refactor upstreamgithub.ProviderConfig to hold more config

internal/federationdomain/resolvedprovider/resolvedgithub/resolved_github_provider.go

@@ -19,7 +19,7 @@ import (
 	"go.pinniped.dev/pkg/oidcclient/pkce"
 )
 
-// FederationDomainResolvedGitHubIdentityProvider respresents a FederationDomainIdentityProvider which has
+// FederationDomainResolvedGitHubIdentityProvider represents a FederationDomainIdentityProvider which has
 // been resolved dynamically based on the currently loaded IDP CRs to include the provider.UpstreamGitHubIdentityProviderI
 // and other metadata about the provider.
 type FederationDomainResolvedGitHubIdentityProvider struct {
@@ -76,37 +76,33 @@ func (p *FederationDomainResolvedGitHubIdentityProvider) UpstreamAuthorizeRedire
 			AuthURL: p.Provider.GetAuthorizationURL(),
 		},
 		RedirectURL: fmt.Sprintf("%s/callback", downstreamIssuerURL),
+		Scopes:      p.Provider.GetScopes(),
 	}
-	redirectURL := upstreamOAuthConfig.AuthCodeURL(
-		state.EncodedStateParam,
-	)
+	redirectURL := upstreamOAuthConfig.AuthCodeURL(state.EncodedStateParam)
 	return redirectURL, nil
 }
 
 func (p *FederationDomainResolvedGitHubIdentityProvider) Login(
 	_ context.Context,
-	submittedUsername string,
-	submittedPassword string,
+	_ string,
+	_ string,
 ) (*resolvedprovider.Identity, *resolvedprovider.IdentityLoginExtras, error) {
-	fmt.Printf("GithubResolvedIdentityProvider ~ Login() called with submittedUserName %s, submittedPassword %s", submittedUsername, submittedPassword)
 	return nil, nil, errors.New("function Login not yet implemented for GitHub IDP")
 }
 
 func (p *FederationDomainResolvedGitHubIdentityProvider) LoginFromCallback(
 	_ context.Context,
-	authCode string,
-	pkce pkce.Code,
-	nonce nonce.Nonce,
-	redirectURI string,
+	_ string,
+	_ pkce.Code,
+	_ nonce.Nonce,
+	_ string,
 ) (*resolvedprovider.Identity, *resolvedprovider.IdentityLoginExtras, error) {
-	fmt.Printf("GithubResolvedIdentityProvider ~ LoginFromCallback() called with authCode: %s, pkce: %#v, nonce: %#v, redirectURI: %s", authCode, pkce, nonce, redirectURI)
 	return nil, nil, errors.New("function LoginFromCallback not yet implemented for GitHub IDP")
 }
 
 func (p *FederationDomainResolvedGitHubIdentityProvider) UpstreamRefresh(
 	_ context.Context,
-	identity *resolvedprovider.Identity,
+	_ *resolvedprovider.Identity,
 ) (refreshedIdentity *resolvedprovider.RefreshedIdentity, err error) {
-	fmt.Printf("GithubResolvedIdentityProvider ~ UpstreamRefresh() called with identity %#v", identity)
 	return nil, errors.New("function UpstreamRefresh not yet implemented for GitHub IDP")
 }

internal/federationdomain/resolvedprovider/resolvedgithub/resolved_github_provider_test.go

@@ -4,64 +4,80 @@
 package resolvedgithub
 
 import (
-	"context"
 	"testing"
 
 	"github.com/stretchr/testify/require"
 	"golang.org/x/oauth2"
 
-	"go.pinniped.dev/generated/latest/apis/supervisor/idpdiscovery/v1alpha1"
+	idpv1alpha1 "go.pinniped.dev/generated/latest/apis/supervisor/idp/v1alpha1"
+	idpdiscoveryv1alpha1 "go.pinniped.dev/generated/latest/apis/supervisor/idpdiscovery/v1alpha1"
 	"go.pinniped.dev/internal/federationdomain/resolvedprovider"
-	"go.pinniped.dev/internal/idtransform"
 	"go.pinniped.dev/internal/psession"
+	"go.pinniped.dev/internal/testutil/transformtestutil"
 	"go.pinniped.dev/internal/upstreamgithub"
 )
 
