diff --git a/integration_test/credetial_plugin_test.go b/integration_test/credetial_plugin_test.go index 5a5a9760..49fc5dfd 100644 --- a/integration_test/credetial_plugin_test.go +++ b/integration_test/credetial_plugin_test.go @@ -11,7 +11,7 @@ import ( "github.com/google/go-cmp/cmp" "github.com/int128/kubelogin/integration_test/idp" "github.com/int128/kubelogin/integration_test/idp/mock_idp" - "github.com/int128/kubelogin/integration_test/keys" + "github.com/int128/kubelogin/integration_test/keypair" "github.com/int128/kubelogin/integration_test/localserver" "github.com/int128/kubelogin/pkg/adaptors/browser" "github.com/int128/kubelogin/pkg/adaptors/browser/mock_browser" @@ -43,9 +43,9 @@ func TestCredentialPlugin(t *testing.T) { t.Run("NoTLS", func(t *testing.T) { testCredentialPlugin(t, credentialPluginTestCase{ - TokenCacheDir: tokenCacheDir, - Keys: keys.None, - ExtraArgs: []string{ + tokenCacheDir: tokenCacheDir, + idpTLS: keypair.None, + extraArgs: []string{ "--token-cache-dir", tokenCacheDir, }, }) @@ -53,23 +53,23 @@ func TestCredentialPlugin(t *testing.T) { t.Run("TLS", func(t *testing.T) { t.Run("CertFile", func(t *testing.T) { testCredentialPlugin(t, credentialPluginTestCase{ - TokenCacheDir: tokenCacheDir, - TokenCacheKey: tokencache.Key{CACertFilename: keys.Server.CACertPath}, - Keys: keys.Server, - ExtraArgs: []string{ + tokenCacheDir: tokenCacheDir, + tokenCacheKey: tokencache.Key{CACertFilename: keypair.Server.CACertPath}, + idpTLS: keypair.Server, + extraArgs: []string{ "--token-cache-dir", tokenCacheDir, - "--certificate-authority", keys.Server.CACertPath, + "--certificate-authority", keypair.Server.CACertPath, }, }) }) t.Run("CertData", func(t *testing.T) { testCredentialPlugin(t, credentialPluginTestCase{ - TokenCacheDir: tokenCacheDir, - TokenCacheKey: tokencache.Key{CACertData: keys.Server.CACertBase64}, - Keys: keys.Server, - ExtraArgs: []string{ + tokenCacheDir: tokenCacheDir, + tokenCacheKey: tokencache.Key{CACertData: keypair.Server.CACertBase64}, + idpTLS: keypair.Server, + extraArgs: []string{ "--token-cache-dir", tokenCacheDir, - "--certificate-authority-data", keys.Server.CACertBase64, + "--certificate-authority-data", keypair.Server.CACertBase64, }, }) }) @@ -77,10 +77,10 @@ func TestCredentialPlugin(t *testing.T) { } type credentialPluginTestCase struct { - TokenCacheDir string - TokenCacheKey tokencache.Key - Keys keys.Keys - ExtraArgs []string + tokenCacheDir string + tokenCacheKey tokencache.Key + idpTLS keypair.KeyPair + extraArgs []string } func testCredentialPlugin(t *testing.T, tc credentialPluginTestCase) { @@ -94,18 +94,22 @@ func testCredentialPlugin(t *testing.T, tc credentialPluginTestCase) { defer ctrl.Finish() provider := mock_idp.NewMockProvider(ctrl) - serverURL, server := localserver.Start(t, idp.NewHandler(t, provider), tc.Keys) + serverURL, server := localserver.Start(t, idp.NewHandler(t, provider), tc.idpTLS) defer server.Shutdown(t, ctx) - var idToken string - setupAuthCodeFlow(t, provider, serverURL, "openid", "http://localhost:", nil, &idToken) - writerMock := newCredentialPluginWriterMock(t, ctrl, &idToken) - browserMock := newBrowserMock(ctx, t, ctrl, tc.Keys) + cfg := authCodeFlowConfig{ + serverURL: serverURL, + scope: "openid", + redirectURIPrefix: "http://localhost:", + } + setupAuthCodeFlow(t, provider, &cfg) + writerMock := newCredentialPluginWriterMock(t, ctrl, &cfg.idToken) + browserMock := newBrowserMock(ctx, t, ctrl, tc.idpTLS) args := []string{ "--oidc-issuer-url", serverURL, "--oidc-client-id", "kubernetes", } - args = append(args, tc.ExtraArgs...) + args = append(args, tc.extraArgs...) runGetTokenCmd(t, ctx, browserMock, writerMock, args) }) @@ -117,7 +121,7 @@ func testCredentialPlugin(t *testing.T, tc credentialPluginTestCase) { defer ctrl.Finish() provider := mock_idp.NewMockProvider(ctrl) - serverURL, server := localserver.Start(t, idp.NewHandler(t, provider), tc.Keys) + serverURL, server := localserver.Start(t, idp.NewHandler(t, provider), tc.idpTLS) defer server.Shutdown(t, ctx) idToken := newIDToken(t, serverURL, "", tokenExpiryFuture) setupROPCFlow(provider, serverURL, "openid", "USER", "PASS", idToken) @@ -130,7 +134,7 @@ func testCredentialPlugin(t *testing.T, tc credentialPluginTestCase) { "--username", "USER", "--password", "PASS", } - args = append(args, tc.ExtraArgs...) + args = append(args, tc.extraArgs...) runGetTokenCmd(t, ctx, browserMock, writerMock, args) }) @@ -142,7 +146,7 @@ func testCredentialPlugin(t *testing.T, tc credentialPluginTestCase) { defer ctrl.Finish() provider := mock_idp.NewMockProvider(ctrl) - serverURL, server := localserver.Start(t, idp.NewHandler(t, provider), tc.Keys) + serverURL, server := localserver.Start(t, idp.NewHandler(t, provider), tc.idpTLS) defer server.Shutdown(t, ctx) idToken := newIDToken(t, serverURL, "YOUR_NONCE", tokenExpiryFuture) writerMock := newCredentialPluginWriterMock(t, ctrl, &idToken) @@ -156,7 +160,7 @@ func testCredentialPlugin(t *testing.T, tc credentialPluginTestCase) { "--oidc-issuer-url", serverURL, "--oidc-client-id", "kubernetes", } - args = append(args, tc.ExtraArgs...) + args = append(args, tc.extraArgs...) runGetTokenCmd(t, ctx, browserMock, writerMock, args) assertTokenCache(t, tc, serverURL, tokencache.Value{ IDToken: idToken, @@ -172,7 +176,7 @@ func testCredentialPlugin(t *testing.T, tc credentialPluginTestCase) { defer ctrl.Finish() provider := mock_idp.NewMockProvider(ctrl) - serverURL, server := localserver.Start(t, idp.NewHandler(t, provider), tc.Keys) + serverURL, server := localserver.Start(t, idp.NewHandler(t, provider), tc.idpTLS) defer server.Shutdown(t, ctx) validIDToken := newIDToken(t, serverURL, "YOUR_NONCE", tokenExpiryFuture) expiredIDToken := newIDToken(t, serverURL, "YOUR_NONCE", tokenExpiryPast) @@ -193,7 +197,7 @@ func testCredentialPlugin(t *testing.T, tc credentialPluginTestCase) { "--oidc-issuer-url", serverURL, "--oidc-client-id", "kubernetes", } - args = append(args, tc.ExtraArgs...) + args = append(args, tc.extraArgs...) runGetTokenCmd(t, ctx, browserMock, writerMock, args) assertTokenCache(t, tc, serverURL, tokencache.Value{ IDToken: validIDToken, @@ -209,31 +213,35 @@ func testCredentialPlugin(t *testing.T, tc credentialPluginTestCase) { defer ctrl.Finish() provider := mock_idp.NewMockProvider(ctrl) - serverURL, server := localserver.Start(t, idp.NewHandler(t, provider), tc.Keys) + serverURL, server := localserver.Start(t, idp.NewHandler(t, provider), tc.idpTLS) defer server.Shutdown(t, ctx) - validIDToken := newIDToken(t, serverURL, "YOUR_NONCE", tokenExpiryFuture) - expiredIDToken := newIDToken(t, serverURL, "YOUR_NONCE", tokenExpiryPast) - setupAuthCodeFlow(t, provider, serverURL, "openid", "http://localhost:", nil, &validIDToken) + cfg := authCodeFlowConfig{ + serverURL: serverURL, + scope: "openid", + redirectURIPrefix: "http://localhost:", + } + setupAuthCodeFlow(t, provider, &cfg) provider.EXPECT().Refresh("EXPIRED_REFRESH_TOKEN"). Return(nil, &idp.ErrorResponse{Code: "invalid_request", Description: "token has expired"}). MaxTimes(2) // package oauth2 will retry refreshing the token + expiredIDToken := newIDToken(t, serverURL, "YOUR_NONCE", tokenExpiryPast) setupTokenCache(t, tc, serverURL, tokencache.Value{ IDToken: expiredIDToken, RefreshToken: "EXPIRED_REFRESH_TOKEN", }) - writerMock := newCredentialPluginWriterMock(t, ctrl, &validIDToken) - browserMock := newBrowserMock(ctx, t, ctrl, tc.Keys) + writerMock := newCredentialPluginWriterMock(t, ctrl, &cfg.idToken) + browserMock := newBrowserMock(ctx, t, ctrl, tc.idpTLS) args := []string{ "--oidc-issuer-url", serverURL, "--oidc-client-id", "kubernetes", } - args = append(args, tc.ExtraArgs...) + args = append(args, tc.extraArgs...) runGetTokenCmd(t, ctx, browserMock, writerMock, args) assertTokenCache(t, tc, serverURL, tokencache.Value{ - IDToken: validIDToken, + IDToken: cfg.idToken, RefreshToken: "YOUR_REFRESH_TOKEN", }) }) @@ -246,12 +254,16 @@ func testCredentialPlugin(t *testing.T, tc credentialPluginTestCase) { defer ctrl.Finish() provider := mock_idp.NewMockProvider(ctrl) - serverURL, server := localserver.Start(t, idp.NewHandler(t, provider), tc.Keys) + serverURL, server := localserver.Start(t, idp.NewHandler(t, provider), tc.idpTLS) defer server.Shutdown(t, ctx) - var idToken string - setupAuthCodeFlow(t, provider, serverURL, "email profile openid", "http://localhost:", nil, &idToken) - writerMock := newCredentialPluginWriterMock(t, ctrl, &idToken) - browserMock := newBrowserMock(ctx, t, ctrl, tc.Keys) + cfg := authCodeFlowConfig{ + serverURL: serverURL, + scope: "email profile openid", + redirectURIPrefix: "http://localhost:", + } + setupAuthCodeFlow(t, provider, &cfg) + writerMock := newCredentialPluginWriterMock(t, ctrl, &cfg.idToken) + browserMock := newBrowserMock(ctx, t, ctrl, tc.idpTLS) args := []string{ "--oidc-issuer-url", serverURL, @@ -259,7 +271,7 @@ func testCredentialPlugin(t *testing.T, tc credentialPluginTestCase) { "--oidc-extra-scope", "email", "--oidc-extra-scope", "profile", } - args = append(args, tc.ExtraArgs...) + args = append(args, tc.extraArgs...) runGetTokenCmd(t, ctx, browserMock, writerMock, args) }) @@ -271,19 +283,23 @@ func testCredentialPlugin(t *testing.T, tc credentialPluginTestCase) { defer ctrl.Finish() provider := mock_idp.NewMockProvider(ctrl) - serverURL, server := localserver.Start(t, idp.NewHandler(t, provider), tc.Keys) + serverURL, server := localserver.Start(t, idp.NewHandler(t, provider), tc.idpTLS) defer server.Shutdown(t, ctx) - var idToken string - setupAuthCodeFlow(t, provider, serverURL, "openid", "http://127.0.0.1:", nil, &idToken) - writerMock := newCredentialPluginWriterMock(t, ctrl, &idToken) - browserMock := newBrowserMock(ctx, t, ctrl, tc.Keys) + cfg := authCodeFlowConfig{ + serverURL: serverURL, + scope: "openid", + redirectURIPrefix: "http://127.0.0.1:", + } + setupAuthCodeFlow(t, provider, &cfg) + writerMock := newCredentialPluginWriterMock(t, ctrl, &cfg.idToken) + browserMock := newBrowserMock(ctx, t, ctrl, tc.idpTLS) args := []string{ "--oidc-issuer-url", serverURL, "--oidc-client-id", "kubernetes", "--oidc-redirect-url-hostname", "127.0.0.1", } - args = append(args, tc.ExtraArgs...) + args = append(args, tc.extraArgs...) runGetTokenCmd(t, ctx, browserMock, writerMock, args) }) @@ -295,15 +311,20 @@ func testCredentialPlugin(t *testing.T, tc credentialPluginTestCase) { defer ctrl.Finish() provider := mock_idp.NewMockProvider(ctrl) - serverURL, server := localserver.Start(t, idp.NewHandler(t, provider), tc.Keys) + serverURL, server := localserver.Start(t, idp.NewHandler(t, provider), tc.idpTLS) defer server.Shutdown(t, ctx) - var idToken string - setupAuthCodeFlow(t, provider, serverURL, "openid", "http://localhost:", map[string]string{ - "ttl": "86400", - "reauth": "false", - }, &idToken) - writerMock := newCredentialPluginWriterMock(t, ctrl, &idToken) - browserMock := newBrowserMock(ctx, t, ctrl, tc.Keys) + cfg := authCodeFlowConfig{ + serverURL: serverURL, + scope: "openid", + redirectURIPrefix: "http://localhost:", + extraParams: map[string]string{ + "ttl": "86400", + "reauth": "false", + }, + } + setupAuthCodeFlow(t, provider, &cfg) + writerMock := newCredentialPluginWriterMock(t, ctrl, &cfg.idToken) + browserMock := newBrowserMock(ctx, t, ctrl, tc.idpTLS) args := []string{ "--oidc-issuer-url", serverURL, @@ -311,7 +332,7 @@ func testCredentialPlugin(t *testing.T, tc credentialPluginTestCase) { "--oidc-auth-request-extra-params", "ttl=86400", "--oidc-auth-request-extra-params", "reauth=false", } - args = append(args, tc.ExtraArgs...) + args = append(args, tc.extraArgs...) runGetTokenCmd(t, ctx, browserMock, writerMock, args) }) } @@ -346,22 +367,22 @@ func runGetTokenCmd(t *testing.T, ctx context.Context, b browser.Interface, w cr } func setupTokenCache(t *testing.T, tc credentialPluginTestCase, serverURL string, v tokencache.Value) { - k := tc.TokenCacheKey + k := tc.tokenCacheKey k.IssuerURL = serverURL k.ClientID = "kubernetes" var r tokencache.Repository - err := r.Save(tc.TokenCacheDir, k, v) + err := r.Save(tc.tokenCacheDir, k, v) if err != nil { t.Errorf("could not set up the token cache: %s", err) } } func assertTokenCache(t *testing.T, tc credentialPluginTestCase, serverURL string, want tokencache.Value) { - k := tc.TokenCacheKey + k := tc.tokenCacheKey k.IssuerURL = serverURL k.ClientID = "kubernetes" var r tokencache.Repository - got, err := r.FindByKey(tc.TokenCacheDir, k) + got, err := r.FindByKey(tc.tokenCacheDir, k) if err != nil { t.Errorf("could not set up the token cache: %s", err) } diff --git a/integration_test/helpers_test.go