateAuthorizedSession()

138 email, err := p.GetEmailAddress(session)

137 email, err := p.GetEmailAddress(session)

139 assert.Equal(t, nil, err)

138 assert.Equal(t, nil, err)

140 assert.Equal(t, "user@windows.net", email)

139 assert.Equal(t, "user@windows.net", email)

@@ -147,7 +146,7 @@ func TestAzureProviderGetEmailAddressMailNull(t *testing.T) {

147 bURL, _ := url.Parse(b.URL)

146 bURL, _ := url.Parse(b.URL)

148 p := testAzureProvider(bURL.Host)

147 p := testAzureProvider(bURL.Host)

149

148

150− session := &sessions.SessionState{AccessToken: "imaginary_access_token"}

149+ session := CreateAuthorizedSession()

151 email, err := p.GetEmailAddress(session)

150 email, err := p.GetEmailAddress(session)

152 assert.Equal(t, nil, err)

151 assert.Equal(t, nil, err)

153 assert.Equal(t, "user@windows.net", email)

152 assert.Equal(t, "user@windows.net", email)

@@ -160,7 +159,7 @@ func TestAzureProviderGetEmailAddressGetUserPrincipalName(t *testing.T) {

160 bURL, _ := url.Parse(b.URL)

159 bURL, _ := url.Parse(b.URL)

161 p := testAzureProvider(bURL.Host)

160 p := testAzureProvider(bURL.Host)

162

161

163− session := &sessions.SessionState{AccessToken: "imaginary_access_token"}

162+ session := CreateAuthorizedSession()

164 email, err := p.GetEmailAddress(session)

163 email, err := p.GetEmailAddress(session)

165 assert.Equal(t, nil, err)

164 assert.Equal(t, nil, err)

166 assert.Equal(t, "user@windows.net", email)

165 assert.Equal(t, "user@windows.net", email)

@@ -173,7 +172,7 @@ func TestAzureProviderGetEmailAddressFailToGetEmailAddress(t *testing.T) {

173 bURL, _ := url.Parse(b.URL)

172 bURL, _ := url.Parse(b.URL)

174 p := testAzureProvider(bURL.Host)

173 p := testAzureProvider(bURL.Host)

175

174

176− session := &sessions.SessionState{AccessToken: "imaginary_access_token"}

175+ session := CreateAuthorizedSession()

177 email, err := p.GetEmailAddress(session)

176 email, err := p.GetEmailAddress(session)

178 assert.Equal(t, "type assertion to string failed", err.Error())

177 assert.Equal(t, "type assertion to string failed", err.Error())

179 assert.Equal(t, "", email)

178 assert.Equal(t, "", email)

@@ -186,7 +185,7 @@ func TestAzureProviderGetEmailAddressEmptyUserPrincipalName(t *testing.T) {

186 bURL, _ := url.Parse(b.URL)

185 bURL, _ := url.Parse(b.URL)

187 p := testAzureProvider(bURL.Host)

186 p := testAzureProvider(bURL.Host)

188

187

189− session := &sessions.SessionState{AccessToken: "imaginary_access_token"}

188+ session := CreateAuthorizedSession()

190 email, err := p.GetEmailAddress(session)

189 email, err := p.GetEmailAddress(session)

191 assert.Equal(t, nil, err)

190 assert.Equal(t, nil, err)

192 assert.Equal(t, "", email)

191 assert.Equal(t, "", email)

@@ -199,7 +198,7 @@ func TestAzureProviderGetEmailAddressIncorrectOtherMails(t *testing.T) {

199 bURL, _ := url.Parse(b.URL)

198 bURL, _ := url.Parse(b.URL)

200 p := testAzureProvider(bURL.Host)

199 p := testAzureProvider(bURL.Host)

201

200

202− session := &sessions.SessionState{AccessToken: "imaginary_access_token"}

201+ session := CreateAuthorizedSession()

203 email, err := p.GetEmailAddress(session)

202 email, err := p.GetEmailAddress(session)

204 assert.Equal(t, "type assertion to string failed", err.Error())

203 assert.Equal(t, "type assertion to string failed", err.Error())

205 assert.Equal(t, "", email)

