git.iko.soy/typeable/oauth2-proxy
on master help sign in
Convert allowlist validation test to Ginkgo
fa4ba5eNick Meves
CHANGELOG.md+3−3
compare with master
unifiedsplit
@@ -4,12 +4,12 @@
4
4
5## Important Notes
5## Important Notes
6
6
7−- [#575](https://github.com/oauth2-proxy/oauth2-proxy/pull/575) Sessions from v5.1.1 or earlier will no longer validate since they were not signed with SHA1.
8− - Sessions from v6.0.0 or later had a graceful conversion to SHA256 that resulted in no reauthentication
9− - Upgrading from v5.1.1 or earlier will result in a reauthentication
10- [#789](https://github.com/oauth2-proxy/oauth2-proxy/pull/789) `--skip-auth-route` is (almost) backwards compatible with `--skip-auth-regex`
7- [#789](https://github.com/oauth2-proxy/oauth2-proxy/pull/789) `--skip-auth-route` is (almost) backwards compatible with `--skip-auth-regex`
11 - We are marking `--skip-auth-regex` as DEPRECATED and will remove it in the next major version.
8 - We are marking `--skip-auth-regex` as DEPRECATED and will remove it in the next major version.
12 - If your regex contains an `=` and you want it for all methods, you will need to add a leading `=` (this is the area where `--skip-auth-regex` doesn't port perfectly)
9 - If your regex contains an `=` and you want it for all methods, you will need to add a leading `=` (this is the area where `--skip-auth-regex` doesn't port perfectly)
10+- [#575](https://github.com/oauth2-proxy/oauth2-proxy/pull/575) Sessions from v5.1.1 or earlier will no longer validate since they were not signed with SHA1.
11+ - Sessions from v6.0.0 or later had a graceful conversion to SHA256 that resulted in no reauthentication
12+ - Upgrading from v5.1.1 or earlier will result in a reauthentication
13- [#616](https://github.com/oauth2-proxy/oauth2-proxy/pull/616) Ensure you have configured oauth2-proxy to use the `groups` scope. The user may be logged out initially as they may not currently have the `groups` claim however after going back through login process wil be authenticated.
13- [#616](https://github.com/oauth2-proxy/oauth2-proxy/pull/616) Ensure you have configured oauth2-proxy to use the `groups` scope. The user may be logged out initially as they may not currently have the `groups` claim however after going back through login process wil be authenticated.
14
14
15## Breaking Changes
15## Breaking Changes
pkg/validation/allowlist_test.go+66−91
@@ -1,149 +1,124 @@
1package validation
1package validation
2
2
3import (
3import (
4− "testing"
5−
6 "github.com/oauth2-proxy/oauth2-proxy/pkg/apis/options"
4 "github.com/oauth2-proxy/oauth2-proxy/pkg/apis/options"
7− "github.com/stretchr/testify/assert"
5+ . "github.com/onsi/ginkgo"
6+ . "github.com/onsi/ginkgo/extensions/table"
7+ . "github.com/onsi/gomega"
8)
8)
9
9
10−func Test_validateAllowlists(t *testing.T) {
10+var _ = Describe("Allowlist", func() {
11− opts := &options.Options{
11+ type validateRoutesTableInput struct {
12− SkipAuthRoutes: []string{
12+ routes []string
13− "POST=/foo/bar",
13+ errStrings []string
14− "PUT=^/foo/bar$",
14+ }
15− },
15+
16− SkipAuthRegex: []string{"/foo/baz"},
16+ type validateRegexesTableInput struct {
17− TrustedIPs: []string{
17+ regexes []string
18− "10.32.0.1/32",
18+ errStrings []string
