@@ -180,6 +180,11 @@ func (p *GoogleProvider) Redeem(ctx context.Context, redirectURL, code string) (
180180// EnrichSessionState checks the listed Google Groups configured and adds any
181181// that the user is a member of to session.Groups.
182182func (p *GoogleProvider) EnrichSessionState(ctx context.Context, s *sessions.SessionState) error {
183+ // TODO (@NickMeves) - Move to pure EnrichSessionState logic and stop
184+ // reusing legacy `groupValidator`.
185+ //
186+ // This is called here to get the validator to do the `session.Groups`
187+ // populating logic.
183188 p.groupValidator(s)
184189
185190 return nil
@@ -273,6 +278,9 @@ func (p *GoogleProvider) RefreshSessionIfNeeded(ctx context.Context, s *sessions
273278 return false, err
274279 }
275280
281+ // TODO (@NickMeves) - Align Group authorization needs with other providers'
282+ // behavior in the `RefreshSession` case.
283+ //
276284 // re-check that the user is in the proper google group(s)
277285 if !p.groupValidator(s) {
278286 return false, fmt.Errorf("%s is no longer in the group(s)", s.Email)