204 assert.Equal(t, "", email)

providers/bitbucket_test.go+4−4

@@ -51,7 +51,7 @@ func testBitbucketBackend(payload string) *httptest.Server {

51 if !paths[url.Path] {

52 log.Printf("%s not in %+v\n", url.Path, paths)

53 w.WriteHeader(404)

54− } else if r.URL.Query().Get("access_token") != "imaginary_access_token" {

54+ } else if !IsAuthorizedInURL(r.URL) {

55 w.WriteHeader(403)

56 } else {

57 w.WriteHeader(200)

@@ -119,7 +119,7 @@ func TestBitbucketProviderGetEmailAddress(t *testing.T) {

119 bURL, _ := url.Parse(b.URL)

120 p := testBitbucketProvider(bURL.Host, "", "")

121

122− session := &sessions.SessionState{AccessToken: "imaginary_access_token"}

122+ session := CreateAuthorizedSession()

123 email, err := p.GetEmailAddress(session)

124 assert.Equal(t, nil, err)

125 assert.Equal(t, "michael.bland@gsa.gov", email)

@@ -132,7 +132,7 @@ func TestBitbucketProviderGetEmailAddressAndGroup(t *testing.T) {

132 bURL, _ := url.Parse(b.URL)

133 p := testBitbucketProvider(bURL.Host, "bioinformatics", "")

134

135− session := &sessions.SessionState{AccessToken: "imaginary_access_token"}

135+ session := CreateAuthorizedSession()

136 email, err := p.GetEmailAddress(session)

137 assert.Equal(t, nil, err)

138 assert.Equal(t, "michael.bland@gsa.gov", email)

@@ -163,7 +163,7 @@ func TestBitbucketProviderGetEmailAddressEmailNotPresentInPayload(t *testing.T)

163 bURL, _ := url.Parse(b.URL)

164 p := testBitbucketProvider(bURL.Host, "", "")

165

166− session := &sessions.SessionState{AccessToken: "imaginary_access_token"}

166+ session := CreateAuthorizedSession()

167 email, err := p.GetEmailAddress(session)

168 assert.Equal(t, "", email)

169 assert.Equal(t, nil, err)

providers/digitalocean_test.go+3−3

@@ -34,7 +34,7 @@ func testDigitalOceanBackend(payload string) *httptest.Server {

34 func(w http.ResponseWriter, r *http.Request) {

35 if r.URL.Path != path {

36 w.WriteHeader(404)

37− } else if r.Header.Get("Authorization") != "Bearer imaginary_access_token" {

37+ } else if !IsAuthorizedInHeader(r.Header) {

38 w.WriteHeader(403)

39 } else {

40 w.WriteHeader(200)

@@ -98,7 +98,7 @@ func TestDigitalOceanProviderGetEmailAddress(t *testing.T) {

98 bURL, _ := url.Parse(b.URL)

99 p := testDigitalOceanProvider(bURL.Host)

100

101− session := &sessions.SessionState{AccessToken: "imaginary_access_token"}

101+ session := CreateAuthorizedSession()

102 email, err := p.GetEmailAddress(session)

103 assert.Equal(t, nil, err)

104 assert.Equal(t, "user@example.com", email)

@@ -127,7 +127,7 @@ func TestDigitalOceanProviderGetEmailAddressEmailNotPresentInPayload(t *testing.

127 bURL, _ := url.Parse(b.URL)

128 p := testDigitalOceanProvider(bURL.Host)

129

130− session := &sessions.SessionState{AccessToken: "imaginary_access_token"}

130+ session := CreateAuthorizedSession()

131 email, err := p.GetEmailAddress(session)

132 assert.NotEqual(t, nil, err)

133 assert.Equal(t, "", email)

providers/github_test.go+5−5

@@ -104,7 +104,7 @@ func TestGitHubProviderGetEmailAddress(t *testing.T) {

104 bURL, _ := url.Parse(b.URL)

105 p := testGitHubProvider(bURL.Host)

106

107− session := &sessions.SessionState{AccessToken: "imaginary_access_token"}

107+ session := CreateAuthorizedSession()

108 email, err := p.GetEmailAddress(session)

109 assert.Equal(t, nil, err)

110 assert.Equal(t, "michael.bland@gsa.gov", email)

@@ -117,7 +117,7 @@ func TestGitHubProviderGetEmailAddressNotVerified(t *testing.T) {

117 bURL, _ := url.Parse(b.URL)