19− "43.36.201.0/24",
19+ }
20− },
20+
21+ type validateTrustedIPsTableInput struct {
22+ trustedIPs []string
23+ errStrings []string
21 }
24 }
22− assert.Equal(t, []string{}, validateAllowlists(opts))
23−}
24
25
25−func Test_validateRoutes(t *testing.T) {
26+ DescribeTable("validateRoutes",
26− testCases := map[string]struct {
27+ func(r *validateRoutesTableInput) {
27− Regexes []string
28+ opts := &options.Options{
28− Expected []string
29+ SkipAuthRoutes: r.routes,
30+ }
31+ Expect(validateRoutes(opts)).To(ConsistOf(r.errStrings))
29− }{
32+ },
30− "Valid regex routes": {
33+ Entry("Valid regex routes", &validateRoutesTableInput{
31− Regexes: []string{
34+ routes: []string{
32 "/foo",
35 "/foo",
33 "POST=/foo/bar",
36 "POST=/foo/bar",
34 "PUT=^/foo/bar$",
37 "PUT=^/foo/bar$",
35 "DELETE=/crazy/(?:regex)?/[^/]+/stuff$",
38 "DELETE=/crazy/(?:regex)?/[^/]+/stuff$",
36 },
39 },
37− Expected: []string{},
40+ errStrings: []string{},
38− },
41+ }),
39− "Bad regexes do not compile": {
42+ Entry("Bad regexes do not compile", &validateRoutesTableInput{
40− Regexes: []string{
43+ routes: []string{
41 "POST=/(foo",
44 "POST=/(foo",
42 "OPTIONS=/foo/bar)",
45 "OPTIONS=/foo/bar)",
43 "GET=^]/foo/bar[$",
46 "GET=^]/foo/bar[$",
44 "GET=^]/foo/bar[$",
47 "GET=^]/foo/bar[$",
45 },
48 },
46− Expected: []string{
49+ errStrings: []string{
47 "error compiling regex //(foo/: error parsing regexp: missing closing ): `/(foo`",
50 "error compiling regex //(foo/: error parsing regexp: missing closing ): `/(foo`",
48 "error compiling regex //foo/bar)/: error parsing regexp: unexpected ): `/foo/bar)`",
51 "error compiling regex //foo/bar)/: error parsing regexp: unexpected ): `/foo/bar)`",
49 "error compiling regex /^]/foo/bar[$/: error parsing regexp: missing closing ]: `[$`",
52 "error compiling regex /^]/foo/bar[$/: error parsing regexp: missing closing ]: `[$`",
50 "error compiling regex /^]/foo/bar[$/: error parsing regexp: missing closing ]: `[$`",
53 "error compiling regex /^]/foo/bar[$/: error parsing regexp: missing closing ]: `[$`",
51 },
54 },
52− },
55+ }),
53− }
56+ )
54
57
55− for testName, tc := range testCases {
58+ DescribeTable("validateRegexes",
56− t.Run(testName, func(t *testing.T) {
59+ func(r *validateRegexesTableInput) {
57 opts := &options.Options{
60 opts := &options.Options{
58− SkipAuthRoutes: tc.Regexes,
61+ SkipAuthRegex: r.regexes,
59 }
62 }
60− msgs := validateRoutes(opts)
63+ Expect(validateRegexes(opts)).To(ConsistOf(r.errStrings))
61− assert.Equal(t, tc.Expected, msgs)
62− })
63− }
64−}
65−
66−func Test_validateRegexes(t *testing.T) {
67− testCases := map[string]struct {
68− Regexes []string
69− Expected []string
70− }{
64+ },
71− "Valid regex routes": {
65+ Entry("Valid regex routes", &validateRegexesTableInput{
72− Regexes: []string{
66+ regexes: []string{
73 "/foo",
67 "/foo",
74 "/foo/bar",
68 "/foo/bar",
75 "^/foo/bar$",
69 "^/foo/bar$",
76 "/crazy/(?:regex)?/[^/]+/stuff$",
70 "/crazy/(?:regex)?/[^/]+/stuff$",
77 },
71 },
78− Expected: []string{},
72+ errStrings: []string{},
79− },
73+ }),
80− "Bad regexes do not compile": {
74+ Entry("Bad regexes do not compile", &validateRegexesTableInput{
81− Regexes: []string{
75+ regexes: []string{
82 "/(foo",
76 "/(foo",
83 "/foo/bar)",
77 "/foo/bar)",
