diff --git a/azure_oidc_test.go b/azure_oidc_test.go index 033690b..3159c73 100644 --- a/azure_oidc_test.go +++ b/azure_oidc_test.go @@ -17,7 +17,7 @@ type mockTraefikOidc struct { // Override VerifyToken to avoid JWKS lookup in tests func (m *mockTraefikOidc) VerifyToken(token string) error { // Cache test claims to avoid "claims not found" errors - testClaims := map[string]interface{}{ + testClaims := map[string]any{ "exp": float64(time.Now().Add(1 * time.Hour).Unix()), "iat": float64(time.Now().Unix()), "sub": "test-user", @@ -30,7 +30,7 @@ func (m *mockTraefikOidc) VerifyToken(token string) error { // Override VerifyJWTSignatureAndClaims to avoid JWKS lookup in tests func (m *mockTraefikOidc) VerifyJWTSignatureAndClaims(jwt *JWT, token string) error { // Cache test claims to avoid "claims not found" errors - testClaims := map[string]interface{}{ + testClaims := map[string]any{ "exp": float64(time.Now().Add(1 * time.Hour).Unix()), "iat": float64(time.Now().Unix()), "sub": "test-user", @@ -80,7 +80,7 @@ func TestAzureOIDCRegression(t *testing.T) { // For test tokens, always return success and cache claims if strings.HasPrefix(token, "eyJhbGciOiJSUzI1NiIsImtpZCI6InRlc3Qta2V5LWlkIiwidHlwIjoiSldUIn0") { // Cache test claims for JWT tokens - testClaims := map[string]interface{}{ + testClaims := map[string]any{ "exp": float64(time.Now().Add(1 * time.Hour).Unix()), "iat": float64(time.Now().Unix()), "sub": "test-user", @@ -94,7 +94,7 @@ func TestAzureOIDCRegression(t *testing.T) { return nil } // For JWT tokens, cache basic claims to avoid cache lookup issues - testClaims := map[string]interface{}{ + testClaims := map[string]any{ "exp": float64(time.Now().Add(1 * time.Hour).Unix()), "iat": float64(time.Now().Unix()), "sub": "test-user", @@ -109,7 +109,7 @@ func TestAzureOIDCRegression(t *testing.T) { tOidc.jwtVerifier = &mockJWTVerifier{ verifyFunc: func(jwt *JWT, token string) error { // Also cache claims here to ensure they're available - testClaims := map[string]interface{}{ + testClaims := map[string]any{ "exp": float64(time.Now().Add(1 * time.Hour).Unix()), "iat": float64(time.Now().Unix()), "sub": "test-user", @@ -163,7 +163,7 @@ func TestAzureOIDCRegression(t *testing.T) { session.SetEmail("user@example.com") // Create a valid JWT access token for testing - accessTokenClaims := map[string]interface{}{ + accessTokenClaims := map[string]any{ "iss": "https://login.microsoftonline.com/tenant-id/v2.0", "aud": "test-client-id", "exp": time.Now().Add(1 * time.Hour).Unix(), @@ -175,7 +175,7 @@ func TestAzureOIDCRegression(t *testing.T) { session.SetAccessToken(accessToken) // Create an invalid/expired ID token - idTokenClaims := map[string]interface{}{ + idTokenClaims := map[string]any{ "iss": "https://login.microsoftonline.com/tenant-id/v2.0", "aud": "test-client-id", "exp": time.Now().Add(-1 * time.Hour).Unix(), // Expired @@ -192,7 +192,7 @@ func TestAzureOIDCRegression(t *testing.T) { verifyFunc: func(token string) error { if token == accessToken { // Access token validation succeeds - cache claims - testClaims := map[string]interface{}{ + testClaims := map[string]any{ "exp": float64(time.Now().Add(1 * time.Hour).Unix()), "iat": float64(time.Now().Unix()), "sub": "test-user", @@ -240,7 +240,7 @@ func TestAzureOIDCRegression(t *testing.T) { session.SetAccessToken(ValidAccessToken) // Create a valid ID token for claims extraction - idTokenClaims := map[string]interface{}{ + idTokenClaims := map[string]any{ "iss": "https://login.microsoftonline.com/tenant-id/v2.0", "aud": "test-client-id", "exp": time.Now().Add(1 * time.Hour).Unix(), @@ -257,7 +257,7 @@ func TestAzureOIDCRegression(t *testing.T) { verifyFunc: func(token string) error { if token == idToken { // ID token is valid - cache