From 2847c22a4cdc1b0d293a8bbef4e214824581e4e4 Mon Sep 17 00:00:00 2001 From: reesporte Date: Wed, 29 Dec 2021 11:06:58 -0600 Subject: [PATCH] linter things --- authn/authenticate.go | 46 +++++++++++++++++++---------- authn/authenticate_internal_test.go | 6 ++-- 2 files changed, 33 insertions(+), 19 deletions(-) diff --git a/authn/authenticate.go b/authn/authenticate.go index f4d1a8cb8..e1a51f5f6 100644 --- a/authn/authenticate.go +++ b/authn/authenticate.go @@ -1,4 +1,6 @@ // Copyright 2021 Molecula Corp. All rights reserved. + +// Package authn handles authentication package authn import ( @@ -17,6 +19,7 @@ import ( "golang.org/x/oauth2" ) +// Auth holds state and helper methods needed for authentication type Auth struct { logger logger.Logger cookieName string @@ -30,7 +33,8 @@ type Auth struct { oAuthConfig *oauth2.Config } -func NewAuth(logger logger.Logger, url string, scopes []string, authUrl, tokenUrl, groupEndpoint, logout, clientID, clientSecret, hashKey, blockKey string) (*Auth, error) { +// NewAuth instantiates and returns a new Auth struct +func NewAuth(logger logger.Logger, url string, scopes []string, authURL, tokenURL, groupEndpoint, logout, clientID, clientSecret, hashKey, blockKey string) (*Auth, error) { auth := &Auth{ logger: logger, cookieName: "molecula-chip", @@ -44,8 +48,8 @@ func NewAuth(logger logger.Logger, url string, scopes []string, authUrl, tokenUr ClientSecret: clientSecret, Scopes: scopes, Endpoint: oauth2.Endpoint{ - AuthURL: authUrl, - TokenURL: tokenUrl, + AuthURL: authURL, + TokenURL: tokenURL, }, }, } @@ -63,6 +67,7 @@ func NewAuth(logger logger.Logger, url string, scopes []string, authUrl, tokenUr return auth, nil } +// CookieValue holds the value of an authenticated user's cookie type CookieValue struct { UserID string UserName string @@ -70,22 +75,26 @@ type CookieValue struct { Token *oauth2.Token } -type Groups struct { - Groups []Group `json:"value"` -} - +// Group holds group information for an authenticated user type Group struct { UserID string GroupID string `json:"id"` GroupName string `json:"displayName"` } +// UserInfo holds user information for an authenticated user type UserInfo struct { UserID string `json:"userid"` UserName string `json:"username"` } -func (a *Auth) Authenticate(w http.ResponseWriter, r *http.Request) ([]Group, error) { +// Authenticate reads the authentication cookie from a request, returning the +// user's group memberships on success. If the cookie is not present or has expired, +// Authenticate redirects the user to sign in. If the cookie is within the +// refresh window of expiring, the cookie is refreshed, and the updated group +// membership is returned. +func (a *Auth) Authenticate(w http.ResponseWriter, r *http.Request) ([]Group, + error) { cookie, err := a.readCookie(w, r) if err != nil { http.Redirect(w, r, "/signin", http.StatusTemporaryRedirect) @@ -108,11 +117,14 @@ func (a *Auth) Authenticate(w http.ResponseWriter, r *http.Request) ([]Group, er } +// Login redirects a user to login to their configured oAuth login endpoint func (a *Auth) Login(w http.ResponseWriter, r *http.Request) { - authUrl := a.oAuthConfig.AuthCodeURL(a.oAuthConfig.Endpoint.AuthURL) - http.Redirect(w, r, authUrl, http.StatusTemporaryRedirect) + authURL := a.oAuthConfig.AuthCodeURL(a.oAuthConfig.Endpoint.AuthURL) + http.Redirect(w, r, authURL, http.StatusTemporaryRedirect) } +// Logout sets the molecula-chip cookie to an empty cookie and redirects