refactor upstreamgithub.ProviderConfig to hold more config

internal/upstreamgithub/upstreamgithub.go

@@ -16,16 +16,31 @@ import (
 
 // ProviderConfig holds the active configuration of an upstream GitHub provider.
 type ProviderConfig struct {
-	Name                    string
-	ResourceUID             types.UID
-	Host                    string
-	UsernameAttribute       v1alpha1.GitHubUsernameAttribute
-	GroupNameAttribute      v1alpha1.GitHubGroupNameAttribute
-	OAuth2Config            *oauth2.Config
-	AllowedOrganizations    []string
-	OrganizationLoginPolicy v1alpha1.GitHubAllowedAuthOrganizationsPolicy
-	AuthorizationURL        string
-	HttpClient              *http.Client
+	Name        string
+	ResourceUID types.UID
+
+	// APIBaseURL is the url of the GitHub API, not including the path to a specific API endpoint.
+	// According to the GitHub docs, it should be either https://api.github.com/ for cloud
+	// or https://HOSTNAME/api/v3/ for Enterprise Server.
+	APIBaseURL string
+
+	UsernameAttribute  v1alpha1.GitHubUsernameAttribute
+	GroupNameAttribute v1alpha1.GitHubGroupNameAttribute
+
+	// AllowedOrganizations, when empty, means to allow users from all orgs.
+	AllowedOrganizations []string
+
+	// HttpClient is a client that can be used to call the GitHub APIs and token endpoint.
+	// This client should be configured with the user-provided CA bundle and a timeout.
+	HttpClient *http.Client
+
+	// OAuth2Config contains ClientID, ClientSecret, Scopes, and Endpoint (which contains auth and token endpoint URLs,
+	// and auth style for the token endpoint).
+	// OAuth2Config will not be used to compute the authorize URL because the redirect back to the Supervisor's
+	// callback must be different per FederationDomain. It holds data that may be useful when calculating the
+	// authorize URL, so that data is exposed by interface methods. However, it can be used to call the token endpoint,
+	// for which there is no RedirectURL needed.
+	OAuth2Config *oauth2.Config
 }
 
 type Provider struct {
@@ -40,12 +55,6 @@ func New(config ProviderConfig) *Provider {
 	return &Provider{c: config}
 }
 
-// GetConfig is a reader for the config. Returns a copy of the config to keep the underlying config read-only.
-func (p *Provider) GetConfig() ProviderConfig {
-	return p.c
-}
-
-// GetName returns a name for this upstream provider.
 func (p *Provider) GetName() string {
 	return p.c.Name
 }
@@ -58,12 +67,8 @@ func (p *Provider) GetClientID() string {
 	return p.c.OAuth2Config.ClientID
 }
 
-func (p *Provider) GetOAuth2Config() *oauth2.Config {
-	return p.c.OAuth2Config
-}
-
-func (p *Provider) GetHost() string {
-	return p.c.Host
+func (p *Provider) GetScopes() []string {
+	return p.c.OAuth2Config.Scopes
 }
 
 func (p *Provider) GetUsernameAttribute() v1alpha1.GitHubUsernameAttribute {
@@ -78,14 +83,11 @@ func (p *Provider) GetAllowedOrganizations() []string {
 	return p.c.AllowedOrganizations
 }
 
-func (p *Provider) GetOrganizationLoginPolicy() v1alpha1.GitHubAllowedAuthOrganizationsPolicy {
-	return p.c.OrganizationLoginPolicy
-}
-
 func (p *Provider) GetAuthorizationURL() string {
-	return p.c.AuthorizationURL
+	return p.c.OAuth2Config.Endpoint.AuthURL
 }
 
