Skip to content

Commit cb98e18

Browse files
EmyrkEmyrk
committed
update golden files
1 parent e6c0a57 commit cb98e18

File tree

9 files changed

+105
-29
lines changed

9 files changed

+105
-29
lines changed

‎cli/testdata/coder_server_--help.golden

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -304,9 +304,19 @@ can safely ignore these settings.
304304
--oidc-auth-url-params struct[map[string]string], $CODER_OIDC_AUTH_URL_PARAMS (default: {"access_type": "offline"})
305305
OIDC auth URL parameters to pass to the upstream provider.
306306

307+
--oidc-client-cert-file string, $CODER_OIDC_CLIENT_CERT_FILE
308+
Pem encoded certificate file to use for oauth2 PKI/JWT authorization.
309+
The public certificate that accompanies oidc-client-key-file. A
310+
standard x509 certificate is expected.
311+
307312
--oidc-client-id string, $CODER_OIDC_CLIENT_ID
308313
Client ID to use for Login with OIDC.
309314

315+
--oidc-client-key-file string, $CODER_OIDC_CLIENT_KEY_FILE
316+
Pem encoded RSA private key to use for oauth2 PKI/JWT authorization.
317+
This can be used instead of oidc-client-secret if your IDP supports
318+
it.
319+
310320
--oidc-client-secret string, $CODER_OIDC_CLIENT_SECRET
311321
Client secret to use for Login with OIDC.
312322

‎coderd/apidoc/docs.go

Lines changed: 7 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎coderd/apidoc/swagger.json

Lines changed: 7 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎coderd/oauthpki/oidcpki.go

Lines changed: 12 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ package oauthpki
33
import (
44
"context"
55
"crypto/rsa"
6-
"crypto/sha1"
6+
"crypto/sha1" //#nosec // Not used for cryptography.
77
"crypto/x509"
88
"encoding/base64"
99
"encoding/json"
@@ -92,6 +92,8 @@ func NewOauth2PKIConfig(params ConfigParams) (*Config, error) {
9292
}
9393

9494
block, _ := pem.Decode(params.PemEncodedCert)
95+
// Used as an identifier, not an actual cryptographic hash.
96+
//nolint:gosec
9597
hashed := sha1.Sum(block.Bytes)
9698

9799
return &Config{
@@ -196,7 +198,13 @@ func (src *jwtTokenSource) Token() (*oauth2.Token, error) {
196198
"refresh_token": {src.refreshToken},
197199
}
198200
// Using params based auth
199-
resp, err := cli.PostForm(src.cfg.tokenURL, v)
201+
req, err := http.NewRequest("POST", src.cfg.tokenURL, strings.NewReader(v.Encode()))
202+
if err != nil {
203+
return nil, xerrors.Errorf("oauth2: make token refresh request: %w", err)
204+
}
205+
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
206+
req = req.WithContext(src.ctx)
207+
resp, err := cli.Do(req)
200208
if err != nil {
201209
return nil, xerrors.Errorf("oauth2: cannot get token: %w", err)
202210
}
@@ -235,7 +243,7 @@ func (src *jwtTokenSource) Token() (*oauth2.Token, error) {
235243
}
236244

237245
if unmarshalError != nil {
238-
return nil, fmt.Errorf("oauth2: cannot unmarshal token: %v", err)
246+
return nil, fmt.Errorf("oauth2: cannot unmarshal token: %w", err)
239247
}
240248

241249
newToken := &oauth2.Token{
@@ -256,7 +264,7 @@ func (src *jwtTokenSource) Token() (*oauth2.Token, error) {
256264
// decode returned id token to get expiry
257265
claimSet, err := jws.Decode(v)
258266
if err != nil {
259-
return nil, fmt.Errorf("oauth2: error decoding JWT token: %v", err)
267+
return nil, fmt.Errorf("oauth2: error decoding JWT token: %w", err)
260268
}
261269
newToken.Expiry = time.Unix(claimSet.Exp, 0)
262270
}

‎coderd/oauthpki/okidcpki_test.go

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -84,6 +84,8 @@ B1B7CpkMU55hPP+7nsofCszNrMDXT8Z5w2a3zLKM
8484
// It runs an oauth2.Exchange method and hijacks the request to only check the
8585
// request side of the transaction.
8686
func TestAzureADPKIOIDC(t *testing.T) {
87+
t.Parallel()
88+
8789
oauthCfg := &oauth2.Config{
8890
ClientID: "random-client-id",
8991
Endpoint: oauth2.Endpoint{
@@ -128,6 +130,8 @@ func TestAzureADPKIOIDC(t *testing.T) {
128130
// to prevent some regressions by running a full "e2e" oauth and asserting some
129131
// of the request values.
130132
func TestSavedAzureADPKIOIDC(t *testing.T) {
133+
t.Parallel()
134+
131135
var (
132136
stateString = "random-state"
133137
oauth2Code = base64.StdEncoding.EncodeToString([]byte("random-code"))
@@ -237,15 +241,17 @@ func TestSavedAzureADPKIOIDC(t *testing.T) {
237241
}
238242

239243
return nil, xerrors.Errorf("not implemented")
240-
}},
244+
},
245+
},
241246
}
242247
fakeCtx = oidc.ClientContext(context.Background(), fakeClient)
243-
var _ = fakeCtx
248+
_ = fakeCtx
244249

245250
// This simulates a client logging into the browser. The 307 redirect will
246251
// make sure this goes through the full flow.
247-
_, err = fakeClient.Get(pki.AuthCodeURL("state", oauth2.AccessTypeOffline))
252+
resp, err := fakeClient.Get(pki.AuthCodeURL("state", oauth2.AccessTypeOffline))
248253
require.NoError(t, err)
254+
_ = resp.Body.Close()
249255

250256
require.True(t, initialExchange, "initial token exchange complete")
251257
require.True(t, tokenRefreshed, "token was refreshed")

‎docs/api/general.md

Lines changed: 2 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎docs/api/schemas.md

Lines changed: 30 additions & 22 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎docs/cli/server.md

Lines changed: 18 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎enterprise/cli/testdata/coder_server_--help.golden

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -304,9 +304,19 @@ can safely ignore these settings.
304304
--oidc-auth-url-params struct[map[string]string], $CODER_OIDC_AUTH_URL_PARAMS (default: {"access_type": "offline"})
305305
OIDC auth URL parameters to pass to the upstream provider.
306306

307+
--oidc-client-cert-file string, $CODER_OIDC_CLIENT_CERT_FILE
308+
Pem encoded certificate file to use for oauth2 PKI/JWT authorization.
309+
The public certificate that accompanies oidc-client-key-file. A
310+
standard x509 certificate is expected.
311+
307312
--oidc-client-id string, $CODER_OIDC_CLIENT_ID
308313
Client ID to use for Login with OIDC.
309314

315+
--oidc-client-key-file string, $CODER_OIDC_CLIENT_KEY_FILE
316+
Pem encoded RSA private key to use for oauth2 PKI/JWT authorization.
317+
This can be used instead of oidc-client-secret if your IDP supports
318+
it.
319+
310320
--oidc-client-secret string, $CODER_OIDC_CLIENT_SECRET
311321
Client secret to use for Login with OIDC.
312322

0 commit comments

Comments
 (0)