e200bd5 · typeable/oauth2-proxy

git.iko.soy/typeable/oauth2-proxy

Add comments to exported methods for providers package

commite200bd5c20a085021e92b11ea1cfb1087e6e35bd authorJoel Speed <Joel.speed@hotmail.co.uk> dateThu 20 Dec 2018, 10:37 (8 years ago) parenta65ceb2

11 files changed+48

compare with master

unifiedsplit

providers/azure.go+4 providers/facebook.go+4 providers/github.go+6 providers/gitlab.go+3 providers/google.go+5 providers/linkedin.go+4 providers/oidc.go+8 providers/provider_data.go+3 providers/provider_default.go+3 providers/providers.go+2 providers/session_state.go+6

providers/azure.go+4

@@ -11,11 +11,13 @@ import (

1111 "github.com/pusher/oauth2_proxy/api"

1212)

1313

14+// AzureProvider represents an Azure based Identity Provider

1415type AzureProvider struct {

1516 *ProviderData

1617 Tenant string

1718}

1819

20+// NewAzureProvider initiates a new AzureProvider

1921func NewAzureProvider(p *ProviderData) *AzureProvider {

2022 p.ProviderName = "Azure"

2123

@@ -40,6 +42,7 @@ func NewAzureProvider(p *ProviderData) *AzureProvider {

4042 return &AzureProvider{ProviderData: p}

4143}

4244

45+// Configure defaults the AzureProvider configuration options

4346func (p *AzureProvider) Configure(tenant string) {

4447 p.Tenant = tenant

4548 if tenant == "" {

@@ -84,6 +87,7 @@ func getEmailFromJSON(json *simplejson.Json) (string, error) {

8487 return email, err

8588}

8689

90+// GetEmailAddress returns the Account email address

8791func (p *AzureProvider) GetEmailAddress(s *SessionState) (string, error) {

8892 var email string

8993 var err error

providers/facebook.go+4

@@ -9,10 +9,12 @@ import (

99 "github.com/pusher/oauth2_proxy/api"

1010)

1111

12+// FacebookProvider represents an Facebook based Identity Provider

1213type FacebookProvider struct {

1314 *ProviderData

1415}

1516

17+// NewFacebookProvider initiates a new FacebookProvider

1618func NewFacebookProvider(p *ProviderData) *FacebookProvider {

1719 p.ProviderName = "Facebook"

1820 if p.LoginURL.String() == "" {

@@ -51,6 +53,7 @@ func getFacebookHeader(accessToken string) http.Header {

5153 return header

5254}

5355

56+// GetEmailAddress returns the Account email address

5457func (p *FacebookProvider) GetEmailAddress(s *SessionState) (string, error) {

5558 if s.AccessToken == "" {

5659 return "", errors.New("missing access token")

@@ -75,6 +78,7 @@ func (p *FacebookProvider) GetEmailAddress(s *SessionState) (string, error) {

7578 return r.Email, nil

7679}

7780

81+// ValidateSessionState validates the AccessToken

7882func (p *FacebookProvider) ValidateSessionState(s *SessionState) bool {

7983 return validateToken(p, s.AccessToken, getFacebookHeader(s.AccessToken))

8084}

providers/github.go+6

@@ -12,12 +12,14 @@ import (

1212 "strings"

1313)

1414

15+// GitHubProvider represents an GitHub based Identity Provider

1516type GitHubProvider struct {

1617 *ProviderData

1718 Org string

1819 Team string

1920}

2021

22+// NewGitHubProvider initiates a new GitHubProvider

2123func NewGitHubProvider(p *ProviderData) *GitHubProvider {

2224 p.ProviderName = "GitHub"

2325 if p.LoginURL == nil || p.LoginURL.String() == "" {

@@ -47,6 +49,8 @@ func NewGitHubProvider(p *ProviderData) *GitHubProvider {

4749 }

4850 return &GitHubProvider{ProviderData: p}

4951}

52+

53+// SetOrgTeam adds GitHub org reading parameters to the OAuth2 scope

5054func (p *GitHubProvider) SetOrgTeam(org, team string) {

5155 p.Org = org

5256 p.Team = team

@@ -194,6 +198,7 @@ func (p *GitHubProvider) hasOrgAndTeam(accessToken string) (bool, error) {

194198 return false, nil

195199}

196200

201+// GetEmailAddress returns the Account email address

197202func (p *GitHubProvider) GetEmailAddress(s *SessionState) (string, error) {

198203

199204 var emails []struct {

@@ -251,6 +256,7 @@ func (p *GitHubProvider) GetEmailAddress(s *SessionState) (string, error) {

251256 return "", nil

252257}

253258

259+// GetUserName returns the Account user name

254260func (p *GitHubProvider) GetUserName(s *SessionState) (string, error) {

255261 var user struct {

256262 Login string `json:"login"`

providers/gitlab.go+3

@@ -8,10 +8,12 @@ import (

88 "github.com/pusher/oauth2_proxy/api"

