24799510282

Committed 22 Apr 2026 07:55PM UTC coverage: 60.303% (+2.0%) from 58.315%

Build # 24799510282

Build Type

Pull #6265

github

Committed by

web-flow

Commit Message

Merge 8bfee0186 into 7627e8e34

Pull Request Pull Request #6265: Generalize identity provider and implement OIDC discovery

Coverage Stats

20 of 122 new or added lines in 10 files covered. (16.39%)

1295 existing lines in 41 files now uncovered.

20269 of 33612 relevant lines covered (60.3%)

36.0 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

0.0

/internal/auth/github.go

// SPDX-FileCopyrightText: Copyright 2023 The Minder Authors
// SPDX-License-Identifier: Apache-2.0

// Package auth contains the authentication logic for the control plane
package auth

import (
        "context"
        "errors"
        "fmt"
        "strings"
)

// GetUserForGitHubId looks up a user in the identity provider by their GitHub ID.
//
// If the user is found, it returns their subject suitable for use in
// the `sub` claim of a JWT, and in OpenFGA's user field. Note that this function may
// return a user of "" with no error if no users were found matching the GitHub ID.
func GetUserForGitHubId(ctx context.Context, idClient Resolver, ghUser int64) (string, error) {
        // look up the user in the identity provider
        // TODO: For a generic identity provider, resolving by a raw numerical GitHub ID
        // might not work unless the provider specifically indexes 'gh_id' attributes (like Keycloak does).
        id, err := idClient.Resolve(ctx, fmt.Sprintf("%d", ghUser))
        if err != nil {
                // If the user is not found, return an empty string and no error
                if errors.Is(err, errors.New("user not found in identity store")) || strings.Contains(err.Error(), "not found") {
                        return "", nil
                }
                return "", err
        }

        return id.UserID, nil
}

1	// SPDX-FileCopyrightText: Copyright 2023 The Minder Authors
2	// SPDX-License-Identifier: Apache-2.0
3
4	// Package auth contains the authentication logic for the control plane
5	package auth
6
7	import (
8	"context"
9	"errors"
10	"fmt"
11	"strings"
12	)
13
14	// GetUserForGitHubId looks up a user in the identity provider by their GitHub ID.
15	//
16	// If the user is found, it returns their subject suitable for use in
17	// the `sub` claim of a JWT, and in OpenFGA's user field. Note that this function may
18	// return a user of "" with no error if no users were found matching the GitHub ID.
NEW 19	func GetUserForGitHubId(ctx context.Context, idClient Resolver, ghUser int64) (string, error) {	×
NEW 20	// look up the user in the identity provider	×
NEW 21	// TODO: For a generic identity provider, resolving by a raw numerical GitHub ID	×
NEW 22	// might not work unless the provider specifically indexes 'gh_id' attributes (like Keycloak does).	×
NEW 23	id, err := idClient.Resolve(ctx, fmt.Sprintf("%d", ghUser))	×
24	if err != nil {	×
NEW 25	// If the user is not found, return an empty string and no error	×
NEW 26	if errors.Is(err, errors.New("user not found in identity store")) \|\| strings.Contains(err.Error(), "not found") {	×
NEW 27	return "", nil	×
NEW 28	}	×
29	return "", err	×
30	}
31
NEW 32	return id.UserID, nil	×
33	}

mindersec / minder / 24799510282

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous