mirrors/pinniped
1
0
Fork 0
mirror of https://github.com/vmware-tanzu/pinniped.git synced 2026-09-20 06:54:20 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

upgrade linter and fix/ignore all new lint warnings

Browse Source
This commit is contained in:
Ryan Richard
2026-03-27 10:08:17 -07:00
parent 6accdc0a7e
commit 5f38bc05c4
49 changed files with 184 additions and 75 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/controller/apicerts/apiservice_updater_test.go
+1
View File
@@ -146,6 +146,7 @@ func TestAPIServiceUpdaterControllerSync(t *testing.T) {
it.Before(func() {
r = require.New(t)
//nolint:gosec // cancelContextCancelFunc is called in the After()
cancelContext, cancelContextCancelFunc = context.WithCancel(context.Background())
kubeInformerClient = kubefake.NewClientset()
internal/controller/apicerts/certs_manager_test.go
+2 -1
View File
@@ -1,4 +1,4 @@
// Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
// Copyright 2020-2026 the Pinniped contributors. All Rights Reserved.
// SPDX-License-Identifier: Apache-2.0
package apicerts
@@ -168,6 +168,7 @@ func TestManagerControllerSync(t *testing.T) {
it.Before(func() {
r = require.New(t)
//nolint:gosec // cancelContextCancelFunc is called in the After()
cancelContext, cancelContextCancelFunc = context.WithCancel(context.Background())
kubeInformerClient = kubefake.NewClientset()
internal/controller/apicerts/certs_observer_test.go
+2 -1
View File
@@ -1,4 +1,4 @@
// Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
// Copyright 2020-2026 the Pinniped contributors. All Rights Reserved.
// SPDX-License-Identifier: Apache-2.0
package apicerts
@@ -142,6 +142,7 @@ func TestObserverControllerSync(t *testing.T) {
it.Before(func() {
r = require.New(t)
//nolint:gosec // cancelContextCancelFunc is called in the After()
cancelContext, cancelContextCancelFunc = context.WithCancel(context.Background())
kubeInformerClient = kubefake.NewClientset()
internal/controller/impersonatorconfig/impersonator_config_test.go
+14 -1
View File
@@ -342,6 +342,7 @@ func TestImpersonatorConfigControllerSync(t *testing.T) {
return nil, nil // no cached TLS certs
},
ClientAuth: tls.RequestClientCert,
//nolint:gosec // not worried about session resumption in this test
VerifyPeerCertificate: func(rawCerts [][]byte, _ [][]*x509.Certificate) error {
// Docs say that this will always be called in tls.RequestClientCert mode
// and that the second parameter will always be nil in that case.
@@ -486,7 +487,7 @@ func TestImpersonatorConfigControllerSync(t *testing.T) {
rootCAs := x509.NewCertPool()
rootCAs.AppendCertsFromPEM(caCrt)
tr = &http.Transport{
TLSClientConfig: &tls.Config{ //nolint:gosec // not concerned with TLS MinVersion here
TLSClientConfig: &tls.Config{
// Server's TLS serving cert CA
RootCAs: rootCAs,
// Client cert which is supposed to work against the server's dynamic CAContentProvider
@@ -1127,6 +1128,8 @@ func TestImpersonatorConfigControllerSync(t *testing.T) {
it.Before(func() {
r = require.New(t)
queue = &testQueue{}
//nolint:gosec // cancelContextCancelFunc is called in the After()
cancelContext, cancelContextCancelFunc = context.WithCancel(context.Background())
//nolint:staticcheck // our codegen does not yet generate a NewClientset() function
@@ -1986,6 +1989,7 @@ func TestImpersonatorConfigControllerSync(t *testing.T) {
r.Len(kubeAPIClient.Actions(), 3)
requireNodesListed(kubeAPIClient.Actions()[0])
lbService := requireLoadBalancerWasCreated(kubeAPIClient.Actions()[1])
//nolint:gosec // no credentials here
r.Equal(lbService.Annotations, map[string]string{
"some-annotation-key": "some-annotation-value",
"credentialissuer.pinniped.dev/annotation-keys": `["some-annotation-key"]`,
@@ -2783,6 +2787,7 @@ func TestImpersonatorConfigControllerSync(t *testing.T) {
r.Len(kubeAPIClient.Actions(), 4)
requireNodesListed(kubeAPIClient.Actions()[0])
lbService := requireLoadBalancerWasCreated(kubeAPIClient.Actions()[1])
//nolint:gosec // no credentials here
r.Equal(map[string]string{"credentialissuer.pinniped.dev/label-keys": `["app","other-key"]`}, lbService.Annotations)
ca := requireCASecretWasCreated(kubeAPIClient.Actions()[2])
requireTLSSecretWasCreated(kubeAPIClient.Actions()[3], ca)
@@ -2823,6 +2828,7 @@ func TestImpersonatorConfigControllerSync(t *testing.T) {
wantLabels := maps.Clone(labels)
wantLabels["my-label-key"] = "my-label-from-unrelated-controller-val"
r.Equal(wantLabels, lbService.Labels)
//nolint:gosec // no credentials here
r.Equal(map[string]string{
// Now the CredentialIssuer annotations should be merged on the load balancer.