99)

1010

11+// GitLabProvider represents an GitLab based Identity Provider

1112type GitLabProvider struct {

1213 *ProviderData

1314}

1415

16+// NewGitLabProvider initiates a new GitLabProvider

1517func NewGitLabProvider(p *ProviderData) *GitLabProvider {

1618 p.ProviderName = "GitLab"

1719 if p.LoginURL == nil || p.LoginURL.String() == "" {

@@ -41,6 +43,7 @@ func NewGitLabProvider(p *ProviderData) *GitLabProvider {

4143 return &GitLabProvider{ProviderData: p}

4244}

4345

46+// GetEmailAddress returns the Account email address

4447func (p *GitLabProvider) GetEmailAddress(s *SessionState) (string, error) {

4548

4649 req, err := http.NewRequest("GET",

providers/google.go+5

@@ -20,6 +20,7 @@ import (

2020 "google.golang.org/api/googleapi"

2121)

2222

23+// GoogleProvider represents an Google based Identity Provider

2324type GoogleProvider struct {

2425 *ProviderData

2526 RedeemRefreshURL *url.URL

@@ -28,6 +29,7 @@ type GoogleProvider struct {

2829 GroupValidator func(string) bool

2930}

3031

32+// NewGoogleProvider initiates a new GoogleProvider

3133func NewGoogleProvider(p *ProviderData) *GoogleProvider {

3234 p.ProviderName = "Google"

3335 if p.LoginURL.String() == "" {

@@ -90,6 +92,7 @@ func emailFromIDToken(idToken string) (string, error) {

9092 return email.Email, nil

9193}

9294

95+// Redeem exchanges the OAuth2 authentication token for an ID token

9396func (p *GoogleProvider) Redeem(redirectURL, code string) (s *SessionState, err error) {

9497 if code == "" {

9598 err = errors.New("missing code")

@@ -249,6 +252,8 @@ func (p *GoogleProvider) ValidateGroup(email string) bool {

249252 return p.GroupValidator(email)

250253}

251254

255+// RefreshSessionIfNeeded checks if the session has expired and uses the

256+// RefreshToken to fetch a new ID token if required

252257func (p *GoogleProvider) RefreshSessionIfNeeded(s *SessionState) (bool, error) {

253258 if s == nil || s.ExpiresOn.After(time.Now()) || s.RefreshToken == "" {

254259 return false, nil

providers/linkedin.go+4

@@ -9,10 +9,12 @@ import (

99 "github.com/pusher/oauth2_proxy/api"

1010)

1111

12+// LinkedInProvider represents an LinkedIn based Identity Provider

1213type LinkedInProvider struct {

1314 *ProviderData

1415}

1516

17+// NewLinkedInProvider initiates a new LinkedInProvider

1618func NewLinkedInProvider(p *ProviderData) *LinkedInProvider {

1719 p.ProviderName = "LinkedIn"

1820 if p.LoginURL.String() == "" {

@@ -47,6 +49,7 @@ func getLinkedInHeader(accessToken string) http.Header {

4749 return header

4850}

4951

52+// GetEmailAddress returns the Account email address

5053func (p *LinkedInProvider) GetEmailAddress(s *SessionState) (string, error) {

5154 if s.AccessToken == "" {

5255 return "", errors.New("missing access token")

@@ -69,6 +72,7 @@ func (p *LinkedInProvider) GetEmailAddress(s *SessionState) (string, error) {

6972 return email, nil

7073}

7174

75+// ValidateSessionState validates the AccessToken

7276func (p *LinkedInProvider) ValidateSessionState(s *SessionState) bool {

7377 return validateToken(p, s.AccessToken, getLinkedInHeader(s.AccessToken))

7478}

providers/oidc.go+8

@@ -10,17 +10,20 @@ import (

1010 oidc "github.com/coreos/go-oidc"

1111)

1212

13+// OIDCProvider represents an OIDC based Identity Provider

1314type OIDCProvider struct {

1415 *ProviderData

1516

1617 Verifier *oidc.IDTokenVerifier

1718}

1819

20+// NewOIDCProvider initiates a new OIDCProvider

1921func NewOIDCProvider(p *ProviderData) *OIDCProvider {

2022 p.ProviderName = "OpenID Connect"

2123 return &OIDCProvider{ProviderData: p}

2224}

2325

26+// Redeem exchanges the OAuth2 authentication token for an ID token

2427func (p *OIDCProvider) Redeem(redirectURL, code string) (s *SessionState, err error) {

2528 ctx := context.Background()

2629 c := oauth2.Config{

@@ -73,6 +76,11 @@ func (p *OIDCProvider) Redeem(redirectURL, code string) (s *SessionState, err er

