Validate transforms examples in federation_domain_watcher.go

Also changes the transformation pipeline code to sort and uniq
the transformed group names at the end of the pipeline. This makes
the results more predicable without changing the semantics.

internal/idtransform/identity_transformations.go

@@ -8,7 +8,10 @@ package idtransform
 import (
 	"context"
 	"fmt"
+	"sort"
 	"strings"
+
+	"k8s.io/apimachinery/pkg/util/sets"
 )
 
 // TransformationResult is the result of evaluating a transformation against some inputs.
@@ -50,11 +53,13 @@ func (p *TransformationPipeline) Evaluate(ctx context.Context, username string,
 	if groups == nil {
 		groups = []string{}
 	}
+
 	accumulatedResult := &TransformationResult{
 		Username:              username,
 		Groups:                groups,
 		AuthenticationAllowed: true,
 	}
+
 	for i, transform := range p.transforms {
 		var err error
 		accumulatedResult, err = transform.Evaluate(ctx, accumulatedResult.Username, accumulatedResult.Groups)
@@ -73,6 +78,15 @@ func (p *TransformationPipeline) Evaluate(ctx context.Context, username string,
 			return nil, fmt.Errorf("identity transformation returned a null list of groups, which is not allowed")
 		}
 	}
+
+	accumulatedResult.Groups = sortAndUniq(accumulatedResult.Groups)
+
 	// There were no unexpected errors and no policy which rejected auth.
 	return accumulatedResult, nil
 }
+
+func sortAndUniq(s []string) []string {
+	unique := sets.New(s...).UnsortedList()
+	sort.Strings(unique)
+	return unique
+}

internal/idtransform/identity_transformations_test.go

@@ -110,6 +110,29 @@ func TestTransformationPipeline(t *testing.T) {
 			wantAuthenticationAllowed:          true,
 			wantRejectionAuthenticationMessage: "none",
 		},
+		{
+			name: "group results are sorted and made unique",
+			transforms: []IdentityTransformation{
+				FakeAppendStringTransformer{},
+			},
+			username: "foo",
+			groups: []string{
+				"b",
+				"a",
+				"b",
+				"a",
+				"c",
+				"b",
+			},
+			wantUsername: "foo:transformed",
+			wantGroups: []string{
+				"a:transformed",
+				"b:transformed",
+				"c:transformed",
+			},
+			wantAuthenticationAllowed:          true,
+			wantRejectionAuthenticationMessage: "none",
+		},
 		{
 			name:     "multiple transformations applied successfully",
 			username: "foo",
@@ -163,7 +186,9 @@ func TestTransformationPipeline(t *testing.T) {
 		{
 			name:     "unexpected error at index",
 			username: "foo",
-			groups:   []string{"foobar"},
+			groups: []string{
+				"foobar",
+			},
 			transforms: []IdentityTransformation{
 				FakeAppendStringTransformer{},
 				FakeErrorTransformer{},
@@ -214,7 +239,9 @@ func TestTransformationPipeline(t *testing.T) {
 		{
 			name:     "any transformation returning nil for the list of groups will cause an error",
 			username: "foo",
-			groups:   []string{"these.will.be.converted.to.nil"},
+			groups: []string{
+				"these.will.be.converted.to.nil",
+			},
 			transforms: []IdentityTransformation{
 				FakeNilGroupTransformer{},
 			},