// In the unlikely case where keys conflict, the CredentialIssuer value overwrites the other value.
@@ -2864,6 +2870,7 @@ func TestImpersonatorConfigControllerSync(t *testing.T) {
r.Len(kubeAPIClient.Actions(), 4)
requireNodesListed(kubeAPIClient.Actions()[0])
clusterIPService := requireClusterIPWasCreated(kubeAPIClient.Actions()[1])
//nolint:gosec // no credentials here
r.Equal(map[string]string{"credentialissuer.pinniped.dev/label-keys": `["app","other-key"]`}, clusterIPService.Annotations)
ca := requireCASecretWasCreated(kubeAPIClient.Actions()[2])
requireTLSSecretWasCreated(kubeAPIClient.Actions()[3], ca)
@@ -2904,6 +2911,7 @@ func TestImpersonatorConfigControllerSync(t *testing.T) {
wantLabels := maps.Clone(labels)
wantLabels["my-label-key"] = "my-label-from-unrelated-controller-val"
r.Equal(wantLabels, clusterIPService.Labels)
//nolint:gosec // no credentials here
r.Equal(map[string]string{
// Now the CredentialIssuer annotations should be merged on the load balancer.
// In the unlikely case where keys conflict, the CredentialIssuer value overwrites the other value.
@@ -2950,6 +2958,7 @@ func TestImpersonatorConfigControllerSync(t *testing.T) {
r.Len(kubeAPIClient.Actions(), 4)
requireNodesListed(kubeAPIClient.Actions()[0])
lbService := requireLoadBalancerWasCreated(kubeAPIClient.Actions()[1])
//nolint:gosec // no credentials here
r.Equal(map[string]string{
"my-initial-annotation1-key": "my-initial-annotation1-val",
"my-initial-annotation2-key": "my-initial-annotation2-val",
@@ -2994,6 +3003,7 @@ func TestImpersonatorConfigControllerSync(t *testing.T) {
r.Len(kubeAPIClient.Actions(), 5) // one more item to update the loadbalancer
lbService = requireLoadBalancerWasUpdated(kubeAPIClient.Actions()[4])
r.Equal(labels, lbService.Labels)
//nolint:gosec // no credentials here
r.Equal(map[string]string{
// Now the CredentialIssuer annotations should be merged on the load balancer.
// Since the user removed the "my-initial-annotation2-key" key from the CredentialIssuer spec,
@@ -3025,6 +3035,7 @@ func TestImpersonatorConfigControllerSync(t *testing.T) {
r.Len(kubeAPIClient.Actions(), 6) // one more item to update the loadbalancer
lbService = requireLoadBalancerWasUpdated(kubeAPIClient.Actions()[5])
r.Equal(labels, lbService.Labels)
//nolint:gosec // no credentials here
r.Equal(map[string]string{
// Since the user removed all annotations from the CredentialIssuer spec,
// they should all be removed from the Service, along with the special bookkeeping annotation too.