84 "^]/foo/bar[$",
78 "^]/foo/bar[$",
85 "^]/foo/bar[$",
79 "^]/foo/bar[$",
86 },
80 },
87− Expected: []string{
81+ errStrings: []string{
88 "error compiling regex //(foo/: error parsing regexp: missing closing ): `/(foo`",
82 "error compiling regex //(foo/: error parsing regexp: missing closing ): `/(foo`",
89 "error compiling regex //foo/bar)/: error parsing regexp: unexpected ): `/foo/bar)`",
83 "error compiling regex //foo/bar)/: error parsing regexp: unexpected ): `/foo/bar)`",
90 "error compiling regex /^]/foo/bar[$/: error parsing regexp: missing closing ]: `[$`",
84 "error compiling regex /^]/foo/bar[$/: error parsing regexp: missing closing ]: `[$`",
91 "error compiling regex /^]/foo/bar[$/: error parsing regexp: missing closing ]: `[$`",
85 "error compiling regex /^]/foo/bar[$/: error parsing regexp: missing closing ]: `[$`",
92 },
86 },
93− },
87+ }),
94− }
88+ )
95
89
96− for testName, tc := range testCases {
90+ DescribeTable("validateTrustedIPs",
97− t.Run(testName, func(t *testing.T) {
91+ func(t *validateTrustedIPsTableInput) {
98 opts := &options.Options{
92 opts := &options.Options{
99− SkipAuthRegex: tc.Regexes,
93+ TrustedIPs: t.trustedIPs,
100 }
94 }
101− msgs := validateRegexes(opts)
95+ Expect(validateTrustedIPs(opts)).To(ConsistOf(t.errStrings))
102− assert.Equal(t, tc.Expected, msgs)
103− })
104− }
105−}
106−
107−func Test_validateTrustedIPs(t *testing.T) {
108− testCases := map[string]struct {
109− TrustedIPs []string
110− Expected []string
111− }{
96+ },
112− "Non-overlapping valid IPs": {
97+ Entry("Non-overlapping valid IPs", &validateTrustedIPsTableInput{
113− TrustedIPs: []string{
98+ trustedIPs: []string{
114 "127.0.0.1",
99 "127.0.0.1",
115 "10.32.0.1/32",
100 "10.32.0.1/32",
116 "43.36.201.0/24",
101 "43.36.201.0/24",
117 "::1",
102 "::1",
118 "2a12:105:ee7:9234:0:0:0:0/64",
103 "2a12:105:ee7:9234:0:0:0:0/64",
119 },
104 },
120− Expected: []string{},
105+ errStrings: []string{},
121− },
106+ }),
122− "Overlapping valid IPs": {
107+ Entry("Overlapping valid IPs", &validateTrustedIPsTableInput{
123− TrustedIPs: []string{
108+ trustedIPs: []string{
124 "135.180.78.199",
109 "135.180.78.199",
125 "135.180.78.199/32",
110 "135.180.78.199/32",
126 "d910:a5a1:16f8:ddf5:e5b9:5cef:a65e:41f4",
111 "d910:a5a1:16f8:ddf5:e5b9:5cef:a65e:41f4",
127 "d910:a5a1:16f8:ddf5:e5b9:5cef:a65e:41f4/128",
112 "d910:a5a1:16f8:ddf5:e5b9:5cef:a65e:41f4/128",
128 },
113 },
129− Expected: []string{},
114+ errStrings: []string{},
130− },
115+ }),
131− "Invalid IPs": {
116+ Entry("Invalid IPs", &validateTrustedIPsTableInput{
132− TrustedIPs: []string{"[::1]", "alkwlkbn/32"},
117+ trustedIPs: []string{"[::1]", "alkwlkbn/32"},
133− Expected: []string{
118+ errStrings: []string{
134 "trusted_ips[0] ([::1]) could not be recognized",
119 "trusted_ips[0] ([::1]) could not be recognized",
135 "trusted_ips[1] (alkwlkbn/32) could not be recognized",
120 "trusted_ips[1] (alkwlkbn/32) could not be recognized",
136 },
121 },
137− },
122+ }),
138− }
123+ )
139−
140− for testName, tc := range testCases {
141− t.Run(testName, func(t *testing.T) {
142− opts := &options.Options{
143− TrustedIPs: tc.TrustedIPs,
144− }
145− msgs := validateTrustedIPs(opts)
146− assert.Equal(t, tc.Expected, msgs)
147− })
124+})
148− }
149−}