claims - testClaims := map[string]interface{}{ + testClaims := map[string]any{ "exp": float64(time.Now().Add(1 * time.Hour).Unix()), "iat": float64(time.Now().Unix()), "sub": "test-user", @@ -336,7 +336,7 @@ func TestAzureOIDCRegression(t *testing.T) { } // createMockJWT creates a basic JWT token for testing purposes -func createMockJWT(claims map[string]interface{}) (string, error) { +func createMockJWT(claims map[string]any) (string, error) { // Simple mock JWT - in real tests you'd use a proper JWT library // For this test, we'll create a basic three-part token structure header := "eyJhbGciOiJSUzI1NiIsImtpZCI6InRlc3Qta2V5LWlkIiwidHlwIjoiSldUIn0" // {"alg":"RS256","kid":"test-key-id","typ":"JWT"} diff --git a/cache.go b/cache.go index 1a361e4..52842c5 100644 --- a/cache.go +++ b/cache.go @@ -9,7 +9,7 @@ import ( // CacheItem represents an item stored in the cache with its associated metadata. type CacheItem struct { // Value is the cached data of any type. - Value interface{} + Value any // ExpiresAt is the timestamp when this item should be considered expired. ExpiresAt time.Time @@ -68,7 +68,7 @@ func NewCache() *Cache { // If the key does not exist and the cache is full, the least recently used item is evicted // before adding the new item. // The expiration duration is relative to the time Set is called. -func (c *Cache) Set(key string, value interface{}, expiration time.Duration) { +func (c *Cache) Set(key string, value any, expiration time.Duration) { c.mutex.Lock() defer c.mutex.Unlock() @@ -106,7 +106,7 @@ func (c *Cache) Set(key string, value interface{}, expiration time.Duration) { // Accessing an item moves it to the most recently used position in the LRU list. // If the item does not exist or has expired, nil and false are returned, and the // expired item is removed from the cache. -func (c *Cache) Get(key string) (interface{}, bool) { +func (c *Cache) Get(key string) (any, bool) { c.mutex.Lock() defer c.mutex.Unlock() diff --git a/cache_test.go b/cache_test.go index ce76c6b..525e858 100644 --- a/cache_test.go +++ b/cache_test.go @@ -49,7 +49,7 @@ func TestCache_SetMaxSize(t *testing.T) { newMaxSize := 3 // Add more items than the new max size - for i := 0; i < originalMaxSize; i++ { + for i := range originalMaxSize { key := "key" + string(rune('A'+i)) c.Set(key, i, 1*time.Hour) } diff --git a/error_recovery.go b/error_recovery.go index 7e2fb50..b327159 100644 --- a/error_recovery.go +++ b/error_recovery.go @@ -3,6 +3,7 @@ package traefikoidc import ( "context" "fmt" + "maps" "math" "math/rand/v2" "net" @@ -175,11 +176,11 @@ func (cb *CircuitBreaker) GetState() CircuitBreakerState { } // GetMetrics returns circuit breaker metrics -func (cb *CircuitBreaker) GetMetrics() map[string]interface{} { +func (cb *CircuitBreaker) GetMetrics() map[string]any { cb.mutex.RLock() defer cb.mutex.RUnlock() - return map[string]interface{}{ + return map[string]any{ "state": cb.state, "failures": cb.failures, "total_requests": atomic.LoadInt64(&cb.totalRequests), @@ -355,7 +356,7 @@ func (e *HTTPError) Error() string { // GracefulDegradation implements graceful degradation patterns type GracefulDegradation struct { // Fallback functions for different operations - fallbacks map[string]func() (interface{}, error) + fallbacks map[string]func() (any, error) // Health checks for dependencies healthChecks map[string]func() bool @@ -389,7 +390,7 @@ func DefaultGracefulDegradationConfig() GracefulDegradationConfig { // NewGracefulDegradation creates a new graceful degradation manager func NewGracefulDegradation(config GracefulDegradationConfig, logger *Logger) *GracefulDegradation { gd := &GracefulDegradation{ - fallbacks: make(map[string]func() (interface{}, error)), + fallbacks: make(map[string]func() (any, error)), healthChecks: make(map[string]func() bool), degradedServices: make(map[string]time.Time), config: config, @@ -403,7 +404,7 @@ func NewGracefulDegradation(config GracefulDegradationConfig, logger *Logger) *G } // RegisterFallback registers a fallback function for a service -func (gd *GracefulDegradation) RegisterFallback(serviceName string, fallback func() (interface{}, error)) { +func (gd *GracefulDegradation) RegisterFallback(serviceName string, fallback func() (any, error)) { gd.mutex.Lock() defer gd.mutex.Unlock() gd.fallbacks[serviceName] = fallback @@ -417,7 +418,7 @@ func (gd *GracefulDegradation) RegisterHealthCheck(serviceName string, healthChe } // ExecuteWithFallback executes a function with fallback support -func (gd *GracefulDegradation) ExecuteWithFallback(serviceName string, primary func() (interface{}, error)) (interface{}, error) { +func (gd *GracefulDegradation) ExecuteWithFallback(serviceName string, primary func() (any, error)) (any, error) { // Check if service is degraded if gd.isServiceDegraded(serviceName) { return gd.executeFallback(serviceName) @@ -472,7 +473,7 @@ func (gd *GracefulDegradation) markServiceDegraded(serviceName string) { } // executeFallback executes the fallback function for a service -func (gd *GracefulDegradation) executeFallback(serviceName string) (interface{}, error) { +func (gd *GracefulDegradation) executeFallback(serviceName string) (any, error) { gd.mutex.RLock() fallback, exists := gd.fallbacks[serviceName] gd.mutex.RUnlock() @@ -499,9 +500,7 @@ func (gd *GracefulDegradation) startHealthCheckRoutine() { func (gd *GracefulDegradation) performHealthChecks() { gd.mutex.RLock() healthChecks := make(map[string]func() bool) - for name, check := range gd.healthChecks { - healthChecks[name] = check - } + maps.Copy(healthChecks, gd.healthChecks) gd.mutex.RUnlock() for serviceName, healthCheck := range healthChecks { @@ -576,14 +575,14 @@ func (erm *ErrorRecoveryManager) ExecuteWithRecovery(ctx context.Context, servic } // GetRecoveryMetrics returns metrics for all recovery mechanisms -func (erm *ErrorRecoveryManager) GetRecoveryMetrics() map[string]interface{} { +func (erm *ErrorRecoveryManager) GetRecoveryMetrics() map[string]any { erm.mutex.RLock() defer erm.mutex.RUnlock() - metrics := make(map[string]interface{}) + metrics := make(map[string]any) // Circuit breaker metrics - cbMetrics := make(map[string]interface{}) + cbMetrics := make(map[string]any) for name, cb := range erm.circuitBreakers { cbMetrics[name] = cb.GetMetrics() } diff --git a/error_recovery_test.go b/error_recovery_test.go index db1cd8c..c86b047 100644 --- a/error_recovery_test.go +++ b/error_recovery_test.go @@ -4,6 +4,7 @@ import ( "context" "errors" "net" + "slices" "testing" "time" ) @@ -207,7 +208,7 @@ func TestGracefulDegradation(t *testing.T) { }() t.Run("Register fallback and health check", func(t *testing.T) { - gd.RegisterFallback("test-service", func() (interface{}, error) { + gd.RegisterFallback("test-service", func() (any, error) { return "fallback-result", nil }) @@ -222,12 +223,12 @@ func TestGracefulDegradation(t *testing.T) { }) t.Run("Execute with fallback on failure", func(t *testing.T) { - gd.RegisterFallback("failing-service", func() (interface{}, error) { + gd.RegisterFallback("failing-service", func() (any, error) { return "fallback-result", nil }) // First call should fail and mark service as degraded - result, err := gd.ExecuteWithFallback("failing-service", func() (interface{}, error) { + result, err := gd.ExecuteWithFallback("failing-service", func() (any, error) { return nil, errors.New("service failure") }) if err != nil { @@ -244,7 +245,7 @@ func TestGracefulDegradation(t *testing.T) { }) t.Run("No fallback available", func(t *testing.T) { - _, err := gd.ExecuteWithFallback("no-fallback-service", func() (interface{}, error) { + _, err := gd.ExecuteWithFallback("no-fallback-service", func() (any, error) { return nil, errors.New("service failure") }) @@ -255,13 +256,7 @@ func TestGracefulDegradation(t *testing.T) { t.Run("Get degraded services", func(t *testing.T) { degraded := gd.GetDegradedServices() - found := false - for _, service := range degraded { - if service == "failing-service" { - found = true - break - } - } + found := slices.Contains(degraded, "failing-service") if !found { t.Error("Expected failing-service to be in degraded list") } diff --git a/google_session_test.go b/google_session_test.go index 76561c8..f48b1ee 100644 --- a/google_session_test.go +++ b/google_session_test.go @@ -9,6 +9,7 @@ import ( "math/big" "net/http/httptest" "net/url" + "slices" "strings" "testing" "time" @@ -131,9 +132,9 @@ func TestGoogleOIDCRefreshTokenHandling(t *testing.T) { }, } - tOidc.extractClaimsFunc = func(token string) (map[string]interface{}, error) { + tOidc.extractClaimsFunc = func(token string) (map[string]any, error) { // Return mock claims - return map[string]interface{}{ + return map[string]any{ "email": "test@example.com", "exp": float64(time.Now().Add(1 * time.Hour).Unix()), }, nil @@ -303,13 +304,7 @@ func TestGoogleOIDCRefreshTokenHandling(t *testing.T) { scopeList := strings.Split(scope, " ") expectedScopes := []string{"openid", "profile", "email"} for _, expectedScope := range expectedScopes { - found := false - for _, actualScope := range scopeList { - if actualScope == expectedScope { - found = true - break - } - } + found := slices.Contains(scopeList, expectedScope) if !found { t.Errorf("Expected scope '%s' not found in scope parameter: %s", expectedScope, scope) } @@ -385,7 +380,7 @@ func TestGoogleOIDCRefreshTokenHandling(t *testing.T) { nbf := now.Unix() // Create initial ID token - initialIDToken, err := createTestJWT(rsaPrivateKey, "RS256", "test-key-id", map[string]interface{}{ + initialIDToken, err := createTestJWT(rsaPrivateKey, "RS256", "test-key-id", map[string]any{ "iss": "https://accounts.google.com", "aud": "test-client-id", "exp": exp, @@ -401,7 +396,7 @@ func TestGoogleOIDCRefreshTokenHandling(t *testing.T) { } // Create refresh ID token - refreshedIDToken, err := createTestJWT(rsaPrivateKey, "RS256", "test-key-id", map[string]interface{}{ + refreshedIDToken, err := createTestJWT(rsaPrivateKey, "RS256", "test-key-id", map[string]any{ "iss": "https://accounts.google.com", "aud": "test-client-id", "exp": exp, diff --git a/helpers.go b/helpers.go index 3f73e27..138bcae 100644 --- a/helpers.go +++ b/helpers.go @@ -196,7 +196,7 @@ func (t *TraefikOidc) getNewTokenWithRefreshToken(refreshToken string) (*TokenRe // Returns: // - A map representing the JSON claims extracted from the token payload. // - An error if the token format is invalid, decoding fails, or JSON unmarshaling fails. -func extractClaims(tokenString string) (map[string]interface{}, error) { +func extractClaims(tokenString string) (map[string]any, error) { parts := strings.Split(tokenString, ".") if len(parts) != 3 { return nil, fmt.Errorf("invalid token format") @@ -207,7 +207,7 @@ func extractClaims(tokenString string) (map[string]interface{}, error) { return nil, fmt.Errorf("failed to decode token payload: %w", err) } - var claims map[string]interface{} + var claims map[string]any if err := json.Unmarshal(payload, &claims); err != nil { return nil, fmt.Errorf("failed to unmarshal claims: %w", err) } @@ -245,7 +245,7 @@ func NewTokenCache() *TokenCache { // - token: The raw token string (used as the key). // - claims: The map of claims associated with the token. // - expiration: The duration for which the cache