@@ -3076,6 +3087,7 @@ func TestImpersonatorConfigControllerSync(t *testing.T) {
requireNodesListed(kubeAPIClient.Actions()[0])
lbService := requireLoadBalancerWasUpdated(kubeAPIClient.Actions()[1])
r.Equal(labels, lbService.Labels)
//nolint:gosec // no credentials here
r.Equal(map[string]string{
"some-annotation": "annotation-value",
"credentialissuer.pinniped.dev/annotation-keys": `["some-annotation"]`,
@@ -3115,6 +3127,7 @@ func TestImpersonatorConfigControllerSync(t *testing.T) {
r.Len(kubeAPIClient.Actions(), 4)
requireNodesListed(kubeAPIClient.Actions()[0])
lbService := requireLoadBalancerWasCreated(kubeAPIClient.Actions()[1])
//nolint:gosec // no credentials here
r.Equal(map[string]string{"credentialissuer.pinniped.dev/label-keys": `["app","other-key"]`}, lbService.Annotations)
r.Equal("", lbService.Spec.LoadBalancerIP)
ca := requireCASecretWasCreated(kubeAPIClient.Actions()[2])
internal/controller/supervisorconfig/githubupstreamwatcher/github_upstream_watcher_test.go
+6 -1
View File
@@ -1,4 +1,4 @@
// Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
// Copyright 2020-2026 the Pinniped contributors. All Rights Reserved.
// SPDX-License-Identifier: Apache-2.0
package githubupstreamwatcher
@@ -592,6 +592,7 @@ func TestController(t *testing.T) {
OAuth2Config: &oauth2.Config{
ClientID: "some-client-id",
ClientSecret: "some-client-secret",
//nolint:gosec // no credentials here
Endpoint: oauth2.Endpoint{
AuthURL: "https://github.com/login/oauth/authorize",
DeviceAuthURL: "", // not used
@@ -667,6 +668,7 @@ func TestController(t *testing.T) {
OAuth2Config: &oauth2.Config{
ClientID: "some-client-id",
ClientSecret: "some-client-secret",
//nolint:gosec // no credentials here
Endpoint: oauth2.Endpoint{
AuthURL: "https://github.com/login/oauth/authorize",
DeviceAuthURL: "", // not used
@@ -742,6 +744,7 @@ func TestController(t *testing.T) {
OAuth2Config: &oauth2.Config{
ClientID: "some-client-id",
ClientSecret: "some-client-secret",
//nolint:gosec // no credentials here
Endpoint: oauth2.Endpoint{
AuthURL: "https://github.com/login/oauth/authorize",
DeviceAuthURL: "", // not used
@@ -817,6 +820,7 @@ func TestController(t *testing.T) {
OAuth2Config: &oauth2.Config{
ClientID: "some-client-id",
ClientSecret: "some-client-secret",
//nolint:gosec // no credentials here
Endpoint: oauth2.Endpoint{
AuthURL: "https://github.com/login/oauth/authorize",
DeviceAuthURL: "", // not used
@@ -892,6 +896,7 @@ func TestController(t *testing.T) {
OAuth2Config: &oauth2.Config{
ClientID: "some-client-id",
ClientSecret: "some-client-secret",
//nolint:gosec // no credentials here
Endpoint: oauth2.Endpoint{
AuthURL: "https://github.com/login/oauth/authorize",
DeviceAuthURL: "", // not used
internal/controller/supervisorconfig/jwks_observer_test.go
+2 -1
View File
@@ -1,4 +1,4 @@
// Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
// Copyright 2020-2026 the Pinniped contributors. All Rights Reserved.
// SPDX-License-Identifier: Apache-2.0
package supervisorconfig
@@ -165,6 +165,7 @@ func TestJWKSObserverControllerSync(t *testing.T) {
it.Before(func() {
r = require.New(t)
//nolint:gosec // cancelContextCancelFunc is called in the After()
cancelContext, cancelContextCancelFunc = context.WithCancel(context.Background())
kubeInformerClient = kubefake.NewClientset()
internal/controller/supervisorconfig/oidcupstreamwatcher/oidc_upstream_watcher_test.go
+13 -3
View File
@@ -1,4 +1,4 @@
// Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
// Copyright 2020-2026 the Pinniped contributors. All Rights Reserved.
// SPDX-License-Identifier: Apache-2.0
package oidcupstreamwatcher
@@ -230,8 +230,8 @@ func TestOIDCUpstreamWatcherControllerSync(t *testing.T) {
testNamespace = "test-namespace"
testName = "test-name"
testSecretName = "test-client-secret"
testAdditionalScopes = []string{"scope1", "scope2", "scope3"}
testExpectedScopes = []string{"openid", "scope1", "scope2", "scope3"}
testAdditionalScopes = []string{"scope1", "scope2", "scope3"} //nolint:prealloc
testExpectedScopes = []string{"openid", "scope1", "scope2", "scope3"} //nolint:prealloc
testDefaultExpectedScopes = []string{"openid", "offline_access", "email", "profile"}
testAdditionalParams = []idpv1alpha1.Parameter{{Name: "prompt", Value: "consent"}, {Name: "foo", Value: "bar"}}
testExpectedAdditionalParams = map[string]string{"prompt": "consent", "foo": "bar"}
@@ -1919,6 +1919,7 @@ func newTestIssuer(t *testing.T) (string, string) {
// At the root of the server, serve an issuer with a valid discovery response.
