git.iko.soy/typeable/oauth2-proxy
on master help sign in
Merge pull request #96 from caarlos0/verified
d3b8232Joel Speed
CHANGELOG.md+1
compare with master
unifiedsplit
@@ -2,6 +2,7 @@
2
2
3## Changes since v3.1.0
3## Changes since v3.1.0
4
4
5+- [#96](https://github.com/bitly/oauth2_proxy/pull/96) Check if email is verified on GitHub (@caarlos0)
5- [#110](https://github.com/pusher/oauth2_proxy/pull/110) Added GCP healthcheck option (@timothy-spencer)
6- [#110](https://github.com/pusher/oauth2_proxy/pull/110) Added GCP healthcheck option (@timothy-spencer)
6- [#112](https://github.com/pusher/oauth2_proxy/pull/112) Improve websocket support (@gyson)
7- [#112](https://github.com/pusher/oauth2_proxy/pull/112) Improve websocket support (@gyson)
7- [#63](https://github.com/pusher/oauth2_proxy/pull/63) Use encoding/json for SessionState serialization (@yaegashi)
8- [#63](https://github.com/pusher/oauth2_proxy/pull/63) Use encoding/json for SessionState serialization (@yaegashi)
providers/github.go+4−3
@@ -202,8 +202,9 @@ func (p *GitHubProvider) hasOrgAndTeam(accessToken string) (bool, error) {
202func (p *GitHubProvider) GetEmailAddress(s *SessionState) (string, error) {
202func (p *GitHubProvider) GetEmailAddress(s *SessionState) (string, error) {
203
203
204 var emails []struct {
204 var emails []struct {
205− Email string `json:"email"`
205+ Email string `json:"email"`
206− Primary bool `json:"primary"`
206+ Primary bool `json:"primary"`
207+ Verified bool `json:"verified"`
207 }
208 }
208
209
209 // if we require an Org or Team, check that first
210 // if we require an Org or Team, check that first
@@ -248,7 +249,7 @@ func (p *GitHubProvider) GetEmailAddress(s *SessionState) (string, error) {
248 }
249 }
249
250
250 for _, email := range emails {
251 for _, email := range emails {
251− if email.Primary {
252+ if email.Primary && email.Verified {
252 return email.Email, nil
253 return email.Email, nil
253 }
254 }
254 }
255 }
providers/github_test.go+16−3
@@ -97,7 +97,7 @@ func TestGitHubProviderOverrides(t *testing.T) {
97}
97}
98
98
99func TestGitHubProviderGetEmailAddress(t *testing.T) {
99func TestGitHubProviderGetEmailAddress(t *testing.T) {
100− b := testGitHubBackend([]string{`[ {"email": "michael.bland@gsa.gov", "primary": true} ]`})
100+ b := testGitHubBackend([]string{`[ {"email": "michael.bland@gsa.gov", "verified": true, "primary": true} ]`})
101 defer b.Close()
101 defer b.Close()
102
102
103 bURL, _ := url.Parse(b.URL)
103 bURL, _ := url.Parse(b.URL)
@@ -109,10 +109,23 @@ func TestGitHubProviderGetEmailAddress(t *testing.T) {
109 assert.Equal(t, "michael.bland@gsa.gov", email)
109 assert.Equal(t, "michael.bland@gsa.gov", email)
110}
110}
111
111
112+func TestGitHubProviderGetEmailAddressNotVerified(t *testing.T) {
113+ b := testGitHubBackend([]string{`[ {"email": "michael.bland@gsa.gov", "verified": false, "primary": true} ]`})
114+ defer b.Close()
115+
116+ bURL, _ := url.Parse(b.URL)
117+ p := testGitHubProvider(bURL.Host)
118+
119+ session := &SessionState{AccessToken: "imaginary_access_token"}
120+ email, err := p.GetEmailAddress(session)
121+ assert.Equal(t, nil, err)
122+ assert.Empty(t, "", email)
123+}
124+
112func TestGitHubProviderGetEmailAddressWithOrg(t *testing.T) {
125func TestGitHubProviderGetEmailAddressWithOrg(t *testing.T) {
113 b := testGitHubBackend([]string{
126 b := testGitHubBackend([]string{
114− `[ {"email": "michael.bland@gsa.gov", "primary": true, "login":"testorg"} ]`,
127+ `[ {"email": "michael.bland@gsa.gov", "primary": true, "verified": true, "login":"testorg"} ]`,
115− `[ {"email": "michael.bland1@gsa.gov", "primary": true, "login":"testorg1"} ]`,
128+ `[ {"email": "michael.bland1@gsa.gov", "primary": true, "verified": true, "login":"testorg1"} ]`,
116 `[ ]`,
129 `[ ]`,
117 })
130 })
118 defer b.Close()
131 defer b.Close()