b/integration_test/helpers_test.go index 6cda5574..2ffb7e28 100644 --- a/integration_test/helpers_test.go +++ b/integration_test/helpers_test.go @@ -10,7 +10,7 @@ import ( "github.com/golang/mock/gomock" "github.com/int128/kubelogin/integration_test/idp" "github.com/int128/kubelogin/integration_test/idp/mock_idp" - "github.com/int128/kubelogin/integration_test/keys" + "github.com/int128/kubelogin/integration_test/keypair" "github.com/int128/kubelogin/pkg/adaptors/browser" "github.com/int128/kubelogin/pkg/adaptors/browser/mock_browser" "github.com/int128/kubelogin/pkg/testing/jwt" @@ -34,19 +34,29 @@ func newIDToken(t *testing.T, issuer, nonce string, expiry time.Time) string { }) } -func setupAuthCodeFlow(t *testing.T, provider *mock_idp.MockProvider, serverURL, scope, redirectURIPrefix string, extraParams map[string]string, idToken *string) { +type authCodeFlowConfig struct { + serverURL string + scope string + redirectURIPrefix string + extraParams map[string]string + + // setupAuthCodeFlow will set this after authentication + idToken string +} + +func setupAuthCodeFlow(t *testing.T, provider *mock_idp.MockProvider, c *authCodeFlowConfig) { var nonce string - provider.EXPECT().Discovery().Return(idp.NewDiscoveryResponse(serverURL)) + provider.EXPECT().Discovery().Return(idp.NewDiscoveryResponse(c.serverURL)) provider.EXPECT().GetCertificates().Return(idp.NewCertificatesResponse(jwt.PrivateKey)) provider.EXPECT().AuthenticateCode(gomock.Any()). DoAndReturn(func(req idp.AuthenticationRequest) (string, error) { - if req.Scope != scope { - t.Errorf("scope wants `%s` but was `%s`", scope, req.Scope) + if req.Scope != c.scope { + t.Errorf("scope wants `%s` but was `%s`", c.scope, req.Scope) } - if !strings.HasPrefix(req.RedirectURI, redirectURIPrefix) { - t.Errorf("redirectURI wants prefix `%s` but was `%s`", redirectURIPrefix, req.RedirectURI) + if !strings.HasPrefix(req.RedirectURI, c.redirectURIPrefix) { + t.Errorf("redirectURI wants prefix `%s` but was `%s`", c.redirectURIPrefix, req.RedirectURI) } - for k, v := range extraParams { + for k, v := range c.extraParams { got := req.RawQuery.Get(k) if got != v { t.Errorf("parameter %s wants `%s` but was `%s`", k, v, got) @@ -57,8 +67,8 @@ func setupAuthCodeFlow(t *testing.T, provider *mock_idp.MockProvider, serverURL, }) provider.EXPECT().Exchange("YOUR_AUTH_CODE"). DoAndReturn(func(string) (*idp.TokenResponse, error) { - *idToken = newIDToken(t, serverURL, nonce, tokenExpiryFuture) - return idp.NewTokenResponse(*idToken, "YOUR_REFRESH_TOKEN"), nil + c.idToken = newIDToken(t, c.serverURL, nonce, tokenExpiryFuture) + return idp.NewTokenResponse(c.idToken, "YOUR_REFRESH_TOKEN"), nil }) } @@ -69,7 +79,7 @@ func setupROPCFlow(provider *mock_idp.MockProvider, serverURL, scope, username, Return(idp.NewTokenResponse(idToken, "YOUR_REFRESH_TOKEN"), nil) } -func newBrowserMock(ctx context.Context, t *testing.T, ctrl *gomock.Controller, k keys.Keys) browser.Interface { +func newBrowserMock(ctx context.Context, t *testing.T, ctrl *gomock.Controller, k keypair.KeyPair) browser.Interface { b := mock_browser.NewMockInterface(ctrl) b.EXPECT(). Open(gomock.Any()). diff --git a/integration_test/keys/keys.go b/integration_test/keypair/keypair.go similarity index 67% rename from integration_test/keys/keys.go rename to integration_test/keypair/keypair.go index f949ff36..24bd76bb 100644 --- a/integration_test/keys/keys.go +++ b/integration_test/keypair/keypair.go @@ -1,4 +1,4 @@ -package keys +package keypair import ( "crypto/tls" @@ -10,8 +10,8 @@ import ( "strings" ) -// Keys represents a pair of certificate and key. -type Keys struct { +// KeyPair represents a pair of certificate and key. +type KeyPair struct { CertPath string KeyPath string CACertPath string @@ -20,16 +20,16 @@ type Keys struct { } // None represents non-TLS. -var None Keys +var None KeyPair -// Server is a Keys for TLS server. +// Server is a KeyPair for TLS server. // These files should be generated by Makefile before test. -var Server = Keys{ - CertPath: "keys/testdata/server.crt", - KeyPath: "keys/testdata/server.key", - CACertPath: "keys/testdata/ca.crt", - CACertBase64: readAsBase64("keys/testdata/ca.crt"), - TLSConfig: newTLSConfig("keys/testdata/ca.crt"), +var Server = KeyPair{ + CertPath: "keypair/testdata/server.crt", + KeyPath: "keypair/testdata/server.key", + CACertPath: "keypair/testdata/ca.crt", + CACertBase64: readAsBase64("keypair/testdata/ca.crt"), + TLSConfig: newTLSConfig("keypair/testdata/ca.crt"), } func readAsBase64(name string) string { diff --git a/integration_test/keys/testdata/Makefile b/integration_test/keypair/testdata/Makefile similarity index 100% rename from integration_test/keys/testdata/Makefile rename to integration_test/keypair/testdata/Makefile diff --git a/integration_test/keys/testdata/ca.crt b/integration_test/keypair/testdata/ca.crt similarity index 100% rename from integration_test/keys/testdata/ca.crt rename to integration_test/keypair/testdata/ca.crt diff --git a/integration_test/keys/testdata/ca.csr b/integration_test/keypair/testdata/ca.csr similarity index 100% rename from integration_test/keys/testdata/ca.csr rename to integration_test/keypair/testdata/ca.csr diff --git a/integration_test/keys/testdata/ca.key b/integration_test/keypair/testdata/ca.key similarity index 100% rename from integration_test/keys/testdata/ca.key rename to integration_test/keypair/testdata/ca.key diff --git a/integration_test/keys/testdata/ca.srl b/integration_test/keypair/testdata/ca.srl similarity index 100% rename from integration_test/keys/testdata/ca.srl rename to integration_test/keypair/testdata/ca.srl diff --git a/integration_test/keys/testdata/openssl.cnf b/integration_test/keypair/testdata/openssl.cnf similarity index 100% rename from integration_test/keys/testdata/openssl.cnf rename to integration_test/keypair/testdata/openssl.cnf diff --git a/integration_test/keys/testdata/server.crt b/integration_test/keypair/testdata/server.crt similarity index 100% rename from integration_test/keys/testdata/server.crt rename to integration_test/keypair/testdata/server.crt diff --git a/integration_test/keys/testdata/server.csr b/integration_test/keypair/testdata/server.csr similarity index 100% rename from integration_test/keys/testdata/server.csr