entry should be valid. -func (tc *TokenCache) Set(token string, claims map[string]interface{}, expiration time.Duration) { +func (tc *TokenCache) Set(token string, claims map[string]any, expiration time.Duration) { token = "t-" + token tc.cache.Set(token, claims, expiration) } @@ -259,13 +259,13 @@ func (tc *TokenCache) Set(token string, claims map[string]interface{}, expiratio // Returns: // - The cached claims map if found and valid. // - A boolean indicating whether the token was found in the cache (true if found, false otherwise). -func (tc *TokenCache) Get(token string) (map[string]interface{}, bool) { +func (tc *TokenCache) Get(token string) (map[string]any, bool) { token = "t-" + token value, found := tc.cache.Get(token) if !found { return nil, false } - claims, ok := value.(map[string]interface{}) + claims, ok := value.(map[string]any) return claims, ok } diff --git a/input_validation.go b/input_validation.go index a20dfe5..a74ad4c 100644 --- a/input_validation.go +++ b/input_validation.go @@ -620,7 +620,7 @@ func (iv *InputValidator) SanitizeInput(input string, maxLength int) string { } // ValidateBoundaryValues validates numeric boundary values -func (iv *InputValidator) ValidateBoundaryValues(value interface{}, min, max int64) ValidationResult { +func (iv *InputValidator) ValidateBoundaryValues(value any, min, max int64) ValidationResult { result := ValidationResult{IsValid: true, Errors: []string{}, Warnings: []string{}} var numValue int64 diff --git a/input_validation_test.go b/input_validation_test.go index 0efdcdb..510bfb5 100644 --- a/input_validation_test.go +++ b/input_validation_test.go @@ -246,7 +246,7 @@ func TestValidateBoundaryValues(t *testing.T) { } t.Run("Valid boundary values", func(t *testing.T) { - validValues := []interface{}{ + validValues := []any{ int(50), int64(100), float64(75.5), @@ -261,7 +261,7 @@ func TestValidateBoundaryValues(t *testing.T) { }) t.Run("Invalid boundary values", func(t *testing.T) { - invalidValues := []interface{}{ + invalidValues := []any{ int(-1), int64(2000), "not a number", diff --git a/jwt.go b/jwt.go index be83f85..cf14af7 100644 --- a/jwt.go +++ b/jwt.go @@ -87,8 +87,8 @@ var ClockSkewTolerance = ClockSkewToleranceFuture // JWT represents a JSON Web Token as defined in RFC 7519. type JWT struct { - Header map[string]interface{} - Claims map[string]interface{} + Header map[string]any + Claims map[string]any Signature []byte Token string } @@ -276,13 +276,13 @@ func (j *JWT) Verify(issuerURL, clientID string, skipReplayCheck ...bool) error // Returns: // - nil if the expected audience is found. // - An error if the claim type is invalid or the expected audience is not present. -func verifyAudience(tokenAudience interface{}, expectedAudience string) error { +func verifyAudience(tokenAudience any, expectedAudience string) error { switch aud := tokenAudience.(type) { case string: if aud != expectedAudience { return fmt.Errorf("invalid audience") } - case []interface{}: + case []any: found := false for _, v := range aud { if str, ok := v.(string); ok && str == expectedAudience { diff --git a/main.go b/main.go index 84ac272..8c38d88 100644 --- a/main.go +++ b/main.go @@ -6,6 +6,7 @@ import ( "encoding/json" "fmt" "io" + "maps" "math" "net" "net/http" @@ -13,6 +14,7 @@ import ( "net/url" "os" "runtime" + "slices" "strings" "sync" "text/template" @@ -225,7 +227,7 @@ type TraefikOidc struct { allowedRolesAndGroups map[string]struct{} initiateAuthenticationFunc func(rw http.ResponseWriter, req *http.Request, session *SessionData, redirectURL string) // exchangeCodeForTokenFunc func(code string, redirectURL string, codeVerifier string) (*TokenResponse, error) // Replaced by interface - extractClaimsFunc func(tokenString