the +// user to a configured "logged out" endpoint func (a *Auth) Logout(w http.ResponseWriter, r *http.Request) { newCookie := a.getEmptyCookie() http.SetCookie(w, newCookie) @@ -120,7 +132,8 @@ func (a *Auth) Logout(w http.ResponseWriter, r *http.Request) { http.Redirect(w, r, redirect, http.StatusTemporaryRedirect) } -// Gets user information from dP and sets a secure cookie +// Redirect handles the oAuth /redirect endpoint. It gets user information from +// the identity provider and sets a secure cookie holding the user information. func (a *Auth) Redirect(w http.ResponseWriter, r *http.Request) { code := r.FormValue("code") token, err := a.getToken(code) @@ -139,6 +152,7 @@ func (a *Auth) Redirect(w http.ResponseWriter, r *http.Request) { http.Redirect(w, r, "/", http.StatusTemporaryRedirect) } +// GetUserInfo gets and returns user info from a request func (a *Auth) GetUserInfo(w http.ResponseWriter, r *http.Request) *UserInfo { var resp UserInfo cookie, err := a.readCookie(w, r) @@ -149,7 +163,6 @@ func (a *Auth) GetUserInfo(w http.ResponseWriter, r *http.Request) *UserInfo { resp.UserID = cookie.UserID resp.UserName = cookie.UserName return &resp - } func (a *Auth) getToken(code string) (*oauth2.Token, error) { @@ -182,13 +195,13 @@ func (a *Auth) newCookieValue(token *oauth2.Token) (*CookieValue, error) { return &CookieValue{ UserID: claims["oid"].(string), UserName: claims["name"].(string), - GroupMembership: groups.Groups, + GroupMembership: groups, Token: token, }, nil } -func (a *Auth) getGroupMembership(token *oauth2.Token) (Groups, error) { - var groups Groups +func (a *Auth) getGroupMembership(token *oauth2.Token) ([]Group, error) { + var groups []Group var bearer = fmt.Sprintf("Bearer %s", token.AccessToken) req, err := http.NewRequest("GET", a.groupEndpoint, nil) if err != nil { @@ -253,7 +266,7 @@ func (a *Auth) setCookie(w http.ResponseWriter, cookie *CookieValue) error { func (a *Auth) refreshToken(w http.ResponseWriter, cookie *CookieValue) error { if cookie.Token.RefreshToken == "" { - return errors.New("no refresh token found, check auth scopes to see if refresh tokens are being provided by your IdP.") + return errors.New("no refresh token found, check auth scopes to see if refresh tokens are being provided by your IdP") } tokenSource := a.oAuthConfig.TokenSource(context.Background(), cookie.Token) newToken, err := tokenSource.Token() @@ -293,4 +306,5 @@ func (a *Auth) getEmptyCookie() *http.Cookie { HttpOnly: true, SameSite: http.SameSiteStrictMode, } + } diff --git a/authn/authenticate_internal_test.go b/authn/authenticate_internal_test.go index 8df8c3b03..8f1821413 100644 --- a/authn/authenticate_internal_test.go +++ b/authn/authenticate_internal_test.go @@ -13,7 +13,7 @@ import ( func TestAuth(t *testing.T) { var ( - ClientId = "e9088663-eb08-41d7-8f65-efb5f54bbb71" + ClientID = "e9088663-eb08-41d7-8f65-efb5f54bbb71" ClientSecret = "DEADBEEFDEADBEEFDEADBEEFDEADBEEFDEADBEEFDEADBEEFDEADBEEFDEADBEEF" AuthorizeURL = "https://login.microsoftonline.com/4a137d66-d161-4ae4-b1e6-07e9920874b8/oauth2/v2.0/authorize" TokenURL = "https://login.microsoftonline.com/4a137d66-d161-4ae4-b1e6-07e9920874b8/oauth2/v2.0/token" @@ -32,7 +32,7 @@ func TestAuth(t *testing.T) { TokenURL, GroupEndpointURL, LogoutURL, - ClientId, + ClientID, ClientSecret, Key, Key, @@ -92,7 +92,7 @@ func TestAuth(t *testing.T) { TokenURL, GroupEndpointURL, LogoutURL, - ClientId, + ClientID, ClientSecret, Key, ShortKey,