-
Notifications
You must be signed in to change notification settings - Fork 184
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
sso_*: rewrite validator abstractions
working with list, not struct struct testing - think it works? general kind of working with returning Result struct new validator structure adding "<validator_name>:err msg" log line some unfinished auth changes add validators file adding more sso_auth changes fixing up some errors fix some formatting and bugs fix validators in structs, and simplify logging tests for email address and domain validtors just return errors fix func name and capitalization sso_auth: validator tests func name sso_proxy: return correct error sso_proxy: validator tests mock validator misc adding some docstrings this test was pulled in from a different branch and is unrelated add some more context to fail states extra comments authenticator tests
- Loading branch information
1 parent
b490092
commit 9019d4f
Showing
14 changed files
with
529 additions
and
279 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,38 +1,72 @@ | ||
| package options | ||
|
|
||
| import ( | ||
| "errors" | ||
| "fmt" | ||
| "strings" | ||
|
|
||
| "github.com/buzzfeed/sso/internal/pkg/sessions" | ||
| ) | ||
|
|
||
| // NewEmailAddressValidator returns a function that checks whether a given email is valid based on a list | ||
| // of email addresses. The address "*" is a wild card that matches any non-empty email. | ||
| func NewEmailAddressValidator(emails []string) func(string) bool { | ||
| allowAll := false | ||
| var ( | ||
| _ Validator = EmailAddressValidator{} | ||
|
|
||
| // These error message should be formatted in such a way that is appropriate | ||
| // for display to the end user. | ||
| ErrEmailAddressDenied = errors.New("Unauthorized Email Address") | ||
| ) | ||
|
|
||
| type EmailAddressValidator struct { | ||
| AllowedEmails []string | ||
| } | ||
|
|
||
| // NewEmailAddressValidator takes in a list of email addresses and returns a Validator object. | ||
| // The validator can be used to validate that the session.Email: | ||
| // - is non-empty | ||
| // - matches one of the originally passed in email addresses | ||
| // (case insensitive) | ||
| // - if the originally passed in list of emails consists only of "*", then all emails | ||
| // are considered valid based on their domain. | ||
| // If valid, nil is returned in place of an error. | ||
| func NewEmailAddressValidator(allowedEmails []string) EmailAddressValidator { | ||
| var emailAddresses []string | ||
|
|
||
| for _, email := range emails { | ||
| if email == "*" { | ||
| allowAll = true | ||
| } | ||
| for _, email := range allowedEmails { | ||
| emailAddress := fmt.Sprintf("%s", strings.ToLower(email)) | ||
| emailAddresses = append(emailAddresses, emailAddress) | ||
| } | ||
|
|
||
| if allowAll { | ||
| return func(email string) bool { return email != "" } | ||
| return EmailAddressValidator{ | ||
| AllowedEmails: emailAddresses, | ||
| } | ||
| } | ||
|
|
||
| return func(email string) bool { | ||
| if email == "" { | ||
| return false | ||
| } | ||
| email = strings.ToLower(email) | ||
| for _, emailItem := range emailAddresses { | ||
| if email == emailItem { | ||
| return true | ||
| } | ||
| func (v EmailAddressValidator) Validate(session *sessions.SessionState) error { | ||
| if session.Email == "" { | ||
| return ErrInvalidEmailAddress | ||
| } | ||
|
|
||
| if len(v.AllowedEmails) == 0 { | ||
| return ErrEmailAddressDenied | ||
| } | ||
|
|
||
| if len(v.AllowedEmails) == 1 && v.AllowedEmails[0] == "*" { | ||
| return nil | ||
| } | ||
|
|
||
| err := v.validate(session) | ||
| if err != nil { | ||
| return err | ||
| } | ||
| return nil | ||
| } | ||
|
|
||
| func (v EmailAddressValidator) validate(session *sessions.SessionState) error { | ||
| email := strings.ToLower(session.Email) | ||
| for _, emailItem := range v.AllowedEmails { | ||
| if email == emailItem { | ||
| return nil | ||
| } | ||
| return false | ||
| } | ||
| return ErrEmailAddressDenied | ||
| } |
Oops, something went wrong.