rename to integration_test/keypair/testdata/server.csr diff --git a/integration_test/keys/testdata/server.key b/integration_test/keypair/testdata/server.key similarity index 100% rename from integration_test/keys/testdata/server.key rename to integration_test/keypair/testdata/server.key diff --git a/integration_test/localserver/authserver.go b/integration_test/localserver/authserver.go index 66a85983..d1e8be75 100644 --- a/integration_test/localserver/authserver.go +++ b/integration_test/localserver/authserver.go @@ -9,7 +9,7 @@ import ( "net/http" "testing" - "github.com/int128/kubelogin/integration_test/keys" + "github.com/int128/kubelogin/integration_test/keypair" ) type Shutdowner interface { @@ -31,8 +31,8 @@ func (s *shutdowner) Shutdown(t *testing.T, ctx context.Context) { // Start starts an authentication server. // If k is non-nil, it starts a TLS server. -func Start(t *testing.T, h http.Handler, k keys.Keys) (string, Shutdowner) { - if k == keys.None { +func Start(t *testing.T, h http.Handler, k keypair.KeyPair) (string, Shutdowner) { + if k == keypair.None { return startNoTLS(t, h) } return startTLS(t, h, k) @@ -54,7 +54,7 @@ func startNoTLS(t *testing.T, h http.Handler) (string, Shutdowner) { return url, &shutdowner{l, s} } -func startTLS(t *testing.T, h http.Handler, k keys.Keys) (string, Shutdowner) { +func startTLS(t *testing.T, h http.Handler, k keypair.KeyPair) (string, Shutdowner) { t.Helper() l, port := newLocalhostListener(t) url := "https://localhost:" + port diff --git a/integration_test/standalone_test.go b/integration_test/standalone_test.go index abe18649..c7b6f308 100644 --- a/integration_test/standalone_test.go +++ b/integration_test/standalone_test.go @@ -9,7 +9,7 @@ import ( "github.com/golang/mock/gomock" "github.com/int128/kubelogin/integration_test/idp" "github.com/int128/kubelogin/integration_test/idp/mock_idp" - "github.com/int128/kubelogin/integration_test/keys" + "github.com/int128/kubelogin/integration_test/keypair" "github.com/int128/kubelogin/integration_test/kubeconfig" "github.com/int128/kubelogin/integration_test/localserver" "github.com/int128/kubelogin/pkg/adaptors/browser" @@ -28,14 +28,14 @@ import ( // func TestStandalone(t *testing.T) { t.Run("NoTLS", func(t *testing.T) { - testStandalone(t, keys.None) + testStandalone(t, keypair.None) }) t.Run("TLS", func(t *testing.T) { - testStandalone(t, keys.Server) + testStandalone(t, keypair.Server) }) } -func testStandalone(t *testing.T, idpTLS keys.Keys) { +func testStandalone(t *testing.T, idpTLS keypair.KeyPair) { timeout := 5 * time.Second t.Run("Defaults", func(t *testing.T) { @@ -49,8 +49,12 @@ func testStandalone(t *testing.T, idpTLS keys.Keys) { serverURL, server := localserver.Start(t, idp.NewHandler(t, provider), idpTLS) defer server.Shutdown(t, ctx) browserMock := newBrowserMock(ctx, t, ctrl, idpTLS) - var idToken string - setupAuthCodeFlow(t, provider, serverURL, "openid", "http://localhost:", nil, &idToken) + cfg := authCodeFlowConfig{ + serverURL: serverURL, + scope: "openid", + redirectURIPrefix: "http://localhost:", + } + setupAuthCodeFlow(t, provider, &cfg) kubeConfigFilename := kubeconfig.Create(t, &kubeconfig.Values{ Issuer: serverURL, IDPCertificateAuthority: idpTLS.CACertPath, @@ -62,7 +66,7 @@ func testStandalone(t *testing.T, idpTLS keys.Keys) { } runRootCmd(t, ctx, browserMock, args) kubeconfig.Verify(t, kubeConfigFilename, kubeconfig.AuthProviderConfig{ - IDToken: idToken, + IDToken: cfg.idToken, RefreshToken: "YOUR_REFRESH_TOKEN", }) }) @@ -174,8 +178,12 @@ func testStandalone(t *testing.T, idpTLS keys.Keys) { provider := mock_idp.NewMockProvider(ctrl) serverURL, server := localserver.Start(t, idp.NewHandler(t, provider), idpTLS) defer server.Shutdown(t, ctx) - var idToken string - setupAuthCodeFlow(t, provider, serverURL, "openid", "http://localhost:", nil, &idToken) + cfg := authCodeFlowConfig{ + serverURL: serverURL, + scope: "openid", + redirectURIPrefix: "http://localhost:", + } + setupAuthCodeFlow(t, provider, &cfg) provider.EXPECT().Refresh("EXPIRED_REFRESH_TOKEN"). Return(nil, &idp.ErrorResponse{Code: "invalid_request", Description: "token has expired"}). MaxTimes(2) // package oauth2 will retry refreshing the token @@ -194,7 +202,7 @@ func testStandalone(t *testing.T, idpTLS keys.Keys) { } runRootCmd(t, ctx, browserMock, args) kubeconfig.Verify(t, kubeConfigFilename, kubeconfig.AuthProviderConfig{ - IDToken: idToken, + IDToken: cfg.idToken, RefreshToken: "YOUR_REFRESH_TOKEN", }) }) @@ -209,8 +217,12 @@ func testStandalone(t *testing.T, idpTLS keys.Keys) { provider := mock_idp.NewMockProvider(ctrl) serverURL, server := localserver.Start(t, idp.NewHandler(t, provider), idpTLS) defer server.Shutdown(t, ctx) - var idToken string - setupAuthCodeFlow(t, provider, serverURL, "openid", "http://localhost:", nil, &idToken) + cfg := authCodeFlowConfig{ + serverURL: serverURL, + scope: "openid", + redirectURIPrefix: "http://localhost:", + } + setupAuthCodeFlow(t, provider, &cfg) browserMock := newBrowserMock(ctx, t, ctrl, idpTLS) kubeConfigFilename := kubeconfig.Create(t, &kubeconfig.Values{ @@ -226,7 +238,7 @@ func testStandalone(t *testing.T, idpTLS keys.Keys) { } runRootCmd(t, ctx, browserMock, args) kubeconfig.Verify(t, kubeConfigFilename, kubeconfig.AuthProviderConfig{ - IDToken: idToken, + IDToken: cfg.idToken, RefreshToken: "YOUR_REFRESH_TOKEN", }) }) @@ -241,8 +253,12 @@ func testStandalone(t *testing.T, idpTLS keys.Keys) { provider := mock_idp.NewMockProvider(ctrl) serverURL, server := localserver.Start(t, idp.NewHandler(t, provider), idpTLS) defer server.Shutdown(t, ctx) - var idToken string - setupAuthCodeFlow(t, provider, serverURL, "profile groups openid", "http://localhost:", nil, &idToken) + cfg := authCodeFlowConfig{ + serverURL: serverURL, + scope: "profile groups openid", + redirectURIPrefix: "http://localhost:", + } + setupAuthCodeFlow(t, provider, &cfg) browserMock := newBrowserMock(ctx, t, ctrl, idpTLS) kubeConfigFilename := kubeconfig.Create(t, &kubeconfig.Values{ @@ -257,7 +273,7 @@ func testStandalone(t *testing.T, idpTLS keys.Keys) { } runRootCmd(t, ctx, browserMock, args) kubeconfig.Verify(t, kubeConfigFilename, kubeconfig.AuthProviderConfig{ - IDToken: idToken, + IDToken: cfg.idToken, RefreshToken: "YOUR_REFRESH_TOKEN", }) })