118 p := testGitHubProvider(bURL.Host)

119

120− session := &sessions.SessionState{AccessToken: "imaginary_access_token"}

120+ session := CreateAuthorizedSession()

121 email, err := p.GetEmailAddress(session)

122 assert.Equal(t, nil, err)

123 assert.Empty(t, "", email)

@@ -135,7 +135,7 @@ func TestGitHubProviderGetEmailAddressWithOrg(t *testing.T) {

135 p := testGitHubProvider(bURL.Host)

136 p.Org = "testorg1"

137

138− session := &sessions.SessionState{AccessToken: "imaginary_access_token"}

138+ session := CreateAuthorizedSession()

139 email, err := p.GetEmailAddress(session)

140 assert.Equal(t, nil, err)

141 assert.Equal(t, "michael.bland@gsa.gov", email)

@@ -166,7 +166,7 @@ func TestGitHubProviderGetEmailAddressEmailNotPresentInPayload(t *testing.T) {

166 bURL, _ := url.Parse(b.URL)

167 p := testGitHubProvider(bURL.Host)

168

169− session := &sessions.SessionState{AccessToken: "imaginary_access_token"}

169+ session := CreateAuthorizedSession()

170 email, err := p.GetEmailAddress(session)

171 assert.NotEqual(t, nil, err)

172 assert.Equal(t, "", email)

@@ -179,7 +179,7 @@ func TestGitHubProviderGetUserName(t *testing.T) {

179 bURL, _ := url.Parse(b.URL)

180 p := testGitHubProvider(bURL.Host)

181

182− session := &sessions.SessionState{AccessToken: "imaginary_access_token"}

182+ session := CreateAuthorizedSession()

183 email, err := p.GetUserName(session)

184 assert.Equal(t, nil, err)

185 assert.Equal(t, "mbland", email)

providers/keycloak_test.go+4−7

@@ -10,9 +10,6 @@ import (

10 "github.com/pusher/oauth2_proxy/pkg/apis/sessions"

11)

12

13−const imaginaryAccessToken = "imaginary_access_token"

14−const bearerAccessToken = "Bearer " + imaginaryAccessToken

15−

16func testKeycloakProvider(hostname, group string) *KeycloakProvider {

13func testKeycloakProvider(hostname, group string) *KeycloakProvider {

17 p := NewKeycloakProvider(

14 p := NewKeycloakProvider(

18 &ProviderData{

15 &ProviderData{

@@ -44,7 +41,7 @@ func testKeycloakBackend(payload string) *httptest.Server {

44 url := r.URL

41 url := r.URL

45 if url.Path != path {

42 if url.Path != path {

46 w.WriteHeader(404)

43 w.WriteHeader(404)

47− } else if r.Header.Get("Authorization") != bearerAccessToken {

44+ } else if !IsAuthorizedInHeader(r.Header) {

48 w.WriteHeader(403)

45 w.WriteHeader(403)

49 } else {

46 } else {

50 w.WriteHeader(200)

47 w.WriteHeader(200)

@@ -100,7 +97,7 @@ func TestKeycloakProviderGetEmailAddress(t *testing.T) {

100 bURL, _ := url.Parse(b.URL)

97 bURL, _ := url.Parse(b.URL)

101 p := testKeycloakProvider(bURL.Host, "")

98 p := testKeycloakProvider(bURL.Host, "")

102

99

103− session := &sessions.SessionState{AccessToken: imaginaryAccessToken}

100+ session := CreateAuthorizedSession()

104 email, err := p.GetEmailAddress(session)

101 email, err := p.GetEmailAddress(session)

105 assert.Equal(t, nil, err)

102 assert.Equal(t, nil, err)

106 assert.Equal(t, "michael.bland@gsa.gov", email)

103 assert.Equal(t, "michael.bland@gsa.gov", email)

@@ -113,7 +110,7 @@ func TestKeycloakProviderGetEmailAddressAndGroup(t *testing.T) {

113 bURL, _ := url.Parse(b.URL)

110 bURL, _ := url.Parse(b.URL)

114 p := testKeycloakProvider(bURL.Host, "test-grp1")

111 p := testKeycloakProvider(bURL.Host, "test-grp1")

115

112

116− session := &sessions.SessionState{AccessToken: imaginaryAccessToken}

113+ session := CreateAuthorizedSession()

