reverting changes that only cause conflicts

pkg/apis/options/load_test.go

@@ -414,6 +414,7 @@ sub:
 				} else {
 					input = &TestOptions{}
 				}
+
 				err := LoadYAML(configFileName, input)
 				if in.expectedErr != nil {
 					Expect(err).To(MatchError(in.expectedErr.Error()))

pkg/apis/options/providers.go

@@ -85,6 +85,7 @@ type Provider struct {
 	AllowedGroups []string `json:"allowedGroups,omitempty"`
 	// The code challenge method
 	CodeChallengeMethod string `json:"code_challenge_method,omitempty"`
+
 	// URL to call to perform backend logout, `{id_token}` would be replaced by the actual `id_token` if available in the session
 	BackendLogoutURL string `json:"backendLogoutURL"`
 }

pkg/cookies/cookies.go

@@ -35,12 +35,12 @@ func MakeCookieFromOptions(req *http.Request, name string, value string, opts *o
 		SameSite: ParseSameSite(opts.SameSite),
 	}
 
-	warnInvalidDomain(c, req)
-
 	if expiration != time.Duration(0) {
 		c.Expires = now.Add(expiration)
 	}
 
+	warnInvalidDomain(c, req)
+
 	return c
 }
 

pkg/cookies/csrf_test.go

@@ -28,10 +28,10 @@ var _ = Describe("CSRF Cookie Tests", func() {
 			Domains:        []string{cookieDomain},
 			Path:           cookiePath,
 			Expire:         time.Hour,
-			CSRFExpire:     time.Hour,
 			Secure:         true,
 			HTTPOnly:       true,
 			CSRFPerRequest: false,
+			CSRFExpire:     time.Hour,
 		}
 
 		var err error

pkg/encryption/utils.go

@@ -58,7 +58,8 @@ func Validate(cookie *http.Cookie, seed string, expiration time.Duration) (value
 		// creation timestamp stored in the cookie falls within the
 		// window defined by (Now()-expiration, Now()].
 		t = time.Unix(int64(ts), 0)
-		if (expiration == time.Duration(0)) || t.After(time.Now().Add(expiration*-1)) && t.Before(time.Now().Add(time.Minute*5)) { // it's a valid cookie. now get the contents
+		if (expiration == time.Duration(0)) || (t.After(time.Now().Add(expiration*-1)) && t.Before(time.Now().Add(time.Minute*5))) {
+			// it's a valid cookie. now get the contents
 			rawValue, err := base64.URLEncoding.DecodeString(parts[0])
 			if err == nil {
 				value = rawValue

pkg/encryption/utils_test.go

@@ -106,23 +106,6 @@ func TestSignAndValidate(t *testing.T) {
 	assert.False(t, checkSignature(sha1sig, seed, key, "tampered", epoch))
 }
 
-func TestGenerateRandomASCIIString(t *testing.T) {
-	randomString, err := GenerateRandomASCIIString(96)
-	assert.NoError(t, err)
-
-	// Only 8-bit characters
-	assert.Equal(t, 96, len([]byte(randomString)))
-
-	// All non-ascii characters removed should still be the original string
-	removedChars := strings.Map(func(r rune) rune {
-		if r > unicode.MaxASCII {
-			return -1
-		}
-		return r
-	}, randomString)
-	assert.Equal(t, removedChars, randomString)
-}
-
 func TestValidate(t *testing.T) {
 	seed := "0123456789abcdef"
 	key := "cookie-name"
@@ -146,3 +129,20 @@ func TestValidate(t *testing.T) {
 	assert.NoError(t, err)
 	assert.Equal(t, validValue, expectedValue)
 }
+
+func TestGenerateRandomASCIIString(t *testing.T) {
+	randomString, err := GenerateRandomASCIIString(96)
+	assert.NoError(t, err)
+
+	// Only 8-bit characters
+	assert.Equal(t, 96, len([]byte(randomString)))
+
+	// All non-ascii characters removed should still be the original string
+	removedChars := strings.Map(func(r rune) rune {
+		if r > unicode.MaxASCII {
+			return -1
+		}
+		return r
+	}, randomString)
+	assert.Equal(t, removedChars, randomString)
+}

pkg/sessions/persistence/ticket.go

@@ -129,7 +129,6 @@ func decodeTicket(encTicket string, cookieOpts *options.Cookie) (*ticket, error)
 	if errSecret != nil {
 		return nil, fmt.Errorf("failed to decode ticket: %v", errSecret)
 	}
-
 	return &ticket{
 		id:      ticketID,
 		secret:  secret,

pkg/util/util.go

@@ -18,6 +18,7 @@ func GetCertPool(paths []string, useSystemPool bool) (*x509.CertPool, error) {
 	if len(paths) == 0 {
 		return nil, fmt.Errorf("invalid empty list of Root CAs file paths")
 	}
+
 	var pool *x509.CertPool
 	if useSystemPool {
 		rootPool, err := getSystemCertPool()

pkg/util/util_test.go

@@ -217,6 +217,7 @@ func TestGetCertPool(t *testing.T) {
 
 	certFile1 := makeTestCertFile(t, root1Cert, tempDir)
 	certFile2 := makeTestCertFile(t, root2Cert, tempDir)
+
 	for _, tc := range tests {
 		// Append certs to "known" pool so we can compare them
 		assert.True(t, tc.pool.AppendCertsFromPEM([]byte(root1Cert)))

pkg/validation/options.go

@@ -77,7 +77,6 @@ func Validate(o *options.Options) error {
 
 	var redirectURL *url.URL
 	redirectURL, msgs = parseURL(o.RawRedirectURL, "redirect", msgs)
-
 	o.SetRedirectURL(redirectURL)
 	if o.RawRedirectURL == "" && !o.Cookie.Secure && !o.ReverseProxy {
 		logger.Print("WARNING: no explicit redirect URL: redirects will default to insecure HTTP")

pkg/validation/providers.go

@@ -75,6 +75,7 @@ func validateGoogleConfig(provider options.Provider) []string {
 	if !hasGoogleGroups && !hasAdminEmail && !hasSAJSON && !useADC {
 		return msgs
 	}
+
 	if !hasGoogleGroups {
 		msgs = append(msgs, "missing setting: google-group")
 	}

providers/providers.go

@@ -160,7 +160,9 @@ func newProviderDataFromConfig(providerConfig options.Provider) (*ProviderData,
 	}
 
 	p.setAllowedGroups(providerConfig.AllowedGroups)
+
 	p.BackendLogoutURL = providerConfig.BackendLogoutURL
+
 	return p, nil
 }
 

providers/providers_test.go

@@ -132,8 +132,8 @@ func TestScope(t *testing.T) {
 	}{
 		{
 			name:            "oidc: with no scope provided",
-			configuredScope: "",
 			configuredType:  "oidc",
+			configuredScope: "",
 			expectedScope:   "openid email profile",
 		},
 		{