mux.HandleFunc("/.well-known/openid-configuration", func(w http.ResponseWriter, r *http.Request) {
w.Header().Set("content-type", "application/json")
//nolint:gosec // no credentials here
_ = json.NewEncoder(w).Encode(&providerJSON{
Issuer: server.URL,
AuthURL: "https://example.com/authorize",
@@ -1931,6 +1932,7 @@ func newTestIssuer(t *testing.T) (string, string) {
// At "/valid-without-revocation", serve an issuer with a valid discovery response which does not have a revocation endpoint.
mux.HandleFunc("/valid-without-revocation/.well-known/openid-configuration", func(w http.ResponseWriter, r *http.Request) {
w.Header().Set("content-type", "application/json")
//nolint:gosec // no credentials here
_ = json.NewEncoder(w).Encode(&providerJSON{
Issuer: server.URL + "/valid-without-revocation",
AuthURL: "https://example.com/authorize",
@@ -1943,6 +1945,7 @@ func newTestIssuer(t *testing.T) (string, string) {
// At "/valid-without-userinfo", serve an issuer with a valid discovery response which does not have a userinfo endpoint.
mux.HandleFunc("/valid-without-userinfo/.well-known/openid-configuration", func(w http.ResponseWriter, r *http.Request) {
w.Header().Set("content-type", "application/json")
//nolint:gosec // no credentials here
_ = json.NewEncoder(w).Encode(&providerJSON{
Issuer: server.URL + "/valid-without-userinfo",
AuthURL: "https://example.com/authorize",
@@ -1955,6 +1958,7 @@ func newTestIssuer(t *testing.T) (string, string) {
// At "/invalid", serve an issuer that returns an invalid authorization URL (not parseable).
mux.HandleFunc("/invalid/.well-known/openid-configuration", func(w http.ResponseWriter, r *http.Request) {
w.Header().Set("content-type", "application/json")
//nolint:gosec // no credentials here
_ = json.NewEncoder(w).Encode(&providerJSON{
Issuer: server.URL + "/invalid",
AuthURL: "%",
@@ -1965,6 +1969,7 @@ func newTestIssuer(t *testing.T) (string, string) {
// At "/invalid-revocation-url", serve an issuer that returns an invalid revocation URL (not parseable).
mux.HandleFunc("/invalid-revocation-url/.well-known/openid-configuration", func(w http.ResponseWriter, r *http.Request) {
w.Header().Set("content-type", "application/json")
//nolint:gosec // no credentials here
_ = json.NewEncoder(w).Encode(&providerJSON{
Issuer: server.URL + "/invalid-revocation-url",
AuthURL: "https://example.com/authorize",
@@ -1976,6 +1981,7 @@ func newTestIssuer(t *testing.T) (string, string) {
// At "/insecure", serve an issuer that returns an insecure authorization URL (not https://).
mux.HandleFunc("/insecure/.well-known/openid-configuration", func(w http.ResponseWriter, r *http.Request) {
w.Header().Set("content-type", "application/json")
//nolint:gosec // no credentials here
_ = json.NewEncoder(w).Encode(&providerJSON{
Issuer: server.URL + "/insecure",
AuthURL: "http://example.com/authorize",
@@ -1986,6 +1992,7 @@ func newTestIssuer(t *testing.T) (string, string) {
// At "/insecure-revocation-url", serve an issuer that returns an insecure revocation URL (not https://).
mux.HandleFunc("/insecure-revocation-url/.well-known/openid-configuration", func(w http.ResponseWriter, r *http.Request) {
w.Header().Set("content-type", "application/json")
//nolint:gosec // no credentials here
_ = json.NewEncoder(w).Encode(&providerJSON{
Issuer: server.URL + "/insecure-revocation-url",
AuthURL: "https://example.com/authorize",
@@ -1997,6 +2004,7 @@ func newTestIssuer(t *testing.T) (string, string) {
// At "/insecure-token-url", serve an issuer that returns an insecure token URL (not https://).
