Repository: clouditor/clouditor
Pull request #565 (2022-03-10 16:41:36)

Changed auth URLs back to `/v1/auth`

codecov[bot]: # [Codecov](https://codecov.io/gh/clouditor/clouditor/pull/565?src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=clouditor) Report
> Merging [#565](https://codecov.io/gh/clouditor/clouditor/pull/565?src=pr&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=clouditor) (e775939) into [main](https://codecov.io/gh/clouditor/clouditor/commit/ef0d8fbe58d0b7021ba9d364ff332b5236ac716c?el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=clouditor) (ef0d8fb) will **increase** coverage by `0.19%`.
> The diff coverage is `85.71%`.

> :exclamation: Current head e775939 differs from pull request most recent head 3ed6fcd. Consider uploading reports for the commit 3ed6fcd to get more accurate results

[![Impacted file tree graph](https://codecov.io/gh/clouditor/clouditor/pull/565/graphs/tree.svg?width=650&height=150&src=pr&token=syrXsw5LTX&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=clouditor)](https://codecov.io/gh/clouditor/clouditor/pull/565?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=clouditor)

```diff
@@            Coverage Diff             @@
##             main     #565      +/-   ##
==========================================
+ Coverage   82.15%   82.35%   +0.19%     
==========================================
  Files          53       53              
  Lines        4797     4799       +2     
==========================================
+ Hits         3941     3952      +11     
+ Misses        661      655       -6     
+ Partials      195      192       -3     
```

| Flag | Coverage Δ | |
|---|---|---|
| unittests | `82.35% <85.71%> (+0.19%)` | :arrow_up: |

Flags with carried forward coverage won't be shown. [Click here](https://docs.codecov.io/docs/carryforward-flags?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=clouditor#carryforward-flags-in-the-pull-request-comment) to find out more.

| [Impacted Files](https://codecov.io/gh/clouditor/clouditor/pull/565?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=clouditor) | Coverage Δ | |
|---|---|---|
| [rest/rest.go](https://codecov.io/gh/clouditor/clouditor/pull/565/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=clouditor#diff-cmVzdC9yZXN0Lmdv) | `76.64% <57.14%> (+5.31%)` | :arrow_up: |
| [cli/commands/login/login.go](https://codecov.io/gh/clouditor/clouditor/pull/565/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=clouditor#diff-Y2xpL2NvbW1hbmRzL2xvZ2luL2xvZ2luLmdv) | `81.37% <100.00%> (ø)` | |
| [cmd/engine/engine.go](https://codecov.io/gh/clouditor/clouditor/pull/565/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=clouditor#diff-Y21kL2VuZ2luZS9lbmdpbmUuZ28=) | `82.80% <100.00%> (+0.06%)` | :arrow_up: |
| [internal/testutil/auth.go](https://codecov.io/gh/clouditor/clouditor/pull/565/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=clouditor#diff-aW50ZXJuYWwvdGVzdHV0aWwvYXV0aC5nbw==) | `92.10% <100.00%> (+1.78%)` | :arrow_up: |

------

[Continue to review full report at Codecov](https://codecov.io/gh/clouditor/clouditor/pull/565?src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=clouditor).
> **Legend** - [Click here to learn more](https://docs.codecov.io/docs/codecov-delta?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=clouditor)
> `Δ = absolute <relative> (impact)`, `ø = not affected`, `? = missing data`
> Powered by [Codecov](https://codecov.io/gh/clouditor/clouditor/pull/565?src=pr&el=footer&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=clouditor). Last update [ef0d8fb...3ed6fcd](https://codecov.io/gh/clouditor/clouditor/pull/565?src=pr&el=lastupdated&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=clouditor). Read the [comment docs](https://docs.codecov.io/docs/pull-request-comments?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=clouditor).