7376 return

7477}

7578

79+// RefreshSessionIfNeeded checks if the session has expired and uses the

80+// RefreshToken to fetch a new ID token if required

81+//

82+// WARNGING: This implementation is broken and does not check with the upstream

83+// OIDC provider before refreshing the session

7684func (p *OIDCProvider) RefreshSessionIfNeeded(s *SessionState) (bool, error) {

7785 if s == nil || s.ExpiresOn.After(time.Now()) || s.RefreshToken == "" {

7886 return false, nil

providers/provider_data.go+3

@@ -4,6 +4,8 @@ import (

44 "net/url"

55)

7+// ProviderData contains information required to configure all implementations

8+// of OAuth2 providers

79type ProviderData struct {

810 ProviderName string

911 ClientID string

@@ -17,4 +19,5 @@ type ProviderData struct {

1719 ApprovalPrompt string

1820}

1921

22+// Data returns the ProviderData

2023func (p *ProviderData) Data() *ProviderData { return p }

providers/provider_default.go+3

@@ -12,6 +12,7 @@ import (

1212 "github.com/pusher/oauth2_proxy/cookie"

1313)

1414

15+// Redeem provides a default implementation of the OAuth2 token redemption process

1516func (p *ProviderData) Redeem(redirectURL, code string) (s *SessionState, err error) {

1617 if code == "" {

1718 err = errors.New("missing code")

@@ -102,6 +103,7 @@ func (p *ProviderData) SessionFromCookie(v string, c *cookie.Cipher) (s *Session

102103 return DecodeSessionState(v, c)

103104}

104105

106+// GetEmailAddress returns the Account email address

105107func (p *ProviderData) GetEmailAddress(s *SessionState) (string, error) {

106108 return "", errors.New("not implemented")

107109}

@@ -117,6 +119,7 @@ func (p *ProviderData) ValidateGroup(email string) bool {

117119 return true

118120}

119121

122+// ValidateSessionState validates the AccessToken

120123func (p *ProviderData) ValidateSessionState(s *SessionState) bool {

121124 return validateToken(p, s.AccessToken, nil)

122125}

providers/providers.go+2

@@ -4,6 +4,7 @@ import (

44 "github.com/pusher/oauth2_proxy/cookie"

55)

7+// Provider represents an upstream identity provider implementation

78type Provider interface {

89 Data() *ProviderData

910 GetEmailAddress(*SessionState) (string, error)

@@ -17,6 +18,7 @@ type Provider interface {

1718 CookieForSession(*SessionState, *cookie.Cipher) (string, error)

1819}

1920

21+// New provides a new Provider based on the configured provider string

2022func New(provider string, p *ProviderData) Provider {

2123 switch provider {

2224 case "linkedin":

providers/session_state.go+6

@@ -9,6 +9,7 @@ import (

99 "github.com/pusher/oauth2_proxy/cookie"

1010)

1111

12+// SessionState is used to store information about the currently authenticated user session

1213type SessionState struct {

1314 AccessToken string

1415 ExpiresOn time.Time

@@ -17,6 +18,7 @@ type SessionState struct {

1718 User string

1819}

1920

21+// IsExpired checks whether the session has expired

2022func (s *SessionState) IsExpired() bool {

2123 if !s.ExpiresOn.IsZero() && s.ExpiresOn.Before(time.Now()) {

2224 return true

@@ -24,6 +26,7 @@ func (s *SessionState) IsExpired() bool {

2426 return false

2527}

2628

29+// String constructs a summary of the session state

2730func (s *SessionState) String() string {

2831 o := fmt.Sprintf("Session{%s", s.accountInfo())

2932 if s.AccessToken != "" {

@@ -38,6 +41,7 @@ func (s *SessionState) String() string {

3841 return o + "}"

3942}

4043

44+// EncodeSessionState returns string representation of the current session

4145func (s *SessionState) EncodeSessionState(c *cookie.Cipher) (string, error) {

4246 if c == nil || s.AccessToken == "" {

4347 return s.accountInfo(), nil

@@ -49,6 +53,7 @@ func (s *SessionState) accountInfo() string {

4953 return fmt.Sprintf("email:%s user:%s", s.Email, s.User)

5054}

5155

56+// EncryptedString encrypts the session state into a cookie string

5257func (s *SessionState) EncryptedString(c *cookie.Cipher) (string, error) {

5358 var err error

5459 if c == nil {

@@ -84,6 +89,7 @@ func decodeSessionStatePlain(v string) (s *SessionState, err error) {

8489 return &SessionState{User: user, Email: email}, nil

8590}

8691

92+// DecodeSessionState decodes the session cookie string into a SessionState

8793func DecodeSessionState(v string, c *cookie.Cipher) (s *SessionState, err error) {

8894 if c == nil {

8995 return decodeSessionStatePlain(v)