go-pkgz / auth
85%

DEFAULT BRANCH: master
Repo Added
Files 25
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst

LAST BUILD ON BRANCH master
branch: master
CHANGE BRANCH
x

coverage: 85.323% (+0.1%) from 85.199%
25620289937

push

github

umputun 
fix(verify): close service-level typed-nil store + adapter-author guidance

Followups to #281 (verify replay protection) raised on the post-merge
review. None blocking, all small.

1. Service-level typed-nil VerifConfirmationStoreFunc guard. The
   handler-level guard added in round 2 normalizes a typed-nil func to
   nil, but the AddVerifProvider check at auth.go was still a plain
   `s.opts.VerifConfirmationStore != nil` test. A typed-nil
   VerifConfirmationStoreFunc is a non-nil interface wrapping a nil
   func, so it survived that check, the in-memory default was skipped,
   and at redemption the handler's typed-nil guard normalized it to
   nil — net result: a user who wrote
   `Opts{VerifConfirmationStore: VerifConfirmationStoreFunc(nil)}`
   got neither their func nor the default, and replay protection was
   silently disabled for that exact configuration.

   Same shape as the *avatar.Proxy typed-nil case fixed in #286 with a
   different consequence (silent loss of protection vs panic). Apply
   the same shape of guard one layer up. New regression test
   TestService_AddVerifProvider_TypedNilStoreFuncFallsBackToDefault in
   both v1 and v2.

2. gofmt -w on auth.go / v2/auth.go. The verifConfirmStoreO ->
   verifConfirmStoreOnce rename in #281 made the field longer than the
   surrounding column alignment. Cosmetic; CI doesn't enforce gofmt
   but a noisy IDE-on-save diff for the next contributor.

3. scrubTokenFromRequest unit test (TestScrubTokenFromRequest) in both
   v1 and v2 — covers the defensive early-return that coveralls flagged
   as uncovered after #281 (token-missing returns r unchanged, nil r
   returns nil, token-present returns redacted clone with other query
   params preserved).

4. Adapter-author guidance on VerifConfirmationStore.MarkUsed godoc:
   tells external Redis/DB adapter authors not to embed the supplied
   key in returned errors, since the handler logs err on the
   fail-closed branch and the key is the SHA-256 o... (continued)

10 of 10 new or added lines in 1 file covered. (100.0%)

2988 of 3502 relevant lines covered (85.32%)

8.18 hits per line

Relevant lines Covered
3502 RELEVANT LINES 2988 COVERED LINES
8.18 HITS PER LINE
Source Files on master

Recent builds

Builds Branch Commit Type Ran Committer Via Coverage
25620289937 master fix(verify): close service-level typed-nil store + adapter-author guidance Followups to #281 (verify replay protection) raised on the post-merge review. None blocking, all small. 1. Service-level typed-nil VerifConfirmationStoreFunc guard. The ... push umputun github
85.32
25620289928 master fix(verify): close service-level typed-nil store + adapter-author guidance Followups to #281 (verify replay protection) raised on the post-merge review. None blocking, all small. 1. Service-level typed-nil VerifConfirmationStoreFunc guard. The ... push umputun github
85.29
25606477506 master fix(verify): one-shot consumption of email confirmation tokens The email confirmation JWT issued by VerifyHandler.sendConfirmation was only protected by its 30-minute expiry: any party who could read the confirmation link (forwarded email, mail-g... push umputun github
85.2
25606477509 master fix(verify): one-shot consumption of email confirmation tokens The email confirmation JWT issued by VerifyHandler.sendConfirmation was only protected by its 30-minute expiry: any party who could read the confirmation link (forwarded email, mail-g... push umputun github
85.23
25606245315 master fix(apple): validate id_token iss and aud on Sign in with Apple After ParseWithClaims succeeded the Apple handler accepted any token Apple had signed, regardless of which Sign-in-with-Apple client it was issued to. The relying party MUST verify i... push umputun github
85.0
25606245284 master fix(apple): validate id_token iss and aud on Sign in with Apple After ParseWithClaims succeeded the Apple handler accepted any token Apple had signed, regardless of which Sign-in-with-Apple client it was issued to. The relying party MUST verify i... push umputun github
85.03
25592801771 master fix(telegram): never expose bot token in avatar URL tgAPI.Avatar returned a URL with the bot token embedded in its path: https://api.telegram.org/file/bot{TOKEN}/photos/file_X.jpg The token is a bearer credential for the entire bot API. The... push umputun github
84.97
25592801746 master fix(telegram): never expose bot token in avatar URL tgAPI.Avatar returned a URL with the bot token embedded in its path: https://api.telegram.org/file/bot{TOKEN}/photos/file_X.jpg The token is a bearer credential for the entire bot API. The... push umputun github
84.93
25592713665 master fix(provider): backport "from" redirect validator to v1 (sibling of #275) The "from" query parameter accepted by oauth1/oauth2/apple/verify login handlers was stored verbatim in the handshake JWT and used as the redirect target after a successful... push umputun github
84.9
25592713657 master fix(provider): backport "from" redirect validator to v1 (sibling of #275) The "from" query parameter accepted by oauth1/oauth2/apple/verify login handlers was stored verbatim in the handshake JWT and used as the redirect target after a successful... push umputun github
84.94
See All Builds (1045)