mux.HandleFunc("/insecure-token-url/.well-known/openid-configuration", func(w http.ResponseWriter, r *http.Request) {
w.Header().Set("content-type", "application/json")
//nolint:gosec // no credentials here
_ = json.NewEncoder(w).Encode(&providerJSON{
Issuer: server.URL + "/insecure-token-url",
AuthURL: "https://example.com/authorize",
@@ -2019,6 +2027,7 @@ func newTestIssuer(t *testing.T) (string, string) {
// At "/missing-auth-url", serve an issuer that returns no auth URL, which is required by the spec.
mux.HandleFunc("/missing-auth-url/.well-known/openid-configuration", func(w http.ResponseWriter, r *http.Request) {
w.Header().Set("content-type", "application/json")
//nolint:gosec // no credentials here
_ = json.NewEncoder(w).Encode(&providerJSON{
Issuer: server.URL + "/missing-auth-url",
RevocationURL: "https://example.com/revoke",
@@ -2034,6 +2043,7 @@ func newTestIssuer(t *testing.T) (string, string) {
// valid case in=/ out=/
mux.HandleFunc("/ends-with-slash/.well-known/openid-configuration", func(w http.ResponseWriter, r *http.Request) {
w.Header().Set("content-type", "application/json")
//nolint:gosec // no credentials here
_ = json.NewEncoder(w).Encode(&providerJSON{
Issuer: server.URL + "/ends-with-slash/",
AuthURL: "https://example.com/authorize",
internal/controller/supervisorconfig/tls_cert_observer_test.go
+4 -2
View File
@@ -1,4 +1,4 @@
// Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
// Copyright 2020-2026 the Pinniped contributors. All Rights Reserved.
// SPDX-License-Identifier: Apache-2.0
package supervisorconfig
@@ -178,6 +178,7 @@ func TestTLSCertObserverControllerSync(t *testing.T) {
it.Before(func() {
r = require.New(t)
//nolint:gosec // cancelContextCancelFunc is called in the After()
cancelContext, cancelContextCancelFunc = context.WithCancel(context.Background())
kubeInformerClient = kubefake.NewClientset()
@@ -244,7 +245,8 @@ func TestTLSCertObserverControllerSync(t *testing.T) {
},
Spec: supervisorconfigv1alpha1.FederationDomainSpec{
Issuer: "https://bad-secret-issuer.com",
TLS: &supervisorconfigv1alpha1.FederationDomainTLSSpec{SecretName: "bad-tls-secret-name"},
//nolint:gosec // not a real credential
TLS: &supervisorconfigv1alpha1.FederationDomainTLSSpec{SecretName: "bad-tls-secret-name"},
},
}
// Also add one with a URL that cannot be parsed to make sure that the controller is not confused by invalid URLs.
internal/controller/supervisorstorage/garbage_collector_test.go
+24 -1
View File
@@ -1,4 +1,4 @@
// Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
// Copyright 2020-2026 the Pinniped contributors. All Rights Reserved.
// SPDX-License-Identifier: Apache-2.0
package supervisorstorage
@@ -177,6 +177,7 @@ func TestGarbageCollectorControllerSync(t *testing.T) {
it.Before(func() {
r = require.New(t)
//nolint:gosec // cancelContextCancelFunc is called in the After()
cancelContext, cancelContextCancelFunc = context.WithCancel(context.Background())
kubeInformerClient = kubefake.NewClientset()
@@ -287,6 +288,7 @@ func TestGarbageCollectorControllerSync(t *testing.T) {
ProviderUID: "upstream-oidc-provider-uid",
ProviderName: "upstream-oidc-provider-name",
ProviderType: psession.ProviderTypeOIDC,
//nolint:gosec // not a real credential
OIDC: &psession.OIDCSessionData{
UpstreamRefreshToken: "fake-upstream-refresh-token",
},
@@ -332,6 +334,7 @@ func TestGarbageCollectorControllerSync(t *testing.T) {
ProviderUID: "upstream-oidc-provider-uid",
ProviderName: "upstream-oidc-provider-name",
ProviderType: psession.ProviderTypeOIDC,
//nolint:gosec // not a real credential
OIDC: &psession.OIDCSessionData{
UpstreamRefreshToken: "other-fake-upstream-refresh-token",
},
@@ -379,6 +382,7 @@ func TestGarbageCollectorControllerSync(t *testing.T) {
// The upstream refresh token is only revoked for the active authcode session.