Patch:
diff --git a/cli/commands/login/login.go b/cli/commands/login/login.go
index edd83412..7bf1f7cb 100644
--- a/cli/commands/login/login.go
+++ b/cli/commands/login/login.go
@@ -88,8 +88,8 @@ func NewLoginCommand() *cobra.Command {
 			config = &oauth2.Config{
 				ClientID: DefaultClientID,
 				Endpoint: oauth2.Endpoint{
-					AuthURL:  fmt.Sprintf("%s/authorize", authURL),
-					TokenURL: fmt.Sprintf("%s/token", authURL),
+					AuthURL:  fmt.Sprintf("%s/v1/auth/authorize", authURL),
+					TokenURL: fmt.Sprintf("%s/v1/auth/token", authURL),
 				},
 				RedirectURL: DefaultCallback,
 			}
diff --git a/cmd/engine/engine.go b/cmd/engine/engine.go
index cc1dcb85..35bef0ee 100644
--- a/cmd/engine/engine.go
+++ b/cmd/engine/engine.go
@@ -96,7 +96,7 @@ const (
 	DefaultAPIDefaultPassword           = "clouditor"
 	DefaultAPIgRPCPort                  = 9090
 	DefaultAPIStartEmbeddedOAuth2Server = true
-	DefaultServiceOAuth2Endpoint        = "http://localhost:8080/token"
+	DefaultServiceOAuth2Endpoint        = "http://localhost:8080/v1/auth/token"
 	DefaultServiceOAuth2ClientID        = "clouditor"
 	DefaultServiceOAuth2ClientSecret    = "clouditor"
 	DefaultDBUserName                   = "postgres"
@@ -352,6 +352,7 @@ func doCmd(_ *cobra.Command, _ []string) (err error) {
 						viper.GetString(APIDefaultUserFlag),
 						viper.GetString(APIDefaultPasswordFlag),
 					),
+					login.WithBaseURL("/v1/auth"),
 				),
 			),
 		}
diff --git a/go.mod b/go.mod
index e58fd003..ab1680fb 100644
--- a/go.mod
+++ b/go.mod
@@ -26,7 +26,7 @@ require (
 	github.com/logrusorgru/aurora/v3 v3.0.0
 	github.com/mitchellh/mapstructure v1.4.3
 	github.com/open-policy-agent/opa v0.38.0
-	github.com/oxisto/oauth2go v0.5.9
+	github.com/oxisto/oauth2go v0.5.12
 	github.com/sirupsen/logrus v1.8.1
 	github.com/spf13/cobra v1.3.0
 	github.com/spf13/viper v1.10.0
diff --git a/go.sum b/go.sum
index 517273b5..8655fb38 100644
--- a/go.sum
+++ b/go.sum
@@ -570,8 +570,8 @@ github.com/onsi/gomega v1.10.1/go.mod h1:iN09h71vgCQne3DLsj+A5owkum+a2tYe+TOCB1y
 github.com/open-policy-agent/opa v0.38.0 h1:XuGM6yZmHCPO4o1JJGs8pKuoC/vMFkr4pjBVhFLrOk8=
 github.com/open-policy-agent/opa v0.38.0/go.mod h1:z0+Gw2+Re8cEf4/GjHr/wAL1diGy8BkhICIiCUb8y6A=
 github.com/opentracing/opentracing-go v1.1.0/go.mod h1:UkNAQd3GIcIGf0SeVgPpRdFStlNbqXla1AfSYxPUl2o=
-github.com/oxisto/oauth2go v0.5.9 h1:UfQyX6D13jG3ExV9Mc3AGnhuTDz+lrgVzOSekm1X27o=
-github.com/oxisto/oauth2go v0.5.9/go.mod h1:fwpFZP2oyIbpuVr3I2fYzYqOMdVK06rdR9rLl4S41Pk=
+github.com/oxisto/oauth2go v0.5.12 h1:Uq+iSX2A9RrKuRHcpLarx0+QELFkGlN5cJVmTyXzBiU=
+github.com/oxisto/oauth2go v0.5.12/go.mod h1:fwpFZP2oyIbpuVr3I2fYzYqOMdVK06rdR9rLl4S41Pk=
 github.com/pascaldekloe/goe v0.0.0-20180627143212-57f6aae5913c/go.mod h1:lzWF7FIEvWOWxwDKqyGYQf6ZUaNfKdP144TG7ZOy1lc=
 github.com/pascaldekloe/goe v0.1.0/go.mod h1:lzWF7FIEvWOWxwDKqyGYQf6ZUaNfKdP144TG7ZOy1lc=
 github.com/pelletier/go-toml v1.2.0/go.mod h1:5z9KED0ma1S8pY6P1sdut58dfprrGBbd/94hg7ilaic=
diff --git a/rest/rest.go b/rest/rest.go
index a54644f6..7d1581dc 100644
--- a/rest/rest.go
+++ b/rest/rest.go
@@ -152,22 +152,17 @@ func WithEmbeddedOAuth2Server(keyPath string, keyPassword string, saveOnCreate b
 		}))
 
 		authSrv := oauth2.NewServer("", opts...)
+		authHandler := func(w http.ResponseWriter, r *http.Request, pathParams map[string]string) {
+			http.StripPrefix("/v1/auth", authSrv.Handler).ServeHTTP(w, r)
+		}
 
 		WithAdditionalHandler("GET", "/.well-known/jwks.json", func(w http.ResponseWriter, r *http.Request, pathParams map[string]string) {
 			authSrv.Handler.(*http.ServeMux).ServeHTTP(w, r)
 		})(cc, sm)
-		WithAdditionalHandler("GET", "/login", func(w http.ResponseWriter, r *http.Request, pathParams map[string]string) {
-			authSrv.Handler.(*http.ServeMux).ServeHTTP(w, r)
-		})(cc, sm)
-		WithAdditionalHandler("GET", "/authorize", func(w http.ResponseWriter, r *http.Request, pathParams map[string]string) {
-			authSrv.Handler.(*http.ServeMux).ServeHTTP(w, r)
-		})(cc, sm)
-		WithAdditionalHandler("POST", "/login", func(w http.ResponseWriter, r *http.Request, pathParams map[string]string) {
-			authSrv.Handler.(*http.ServeMux).ServeHTTP(w, r)
-		})(cc, sm)
-		WithAdditionalHandler("POST", "/token", func(w http.ResponseWriter, r *http.Request, pathParams map[string]string) {
-			authSrv.Handler.(*http.ServeMux).ServeHTTP(w, r)
-		})(cc, sm)
+		WithAdditionalHandler("GET", "/v1/auth/login", authHandler)(cc, sm)
+		WithAdditionalHandler("GET", "/v1/auth/authorize", authHandler)(cc, sm)
+		WithAdditionalHandler("POST", "/v1/auth/login", authHandler)(cc, sm)
+		WithAdditionalHandler("POST", "/v1/auth/token", authHandler)(cc, sm)
 	}
 }
 


Test patch:
diff --git a/api/authorizer_test.go b/api/authorizer_test.go
index cbf88c15..4ae9a2c5 100644
--- a/api/authorizer_test.go
+++ b/api/authorizer_test.go
@@ -28,31 +28,23 @@ package api
 import (
 	"context"
 	"fmt"
-	"net"
 	"net/http"
 	"reflect"
 	"testing"
 
+	"clouditor.io/clouditor/internal/testutil"
 	oauth2 "github.com/oxisto/oauth2go"
 	"github.com/stretchr/testify/assert"
 	"golang.org/x/oauth2/clientcredentials"
 )
 
 func Test_oauthAuthorizer_Token(t *testing.T) {
-	// start an embedded oauth server
-	srv := oauth2.NewServer(":0", oauth2.WithClient("client", "secret", ""))
-
-	ln, err := net.Listen("tcp", srv.Addr)
-	assert.NoError(t, err)
-
-	port := ln.Addr().(*net.TCPAddr).Port
-
-	go func() {
-		err = srv.Serve(ln)
-		if err != http.ErrServerClosed {
-			assert.NoError(t, err)
-		}
-	}()
+	var (
+		srv  *oauth2.AuthorizationServer
+		port int
+		err  error
+	)
+	srv, port, err = testutil.StartAuthenticationServer()
 
 	defer func() {
 		err = srv.Close()
@@ -79,9 +71,9 @@ func Test_oauthAuthorizer_Token(t *testing.T) {
 			fields: fields{
 				TokenSource: oauth2.ReuseTokenSource(nil,
 					(&clientcredentials.Config{
-						ClientID:     "client",
-						ClientSecret: "secret",
-						TokenURL:     fmt.Sprintf("http://localhost:%d/token", port),
+						ClientID:     testutil.TestAuthClientID,
+						ClientSecret: testutil.TestAuthClientSecret,
+						TokenURL:     fmt.Sprintf("http://localhost:%d/v1/auth/token", port),
 					}).TokenSource(context.Background()),
 				),
 			},
@@ -116,9 +108,9 @@ func Test_oauthAuthorizer_Token(t *testing.T) {
 
 func TestNewOAuthAuthorizerFromClientCredentials(t *testing.T) {
 	var config = clientcredentials.Config{
-		ClientID:     "client",
-		ClientSecret: "secret",
-		TokenURL:     "/token",
+		ClientID:     testutil.TestAuthClientID,
+		ClientSecret: testutil.TestAuthClientSecret,
+		TokenURL:     "/v1/auth/token",
 	}
 
 	type args struct {
diff --git a/internal/testutil/auth.go b/internal/testutil/auth.go
index d98b9159..b6e27434 100644
--- a/internal/testutil/auth.go
+++ b/internal/testutil/auth.go
@@ -3,6 +3,7 @@ package testutil
 import (
 	"fmt"
 	"net"
+	"net/http"
 
 	oauth2 "github.com/oxisto/oauth2go"
 	"github.com/oxisto/oauth2go/login"
@@ -13,8 +14,8 @@ const (
 	TestAuthUser     = "clouditor"
 	TestAuthPassword = "clouditor"
 