-func (p *Provider) GetHttpClient() *http.Client {
-	return p.c.HttpClient
+// GetConfig returns the config. This is not part of the interface and is mostly just for testing.
+func (p *Provider) GetConfig() ProviderConfig {
+	return p.c
 }

internal/upstreamgithub/upstreamgithub_test.go

@@ -18,16 +18,21 @@ func TestGitHubProvider(t *testing.T) {
 	subject := New(ProviderConfig{
 		Name:               "foo",
 		ResourceUID:        "resource-uid-12345",
-		Host:               "fake-host",
+		APIBaseURL:         "https://fake-base-url",
 		UsernameAttribute:  "fake-username-attribute",
 		GroupNameAttribute: "fake-group-name-attribute",
 		OAuth2Config: &oauth2.Config{
 			ClientID:     "fake-client-id",
 			ClientSecret: "fake-client-secret",
+			Scopes:       []string{"scope1", "scope2"},
+			Endpoint: oauth2.Endpoint{
+				AuthURL:       "https://fake-authorization-url",
+				DeviceAuthURL: "",
+				TokenURL:      "https://fake-token-url",
+				AuthStyle:     oauth2.AuthStyleInParams,
+			},
 		},
-		AllowedOrganizations:    []string{"fake-org", "fake-org2"},
-		OrganizationLoginPolicy: v1alpha1.GitHubAllowedAuthOrganizationsPolicyAllGitHubUsers,
-		AuthorizationURL:        "https://fake-authorization-url",
+		AllowedOrganizations: []string{"fake-org", "fake-org2"},
 		HttpClient: &http.Client{
 			Timeout: 1234509,
 		},
@@ -36,16 +41,21 @@ func TestGitHubProvider(t *testing.T) {
 	require.Equal(t, ProviderConfig{
 		Name:               "foo",
 		ResourceUID:        "resource-uid-12345",
-		Host:               "fake-host",
+		APIBaseURL:         "https://fake-base-url",
 		UsernameAttribute:  "fake-username-attribute",
 		GroupNameAttribute: "fake-group-name-attribute",
 		OAuth2Config: &oauth2.Config{
 			ClientID:     "fake-client-id",
 			ClientSecret: "fake-client-secret",
+			Scopes:       []string{"scope1", "scope2"},
+			Endpoint: oauth2.Endpoint{
+				AuthURL:       "https://fake-authorization-url",
+				DeviceAuthURL: "",
+				TokenURL:      "https://fake-token-url",
+				AuthStyle:     oauth2.AuthStyleInParams,
+			},
 		},
-		AllowedOrganizations:    []string{"fake-org", "fake-org2"},
-		OrganizationLoginPolicy: v1alpha1.GitHubAllowedAuthOrganizationsPolicyAllGitHubUsers,
-		AuthorizationURL:        "https://fake-authorization-url",
+		AllowedOrganizations: []string{"fake-org", "fake-org2"},
 		HttpClient: &http.Client{
 			Timeout: 1234509,
 		},
@@ -54,17 +64,12 @@ func TestGitHubProvider(t *testing.T) {
 	require.Equal(t, "foo", subject.GetName())
 	require.Equal(t, types.UID("resource-uid-12345"), subject.GetResourceUID())
 	require.Equal(t, "fake-client-id", subject.GetClientID())
-	require.Equal(t, &oauth2.Config{
-		ClientID:     "fake-client-id",
-		ClientSecret: "fake-client-secret",
-	}, subject.GetOAuth2Config())
-	require.Equal(t, "fake-host", subject.GetHost())
+	require.Equal(t, "fake-client-id", subject.GetClientID())
 	require.Equal(t, v1alpha1.GitHubUsernameAttribute("fake-username-attribute"), subject.GetUsernameAttribute())
 	require.Equal(t, v1alpha1.GitHubGroupNameAttribute("fake-group-name-attribute"), subject.GetGroupNameAttribute())
 	require.Equal(t, []string{"fake-org", "fake-org2"}, subject.GetAllowedOrganizations())
-	require.Equal(t, v1alpha1.GitHubAllowedAuthOrganizationsPolicyAllGitHubUsers, subject.GetOrganizationLoginPolicy())
 	require.Equal(t, "https://fake-authorization-url", subject.GetAuthorizationURL())
 	require.Equal(t, &http.Client{
 		Timeout: 1234509,
-	}, subject.GetHttpClient())
+	}, subject.GetConfig().HttpClient)
 }