idpListerBuilder.RequireExactlyOneCallToRevokeToken(t,
"upstream-oidc-provider-name",
//nolint:gosec // not a real credential
&oidctestutil.RevokeTokenArgs{
Ctx: syncContext.Context,
Token: "fake-upstream-refresh-token",
@@ -432,6 +436,7 @@ func TestGarbageCollectorControllerSync(t *testing.T) {
ProviderUID: "upstream-oidc-provider-uid",
ProviderName: "upstream-oidc-provider-name",
ProviderType: psession.ProviderTypeOIDC,
//nolint:gosec // not a real credential
OIDC: &psession.OIDCSessionData{
UpstreamAccessToken: "fake-upstream-access-token",
},
@@ -477,6 +482,7 @@ func TestGarbageCollectorControllerSync(t *testing.T) {
ProviderUID: "upstream-oidc-provider-uid",
ProviderName: "upstream-oidc-provider-name",
ProviderType: psession.ProviderTypeOIDC,
//nolint:gosec // not a real credential
OIDC: &psession.OIDCSessionData{
UpstreamAccessToken: "other-fake-upstream-access-token",
},
@@ -524,6 +530,7 @@ func TestGarbageCollectorControllerSync(t *testing.T) {
// The upstream refresh token is only revoked for the active authcode session.
idpListerBuilder.RequireExactlyOneCallToRevokeToken(t,
"upstream-oidc-provider-name",
//nolint:gosec // not a real credential
&oidctestutil.RevokeTokenArgs{
Ctx: syncContext.Context,
Token: "fake-upstream-access-token",
@@ -577,6 +584,7 @@ func TestGarbageCollectorControllerSync(t *testing.T) {
ProviderUID: "upstream-oidc-provider-uid",
ProviderName: "upstream-oidc-provider-name",
ProviderType: psession.ProviderTypeOIDC,
//nolint:gosec // not a real credential
OIDC: &psession.OIDCSessionData{
UpstreamRefreshToken: "fake-upstream-refresh-token",
},
@@ -646,6 +654,7 @@ func TestGarbageCollectorControllerSync(t *testing.T) {
ProviderUID: "upstream-oidc-provider-uid",
ProviderName: "upstream-oidc-provider-name-will-not-match",
ProviderType: psession.ProviderTypeOIDC,
//nolint:gosec // not a real credential
OIDC: &psession.OIDCSessionData{
UpstreamRefreshToken: "fake-upstream-refresh-token",
},
@@ -726,6 +735,7 @@ func TestGarbageCollectorControllerSync(t *testing.T) {
ProviderUID: "upstream-oidc-provider-uid-will-not-match",
ProviderName: "upstream-oidc-provider-name",
ProviderType: psession.ProviderTypeOIDC,
//nolint:gosec // not a real credential
OIDC: &psession.OIDCSessionData{
UpstreamRefreshToken: "fake-upstream-refresh-token",
},
@@ -806,6 +816,7 @@ func TestGarbageCollectorControllerSync(t *testing.T) {
ProviderUID: "upstream-oidc-provider-uid",
ProviderName: "upstream-oidc-provider-name",
ProviderType: psession.ProviderTypeOIDC,
//nolint:gosec // not a real credential
OIDC: &psession.OIDCSessionData{
UpstreamRefreshToken: "fake-upstream-refresh-token",
},
@@ -855,6 +866,7 @@ func TestGarbageCollectorControllerSync(t *testing.T) {
// Tried to revoke it, although this revocation will fail.
idpListerBuilder.RequireExactlyOneCallToRevokeToken(t,
"upstream-oidc-provider-name",
//nolint:gosec // not a real credential
&oidctestutil.RevokeTokenArgs{
Ctx: syncContext.Context,
Token: "fake-upstream-refresh-token",
@@ -880,6 +892,7 @@ func TestGarbageCollectorControllerSync(t *testing.T) {
// Tried to revoke it, although this revocation will fail.