-	TestAuthClientID     = "clouditor"
-	TestAuthClientSecret = "clouditor"
+	TestAuthClientID     = "client"
+	TestAuthClientSecret = "secret"
 )
 
 // StartAuthenticationServer starts an authentication server on a random port with
@@ -24,10 +25,17 @@ func StartAuthenticationServer() (srv *oauth2.AuthorizationServer, port int, err
 
 	srv = oauth2.NewServer(":0",
 		oauth2.WithClient("cli", "", "http://localhost:10000/callback"),
-		login.WithLoginPage(login.WithUser(TestAuthUser, TestAuthPassword)),
+		oauth2.WithClient(TestAuthClientID, TestAuthClientSecret, ""),
+		login.WithLoginPage(
+			login.WithUser(TestAuthUser, TestAuthPassword),
+			login.WithBaseURL("/v1/auth"),
+		),
 	)
 
-	// create a new socket for gRPC communication
+	// simulate the /v1/auth endpoints
+	srv.Handler.(*http.ServeMux).Handle("/v1/auth/token", http.StripPrefix("/v1/auth", srv.Handler))
+
+	// create a new socket for HTTP communication
 	nl, err = net.Listen("tcp", srv.Addr)
 	if err != nil {
 		return nil, 0, fmt.Errorf("could not listen: %w", err)
@@ -47,11 +55,11 @@ func JWKSURL(port int) string {
 }
 
 func TokenURL(port int) string {
-	return fmt.Sprintf("http://localhost:%d/token", port)
+	return fmt.Sprintf("http://localhost:%d/v1/auth/token", port)
 }
 
 func AuthURL(port int) string {
-	return fmt.Sprintf("http://localhost:%d/authorize", port)
+	return fmt.Sprintf("http://localhost:%d/v1/auth/authorize", port)
 }
 
 func AuthClientConfig(port int) *clientcredentials.Config {
diff --git a/service/auth_middleware_test.go b/service/auth_middleware_test.go
index 608e4049..90f2e6df 100644
--- a/service/auth_middleware_test.go
+++ b/service/auth_middleware_test.go
@@ -53,7 +53,7 @@ func ValidClaimAssertion(tt assert.TestingT, i1 interface{}, _ ...interface{}) b
 		return false
 	}
 
-	if claims.Subject != "clouditor" {
+	if claims.Subject != testutil.TestAuthClientID {
 		tt.Errorf("Subject is not correct")
 		return true
 	}
diff --git a/service/discovery/discovery_test.go b/service/discovery/discovery_test.go
index 399767d8..1f0ba494 100644
--- a/service/discovery/discovery_test.go
+++ b/service/discovery/discovery_test.go
@@ -408,8 +408,8 @@ func TestService_initAssessmentStream(t *testing.T) {
 
 	type fields struct {
 		hasRPCConnection bool
-		username         string
-		password         string
+		clientID         string
+		clientSecret     string
 	}
 
 	tests := []struct {
@@ -436,20 +436,20 @@ func TestService_initAssessmentStream(t *testing.T) {
 			},
 		},
 		{
-			name: "Authenticated RPC connection with valid user",
+			name: "Authenticated RPC connection with valid client credentials",
 			fields: fields{
 				hasRPCConnection: true,
-				username:         "clouditor",
-				password:         "clouditor",
+				clientID:         testutil.TestAuthClientID,
+				clientSecret:     testutil.TestAuthClientSecret,
 			},
 			wantErr: nil,
 		},
 		{
-			name: "Authenticated RPC connection with invalid user",
+			name: "Authenticated RPC connection with invalid client credentials",
 			fields: fields{
 				hasRPCConnection: true,
-				username:         "notclouditor",
-				password:         "password",
+				clientID:         "not" + testutil.TestAuthClientID,
+				clientSecret:     testutil.TestAuthClientSecret,
 			},
 			wantErr: func(tt assert.TestingT, err error, i ...interface{}) bool {
 				s, _ := status.FromError(errors.Unwrap(err))
@@ -461,8 +461,8 @@ func TestService_initAssessmentStream(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			s := NewService(WithOAuth2Authorizer(&clientcredentials.Config{
-				ClientID:     testutil.TestAuthClientID,
-				ClientSecret: testutil.TestAuthClientSecret,
+				ClientID:     tt.fields.clientID,
+				ClientSecret: tt.fields.clientSecret,
 				TokenURL:     testutil.TokenURL(port),
 			}))