@@ -180,6 +180,11 @@ func (p *GoogleProvider) Redeem(ctx context.Context, redirectURL, code string) (
180// EnrichSessionState checks the listed Google Groups configured and adds any
180// EnrichSessionState checks the listed Google Groups configured and adds any
181// that the user is a member of to session.Groups.
181// that the user is a member of to session.Groups.
182func (p *GoogleProvider) EnrichSessionState(ctx context.Context, s *sessions.SessionState) error {
182func (p *GoogleProvider) EnrichSessionState(ctx context.Context, s *sessions.SessionState) error {
183+ // TODO (@NickMeves) - Move to pure EnrichSessionState logic and stop
184+ // reusing legacy `groupValidator`.
186+ // This is called here to get the validator to do the `session.Groups`
187+ // populating logic.
183 p.groupValidator(s)
188 p.groupValidator(s)
185 return nil
190 return nil
@@ -273,6 +278,9 @@ func (p *GoogleProvider) RefreshSessionIfNeeded(ctx context.Context, s *sessions
273 return false, err
278 return false, err
281+ // TODO (@NickMeves) - Align Group authorization needs with other providers'
282+ // behavior in the `RefreshSession` case.
276 // re-check that the user is in the proper google group(s)
284 // re-check that the user is in the proper google group(s)
277 if !p.groupValidator(s) {
285 if !p.groupValidator(s) {
278 return false, fmt.Errorf("%s is no longer in the group(s)", s.Email)
286 return false, fmt.Errorf("%s is no longer in the group(s)", s.Email)