From c053cb8d0a06e243a5c283c8f7a247513fbb4e78 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Anderson=20Val=C3=A9rio?= <anderson.valerio@philips.com>
Date: Fri, 29 Nov 2024 15:14:58 -0300
Subject: [PATCH] isolating changes on oidc provider

---
 providers/oidc.go      | 41 ++----------------------------------
 providers/pics_oidc.go | 48 ++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 50 insertions(+), 39 deletions(-)
 create mode 100644 providers/pics_oidc.go

diff --git a/providers/oidc.go b/providers/oidc.go
index 0b664964..dae8f089 100644
--- a/providers/oidc.go
+++ b/providers/oidc.go
@@ -1,19 +1,15 @@
 package providers
 
 import (
-	"bytes"
 	"context"
-	b64 "encoding/base64"
 	"errors"
 	"fmt"
-	"net/http"
 	"net/url"
 	"time"
 
 	"github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/options"
 	"github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/sessions"
 	"github.com/oauth2-proxy/oauth2-proxy/v7/pkg/logger"
-	"github.com/oauth2-proxy/oauth2-proxy/v7/pkg/requests"
 	"golang.org/x/oauth2"
 )
 
@@ -98,7 +94,8 @@ func (p *OIDCProvider) Redeem(ctx context.Context, redirectURL, code, codeVerifi
 // EnrichSession is called after Redeem to allow providers to enrich session fields
 // such as User, Email, Groups with provider specific API calls.
 func (p *OIDCProvider) EnrichSession(ctx context.Context, s *sessions.SessionState) error {
-	err := p.enrichFromIntrospectURL(ctx, s)
+
+	err := p.PicsEnrichFromIntrospectURL(ctx, s)
 	if err != nil {
 		logger.Errorf("Warning: Introspect URL request failed: %v", err)
 	}
@@ -130,40 +127,6 @@ func (p *OIDCProvider) ValidateSession(ctx context.Context, s *sessions.SessionS
 	return true
 }
 
-// enrichFromIntrospectURL enriches a session's claims and permissions via the JSON response of
-// an OIDC Introspection URL
-func (p *OIDCProvider) enrichFromIntrospectURL(ctx context.Context, s *sessions.SessionState) error {
-	clientSecret, err := p.GetClientSecret()
-	if err != nil {
-		return err
-	}
-	params := url.Values{}
-	params.Add("token", s.AccessToken)
-	basicAuth := b64.StdEncoding.EncodeToString([]byte(fmt.Sprintf("%s:%s", p.ClientID, clientSecret)))
-	if p.IntrospectURL == nil {
-		p.IntrospectURL = &url.URL{
-			Scheme: p.RedeemURL.Scheme,
-			Host:   p.RedeemURL.Host,
-			Path:   "/authorize/oauth2/v4/introspect",
-		}
-	}
-	logger.Printf("Requesting introspect from '%s'", p.IntrospectURL)
-
-	result := requests.New(p.IntrospectURL.String()).
-		WithContext(ctx).
-		WithMethod("POST").
-		WithBody(bytes.NewBufferString(params.Encode())).
-		SetHeader("Authorization", fmt.Sprintf("Basic %s", basicAuth)).
-		SetHeader("Content-Type", "application/x-www-form-urlencoded").
-		Do()
-
-	if result.StatusCode() != http.StatusOK {
-		return fmt.Errorf("error while requesting introspect claims, status code - %d", result.StatusCode())
-	}
-	s.IntrospectClaims = b64.StdEncoding.EncodeToString(result.Body())
-	return nil
-}
-
 // RefreshSession uses the RefreshToken to fetch new Access and ID Tokens
 func (p *OIDCProvider) RefreshSession(ctx context.Context, s *sessions.SessionState) (bool, error) {
 	if s == nil || s.RefreshToken == "" {
diff --git a/providers/pics_oidc.go b/providers/pics_oidc.go
new file mode 100644
index 00000000..6ca2c7aa
--- /dev/null
+++ b/providers/pics_oidc.go
@@ -0,0 +1,48 @@
+package providers
+
+import (
+	"bytes"
+	"context"
+	b64 "encoding/base64"
+	"fmt"
+	"net/http"
+	"net/url"
+
+	"github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/sessions"
+	"github.com/oauth2-proxy/oauth2-proxy/v7/pkg/logger"
+	"github.com/oauth2-proxy/oauth2-proxy/v7/pkg/requests"
+)
+
+// enrichFromIntrospectURL enriches a session's claims and permissions via the JSON response of
+// an OIDC Introspection URL
+func (p *OIDCProvider) PicsEnrichFromIntrospectURL(ctx context.Context, s *sessions.SessionState) error {
+	clientSecret, err := p.GetClientSecret()
+	if err != nil {
+		return err
+	}
+	params := url.Values{}
+	params.Add("token", s.AccessToken)
+	basicAuth := b64.StdEncoding.EncodeToString([]byte(fmt.Sprintf("%s:%s", p.ClientID, clientSecret)))
+	if p.IntrospectURL == nil {
+		p.IntrospectURL = &url.URL{
+			Scheme: p.RedeemURL.Scheme,
+			Host:   p.RedeemURL.Host,
+			Path:   "/authorize/oauth2/v4/introspect",
+		}
+	}
+	logger.Printf("Requesting introspect from '%s'", p.IntrospectURL)
+
+	result := requests.New(p.IntrospectURL.String()).
+		WithContext(ctx).
+		WithMethod("POST").
+		WithBody(bytes.NewBufferString(params.Encode())).
+		SetHeader("Authorization", fmt.Sprintf("Basic %s", basicAuth)).
+		SetHeader("Content-Type", "application/x-www-form-urlencoded").
+		Do()
+
+	if result.StatusCode() != http.StatusOK {
+		return fmt.Errorf("error while requesting introspect claims, status code - %d", result.StatusCode())
+	}
+	s.IntrospectClaims = b64.StdEncoding.EncodeToString(result.Body())
+	return nil
+}