diff options
| -rw-r--r-- | app/controllers/sessions/controller.go | 1 | ||||
| -rw-r--r-- | app/controllers/sessions/controller_test.go | 19 | ||||
| -rw-r--r-- | app/init.go | 2 |
3 files changed, 19 insertions, 3 deletions
diff --git a/app/controllers/sessions/controller.go b/app/controllers/sessions/controller.go index ba3d112..7b6c871 100644 --- a/app/controllers/sessions/controller.go +++ b/app/controllers/sessions/controller.go @@ -20,6 +20,7 @@ func (c *Controller) MountTo(mux *http.ServeMux) { } func (c *Controller) New(w http.ResponseWriter, r *http.Request) { + // TODO:: Generate and store nonce and use as state param to compare as a CSRF token url := c.cfg.Config.AuthCodeURL("todo-csrf-token", oauth2.SetAuthURLParam("audience", "todo")) http.Redirect(w, r, url, http.StatusFound) } diff --git a/app/controllers/sessions/controller_test.go b/app/controllers/sessions/controller_test.go index 5018e0c..d90896e 100644 --- a/app/controllers/sessions/controller_test.go +++ b/app/controllers/sessions/controller_test.go @@ -49,8 +49,8 @@ func TestSessions(t *testing.T) { mux := http.NewServeMux() controller.MountTo(mux) - t.Run("GET /", func(t *testing.T) { - t.Run("Without an authenticated session", func(t *testing.T) { + t.Run("GET /session/new", func(t *testing.T) { + t.Run("without an authenticated session", func(t *testing.T) { t.Run("redirect to the OIDC Provider", func(t *testing.T) { r, w := test.RequestResponse("GET", "/session/new") @@ -69,6 +69,21 @@ func TestSessions(t *testing.T) { assert.Equal(t, cfg.Config.RedirectURL, redirectURL.Query().Get("redirect_uri")) assert.Equal(t, "code", redirectURL.Query().Get("response_type")) }) + + t.Run("generates a CSRF token", func(t *testing.T) {}) + }) + + t.Run("with an active authenicated session", func(t *testing.T) {}) + t.Run("with an expired authenicated session", func(t *testing.T) {}) + }) + + t.Run("GET /session/callback", func(t *testing.T) { + t.Run("with an invalid csrf token", func(t *testing.T) {}) + t.Run("with an invalid authorization code grant", func(t *testing.T) {}) + t.Run("with a valid authorization code grant", func(t *testing.T) { + t.Run("stores the id token in a session cookie", func(t *testing.T) {}) + t.Run("stores the access token in a session cookie", func(t *testing.T) {}) + t.Run("redirects to the homepage", func(t *testing.T) {}) }) }) } diff --git a/app/init.go b/app/init.go index 9bffde8..bbfb6da 100644 --- a/app/init.go +++ b/app/init.go @@ -33,7 +33,7 @@ func init() { env.Fetch("OIDC_ISSUER", "https://gitlab.com"), env.Fetch("OAUTH_CLIENT_ID", "client_id"), env.Fetch("OAUTH_CLIENT_SECRET", "client_secret"), - env.Fetch("OAUTH_REDIRECT_URL", "https://localhost/session/callback"), + env.Fetch("OAUTH_REDIRECT_URL", "http://localhost:8080/session/callback"), ) if err != nil { log.Fatal(err) |