add better error messaging for if the test is empty

authn/authenticate.go

@@ -145,6 +145,10 @@ func (a *Auth) Authenticate(ctx context.Context, bearer string) (*UserInfo, erro
 		a.tokenCache[bearer] = cachedToken{time.Now(), &t}
 	}
 
+	if len(bearer) == 0 {
+		return nil, fmt.Errorf("bearer token is empty")
+	}
+
 	// NOTE: we are using ParseUnverified here because the IDP validates the
 	// token's signature when we get the user's groups, we just need to make
 	// sure it's not expired and is well-formed

authn/authenticate_internal_test.go

@@ -139,6 +139,7 @@ func TestAuthenticate(t *testing.T) {
 		refresh      bool
 		errOnRefresh bool
 		malformed    bool
+		empty        bool
 		groups       []Group
 		err          error
 	}{
@@ -158,7 +159,11 @@ func TestAuthenticate(t *testing.T) {
 			malformed: true,
 			err:       fmt.Errorf("parsing bearer token: token contains an invalid number of segments"),
 		},
-
+		{
+			name:  "Empty",
+			empty: true,
+			err:   fmt.Errorf("bearer token is empty"),
+		},
 		{
 			name:  "ExpiredTokenNoRefresh",
 			uid:   "42",
@@ -207,7 +212,7 @@ func TestAuthenticate(t *testing.T) {
 			a := NewTestAuth(t)
 			token := ""
 			var err error
-			if !test.malformed {
+			if !test.malformed && !test.empty {
 				tkn := jwt.New(jwt.SigningMethodHS256)
 				claims := tkn.Claims.(jwt.MapClaims)
 				claims["oid"] = test.uid
@@ -219,7 +224,7 @@ func TestAuthenticate(t *testing.T) {
 				if err != nil {
 					t.Fatalf("unexpected error when signing token %v", err)
 				}
-			} else {
+			} else if !test.empty {
 				token = "asdfasdfasdfasdF"
 			}
 			if len(test.groups) > 0 {