idpListerBuilder.RequireExactlyOneCallToRevokeToken(t,
"upstream-oidc-provider-name",
//nolint:gosec // not a real credential
&oidctestutil.RevokeTokenArgs{
Ctx: syncContext.Context,
Token: "fake-upstream-refresh-token",
@@ -920,6 +933,7 @@ func TestGarbageCollectorControllerSync(t *testing.T) {
ProviderUID: "upstream-oidc-provider-uid",
ProviderName: "upstream-oidc-provider-name",
ProviderType: psession.ProviderTypeOIDC,
//nolint:gosec // not a real credential
OIDC: &psession.OIDCSessionData{
UpstreamRefreshToken: "fake-upstream-refresh-token",
},
@@ -968,6 +982,7 @@ func TestGarbageCollectorControllerSync(t *testing.T) {
// Tried to revoke it, although this revocation will fail.
idpListerBuilder.RequireExactlyOneCallToRevokeToken(t,
"upstream-oidc-provider-name",
//nolint:gosec // not a real credential
&oidctestutil.RevokeTokenArgs{
Ctx: syncContext.Context,
Token: "fake-upstream-refresh-token",
@@ -1053,6 +1068,7 @@ func TestGarbageCollectorControllerSync(t *testing.T) {
ProviderUID: "upstream-oidc-provider-uid",
ProviderName: "upstream-oidc-provider-name",
ProviderType: psession.ProviderTypeOIDC,
//nolint:gosec // not a real credential
OIDC: &psession.OIDCSessionData{
UpstreamRefreshToken: "fake-upstream-refresh-token",
},
@@ -1100,6 +1116,7 @@ func TestGarbageCollectorControllerSync(t *testing.T) {
// The upstream refresh token is only revoked for the downstream session which had offline_access granted.
idpListerBuilder.RequireExactlyOneCallToRevokeToken(t,
"upstream-oidc-provider-name",
//nolint:gosec // not a real credential
&oidctestutil.RevokeTokenArgs{
Ctx: syncContext.Context,
Token: "fake-upstream-refresh-token",
@@ -1198,6 +1215,7 @@ func TestGarbageCollectorControllerSync(t *testing.T) {
ProviderUID: "upstream-oidc-provider-uid",
ProviderName: "upstream-oidc-provider-name",
ProviderType: psession.ProviderTypeOIDC,
//nolint:gosec // not a real credential
OIDC: &psession.OIDCSessionData{
UpstreamAccessToken: "fake-upstream-access-token",
},
@@ -1245,6 +1263,7 @@ func TestGarbageCollectorControllerSync(t *testing.T) {
// The upstream refresh token is only revoked for the downstream session which had offline_access granted.
idpListerBuilder.RequireExactlyOneCallToRevokeToken(t,
"upstream-oidc-provider-name",
//nolint:gosec // not a real credential
&oidctestutil.RevokeTokenArgs{
Ctx: syncContext.Context,
Token: "fake-upstream-access-token",
@@ -1297,6 +1316,7 @@ func TestGarbageCollectorControllerSync(t *testing.T) {
ProviderUID: "upstream-oidc-provider-uid",
ProviderName: "upstream-oidc-provider-name",
ProviderType: psession.ProviderTypeOIDC,
//nolint:gosec // not a real credential
OIDC: &psession.OIDCSessionData{
UpstreamRefreshToken: "fake-upstream-refresh-token",
},
@@ -1344,6 +1364,7 @@ func TestGarbageCollectorControllerSync(t *testing.T) {
// The upstream refresh token is revoked.
idpListerBuilder.RequireExactlyOneCallToRevokeToken(t,
"upstream-oidc-provider-name",
//nolint:gosec // not a real credential
&oidctestutil.RevokeTokenArgs{
Ctx: syncContext.Context,
Token: "fake-upstream-refresh-token",
@@ -1389,6 +1410,7 @@ func TestGarbageCollectorControllerSync(t *testing.T) {
ProviderUID: "upstream-oidc-provider-uid",
ProviderName: "upstream-oidc-provider-name",
ProviderType: psession.ProviderTypeOIDC,
//nolint:gosec // not a real credential
OIDC: &psession.OIDCSessionData{
UpstreamAccessToken: "fake-upstream-access-token",
},
@@ -1436,6 +1458,7 @@ func TestGarbageCollectorControllerSync(t *testing.T) {
// The upstream refresh token is revoked.
idpListerBuilder.RequireExactlyOneCallToRevokeToken(t,
"upstream-oidc-provider-name",
//nolint:gosec // not a real credential
&oidctestutil.RevokeTokenArgs{
Ctx: syncContext.Context,
Token: "fake-upstream-access-token",