-type fakeTransformer struct{}
-
-func (a fakeTransformer) Evaluate(_ context.Context, _ string, _ []string) (*idtransform.TransformationResult, error) {
-	return &idtransform.TransformationResult{}, nil
-}
-func (a fakeTransformer) Source() interface{} { return nil }
-
 func TestFederationDomainResolvedGitHubIdentityProvider(t *testing.T) {
-	fake := fakeTransformer{}
-	transforms := idtransform.NewTransformationPipeline()
-	transforms.AppendTransformation(fake)
-	subject := FederationDomainResolvedGitHubIdentityProvider{
-		DisplayName: "fake-display-name",
-		Provider: upstreamgithub.New(upstreamgithub.ProviderConfig{
-			Name:        "fake-provider-config",
-			ResourceUID: "fake-resource-uid",
-			OAuth2Config: &oauth2.Config{
-				ClientID:     "clientID12345",
-				ClientSecret: "clientSecret6789",
-				RedirectURL:  "some/redirect/url",
+	transforms := transformtestutil.NewRejectAllAuthPipeline(t)
+
+	provider := upstreamgithub.New(upstreamgithub.ProviderConfig{
+		Name:                 "fake-provider-config",
+		ResourceUID:          "fake-resource-uid",
+		APIBaseURL:           "https://fake-api-host.com",
+		UsernameAttribute:    idpv1alpha1.GitHubUsernameID,
+		GroupNameAttribute:   idpv1alpha1.GitHubUseTeamSlugForGroupName,
+		AllowedOrganizations: []string{"org1", "org2"},
+		HttpClient:           nil, // not needed yet for this test
+		OAuth2Config: &oauth2.Config{
+			ClientID:     "fake-client-id",
+			ClientSecret: "fake-client-secret",
+			Scopes:       []string{"read:user", "read:org"},
+			Endpoint: oauth2.Endpoint{
+				AuthURL:       "https://fake-authorization-url",
+				DeviceAuthURL: "",
+				TokenURL:      "https://fake-token-url",
+				AuthStyle:     oauth2.AuthStyleInParams,
 			},
-		}),
+		},
+	})
+
+	subject := FederationDomainResolvedGitHubIdentityProvider{
+		DisplayName:         "fake-display-name",
+		Provider:            provider,
 		SessionProviderType: psession.ProviderTypeGitHub,
 		Transforms:          transforms,
 	}
 
 	require.Equal(t, "fake-display-name", subject.GetDisplayName())
-	require.Equal(t, upstreamgithub.New(upstreamgithub.ProviderConfig{
-		Name:        "fake-provider-config",
-		ResourceUID: "fake-resource-uid",
-		OAuth2Config: &oauth2.Config{
-			ClientID:     "clientID12345",
-			ClientSecret: "clientSecret6789",
-			RedirectURL:  "some/redirect/url",
-		},
-	}), subject.GetProvider())
+	require.Equal(t, provider, subject.GetProvider())
 	require.Equal(t, psession.ProviderTypeGitHub, subject.GetSessionProviderType())
-	require.Equal(t, v1alpha1.IDPTypeGitHub, subject.GetIDPDiscoveryType())
-	require.Equal(t, []v1alpha1.IDPFlow{v1alpha1.IDPFlowBrowserAuthcode}, subject.GetIDPDiscoveryFlows())
+	require.Equal(t, idpdiscoveryv1alpha1.IDPTypeGitHub, subject.GetIDPDiscoveryType())
+	require.Equal(t, []idpdiscoveryv1alpha1.IDPFlow{idpdiscoveryv1alpha1.IDPFlowBrowserAuthcode}, subject.GetIDPDiscoveryFlows())
 	require.Equal(t, transforms, subject.GetTransforms())
-	require.Equal(t, &psession.GitHubSessionData{}, subject.CloneIDPSpecificSessionDataFromSession(&psession.CustomSessionData{
+
+	originalCustomSession := &psession.CustomSessionData{
 		Username:         "fake-username",
 		UpstreamUsername: "fake-upstream-username",
-		GitHub:           &psession.GitHubSessionData{},
-	}))
+		GitHub:           &psession.GitHubSessionData{UpstreamAccessToken: "fake-upstream-access-token"},
+	}
+	clonedCustomSession := subject.CloneIDPSpecificSessionDataFromSession(originalCustomSession)
+	require.Equal(t,
+		&psession.GitHubSessionData{UpstreamAccessToken: "fake-upstream-access-token"},
+		clonedCustomSession,
+	)
+	require.NotSame(t, originalCustomSession, clonedCustomSession)
+
+	customSessionToBeMutated := &psession.CustomSessionData{
+		Username:         "fake-username2",
+		UpstreamUsername: "fake-upstream-username2",
+	}
+	subject.ApplyIDPSpecificSessionDataToSession(customSessionToBeMutated, &psession.GitHubSessionData{UpstreamAccessToken: "fake-upstream-access-token2"})
+	require.Equal(t, &psession.CustomSessionData{
+		Username:         "fake-username2",
+		UpstreamUsername: "fake-upstream-username2",
+		GitHub:           &psession.GitHubSessionData{UpstreamAccessToken: "fake-upstream-access-token2"},
+	}, customSessionToBeMutated)
+
 	redirectURL, err := subject.UpstreamAuthorizeRedirectURL(
 		&resolvedprovider.UpstreamAuthorizeRequestState{
 			EncodedStateParam: "encodedStateParam12345",
@@ -72,7 +88,12 @@ func TestFederationDomainResolvedGitHubIdentityProvider(t *testing.T) {
 	)
 	require.NoError(t, err)
 	require.Equal(t,
-		"?client_id=clientID12345&redirect_uri=https%3A%2F%2Flocalhost%2Ffake%2Fpath%2Fcallback&response_type=code&state=encodedStateParam12345",
+		"https://fake-authorization-url?"+
+			"client_id=fake-client-id&"+
+			"redirect_uri=https%3A%2F%2Flocalhost%2Ffake%2Fpath%2Fcallback&"+
+			"response_type=code&"+
+			"scope=read%3Auser+read%3Aorg&"+
+			"state=encodedStateParam12345",
 		redirectURL,
 	)
 }