117 email, err := p.GetEmailAddress(session)

114 email, err := p.GetEmailAddress(session)

118 assert.Equal(t, nil, err)

115 assert.Equal(t, nil, err)

119 assert.Equal(t, "michael.bland@gsa.gov", email)

116 assert.Equal(t, "michael.bland@gsa.gov", email)

@@ -144,7 +141,7 @@ func TestKeycloakProviderGetEmailAddressEmailNotPresentInPayload(t *testing.T) {

144 bURL, _ := url.Parse(b.URL)

141 bURL, _ := url.Parse(b.URL)

145 p := testKeycloakProvider(bURL.Host, "")

142 p := testKeycloakProvider(bURL.Host, "")

146

143

147− session := &sessions.SessionState{AccessToken: imaginaryAccessToken}

144+ session := CreateAuthorizedSession()

148 email, err := p.GetEmailAddress(session)

145 email, err := p.GetEmailAddress(session)

149 assert.NotEqual(t, nil, err)

146 assert.NotEqual(t, nil, err)

150 assert.Equal(t, "", email)

147 assert.Equal(t, "", email)

providers/linkedin_test.go+3−3

@@ -34,7 +34,7 @@ func testLinkedInBackend(payload string) *httptest.Server {

34 func(w http.ResponseWriter, r *http.Request) {

35 if r.URL.Path != path {

36 w.WriteHeader(404)

37− } else if r.Header.Get("Authorization") != "Bearer imaginary_access_token" {

37+ } else if !IsAuthorizedInHeader(r.Header) {

38 w.WriteHeader(403)

39 } else {

40 w.WriteHeader(200)

@@ -98,7 +98,7 @@ func TestLinkedInProviderGetEmailAddress(t *testing.T) {

98 bURL, _ := url.Parse(b.URL)

99 p := testLinkedInProvider(bURL.Host)

100

101− session := &sessions.SessionState{AccessToken: "imaginary_access_token"}

101+ session := CreateAuthorizedSession()

102 email, err := p.GetEmailAddress(session)

103 assert.Equal(t, nil, err)

104 assert.Equal(t, "user@linkedin.com", email)

@@ -127,7 +127,7 @@ func TestLinkedInProviderGetEmailAddressEmailNotPresentInPayload(t *testing.T) {

127 bURL, _ := url.Parse(b.URL)

128 p := testLinkedInProvider(bURL.Host)

129

130− session := &sessions.SessionState{AccessToken: "imaginary_access_token"}

130+ session := CreateAuthorizedSession()

131 email, err := p.GetEmailAddress(session)

132 assert.NotEqual(t, nil, err)

133 assert.Equal(t, "", email)

providers/nextcloud_test.go+3−3

@@ -39,7 +39,7 @@ func testNextcloudBackend(payload string) *httptest.Server {

39 func(w http.ResponseWriter, r *http.Request) {

40 if r.URL.Path != path || r.URL.RawQuery != query {

41 w.WriteHeader(404)

42− } else if r.Header.Get("Authorization") != "Bearer imaginary_access_token_nextcloud" {

42+ } else if !IsAuthorizedInHeader(r.Header) {

43 w.WriteHeader(403)

44 } else {

45 w.WriteHeader(200)

@@ -96,7 +96,7 @@ func TestNextcloudProviderGetEmailAddress(t *testing.T) {

96 p.ValidateURL.Path = userPath

97 p.ValidateURL.RawQuery = formatJSON

98

99− session := &sessions.SessionState{AccessToken: "imaginary_access_token_nextcloud"}

99+ session := CreateAuthorizedSession()

100 email, err := p.GetEmailAddress(session)

101 assert.Equal(t, nil, err)

102 assert.Equal(t, "michael.bland@gsa.gov", email)

@@ -131,7 +131,7 @@ func TestNextcloudProviderGetEmailAddressEmailNotPresentInPayload(t *testing.T)

131 p.ValidateURL.Path = userPath

132 p.ValidateURL.RawQuery = formatJSON

133

134− session := &sessions.SessionState{AccessToken: "imaginary_access_token_nextcloud"}

134+ session := CreateAuthorizedSession()

135 email, err := p.GetEmailAddress(session)

136 assert.NotEqual(t, nil, err)

137 assert.Equal(t, "", email)