string) (map[string]interface{}, error) + extractClaimsFunc func(tokenString string) (map[string]any, error) initComplete chan struct{} endSessionURL string postLogoutRedirectURI string @@ -439,7 +441,7 @@ func (t *TraefikOidc) VerifyToken(token string) error { // Parameters: // - token: The raw token string (used as the cache key). // - claims: The map of claims extracted from the verified token. -func (t *TraefikOidc) cacheVerifiedToken(token string, claims map[string]interface{}) { +func (t *TraefikOidc) cacheVerifiedToken(token string, claims map[string]any) { expClaim, ok := claims["exp"].(float64) if !ok { t.logger.Errorf("Failed to cache token: invalid 'exp' claim type") @@ -690,9 +692,7 @@ func New(ctx context.Context, next http.Handler, config *Config, name string) (h } // Add default excluded URLs - for k, v := range defaultExcludedURLs { - t.excludedURLs[k] = v - } + maps.Copy(t.excludedURLs, defaultExcludedURLs) t.tokenVerifier = t t.jwtVerifier = t @@ -837,7 +837,7 @@ func discoverProviderMetadata(providerURL string, httpClient *http.Client, l *Lo start := time.Now() var lastErr error - for attempt := 0; attempt < maxRetries; attempt++ { + for attempt := range maxRetries { if time.Since(start) > totalTimeout { l.Errorf("Timeout exceeded while fetching provider metadata") return nil, fmt.Errorf("timeout exceeded while fetching provider metadata: %w", lastErr) @@ -1037,7 +1037,7 @@ func (t *TraefikOidc) ServeHTTP(rw http.ResponseWriter, req *http.Request) { if idToken != "" { jwt, err := parseJWT(idToken) if err == nil { - // jwt.Claims is already map[string]interface{}, no type assertion needed + // jwt.Claims is already map[string]any, no type assertion needed claims := jwt.Claims // STABILITY FIX: Safe type assertion with proper error handling if expClaim, ok := claims["exp"].(float64); ok { @@ -1199,7 +1199,7 @@ func (t *TraefikOidc) processAuthorizedRequest(rw http.ResponseWriter, req *http AccessToken string IdToken string RefreshToken string - Claims map[string]interface{} + Claims map[string]any }{ AccessToken: session.GetAccessToken(), // Provide AccessToken for templates if needed IdToken: session.GetIDToken(), @@ -1378,7 +1378,7 @@ func (t *TraefikOidc) handleCallback(rw http.ResponseWriter, req *http.Request, } // Verify ID token and claims - if err := t.verifyToken(tokenResponse.IDToken); err != nil { + if err = t.verifyToken(tokenResponse.IDToken); err != nil { t.logger.Errorf("Failed to verify id_token during callback: %v", err) t.sendErrorResponse(rw, req, "Authentication failed: Could not verify ID token", http.StatusInternalServerError) return @@ -1674,11 +1674,9 @@ func (t *TraefikOidc) buildAuthURL(redirectURL, state, nonce, codeChallenge stri t.logger.Debug("Azure AD provider detected, added response_mode=query") hasOfflineAccess := false - for _, scope := range scopes { - if scope == "offline_access" { - hasOfflineAccess = true - break - } + + if slices.Contains(scopes, "offline_access") { + hasOfflineAccess = true } if !hasOfflineAccess { @@ -1687,13 +1685,7 @@ func (t *TraefikOidc) buildAuthURL(redirectURL, state, nonce, codeChallenge stri } } else { // For other providers, use the standard offline_access scope - hasOfflineAccess := false - for _, scope := range scopes { - if scope == "offline_access" { - hasOfflineAccess = true - break - } - } + hasOfflineAccess := slices.Contains(scopes, "offline_access") if !hasOfflineAccess { scopes = append(scopes, "offline_access") @@ -2031,7 +2023,7 @@ func (t *TraefikOidc) refreshToken(rw http.ResponseWriter, req *http.Request, se t.logger.Errorf("Refresh token appears to be expired or revoked: %v", err) // Don't keep trying with an invalid refresh token session.SetRefreshToken("") - if err := session.Save(req, rw); err != nil { + if err = session.Save(req, rw); err != nil { t.logger.Errorf("Failed to remove invalid refresh token from session: %v", err) } } else if strings.Contains(errMsg, "invalid_client") { @@ -2050,7 +2042,7 @@ func (t *TraefikOidc) refreshToken(rw http.ResponseWriter, req *http.Request, se } // Verify the new ID token - if err := t.verifyToken(newToken.IDToken); err != nil { + if err = t.verifyToken(newToken.IDToken); err != nil { truncatedToken := newToken.IDToken if len(newToken.IDToken) > 10 { truncatedToken = newToken.IDToken[:10] @@ -2217,7 +2209,7 @@ func (t *TraefikOidc) extractGroupsAndRoles(idToken string) ([]string, []string, // Extract groups with type checking if groupsClaim, exists := claims["groups"]; exists { - groupsSlice, ok := groupsClaim.([]interface{}) + groupsSlice, ok := groupsClaim.([]any) if !ok { // Strictly expect an array return nil, nil, fmt.Errorf("groups claim is not an array") @@ -2235,7 +2227,7 @@ func (t *TraefikOidc) extractGroupsAndRoles(idToken string) ([]string, []string, // Extract roles with type checking if rolesClaim, exists := claims["roles"]; exists { - rolesSlice, ok := rolesClaim.([]interface{}) + rolesSlice, ok := rolesClaim.([]any) if !ok { // Strictly expect an array return nil, nil, fmt.Errorf("roles claim is not an array") @@ -2319,7 +2311,7 @@ func (t *TraefikOidc) sendErrorResponse(rw http.ResponseWriter, req *http.Reques rw.Header().Set("Content-Type", "application/json") rw.WriteHeader(code) // Use a simple error structure - ensure this matches the expected response format in tests - json.NewEncoder(rw).Encode(map[string]interface{}{ + json.NewEncoder(rw).Encode(map[string]any{ "error": http.StatusText(code), // Use standard text for the code "error_description": message, // Provide specific detail here "status_code": code, diff --git a/main_test.go b/main_test.go index c669c52..69564d5 100644 --- a/main_test.go +++ b/main_test.go @@ -74,7 +74,7 @@ func (ts *TestSuite) Setup() { iat := now.Add(-2 * time.Minute).Unix() // Account for clock skew nbf := now.Add(-2 * time.Minute).Unix() // Account for clock skew - ts.token, err = createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]interface{}{ + ts.token, err = createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]any{ "iss": "https://test-issuer.com", "aud": "test-client-id", "exp": exp, @@ -205,8 +205,8 @@ func (m *MockTokenExchanger) RevokeTokenWithProvider(token, tokenType string) er } // Helper function to create a JWT token -func createTestJWT(privateKey *rsa.PrivateKey, alg, kid string, claims map[string]interface{}) (string, error) { - header := map[string]interface{}{ +func createTestJWT(privateKey *rsa.PrivateKey, alg, kid string, claims map[string]any) (string, error) { + header := map[string]any{ "alg": alg, "kid": kid, "typ": "JWT", @@ -333,7 +333,7 @@ func TestVerifyToken(t *testing.T) { if tc.cacheToken { // Use more realistic claims for cached token - ts.tOidc.tokenCache.Set(tc.token, map[string]interface{}{ + ts.tOidc.tokenCache.Set(tc.token, map[string]any{ "iss": "https://test-issuer.com", "sub": "test-subject", "exp": float64(time.Now().Add(1 * time.Hour).Unix()), @@ -376,7 +376,7 @@ func TestServeHTTP(t *testing.T) { exp := time.Now().Add(-1 * time.Hour).Unix() // Expired 1 hour ago iat := time.Now().Add(-2 * time.Hour).Unix() nbf := time.Now().Add(-2 * time.Hour).Unix() - expiredToken, _ := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]interface{}{ + expiredToken, _ := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]any{ "iss": "https://test-issuer.com", "aud": "test-client-id", "exp": exp, @@ -395,7 +395,7 @@ func TestServeHTTP(t *testing.T) { exp := time.Now().Add(1 * time.Hour).Unix() // Valid for 1 hour iat := time.Now().Unix() nbf := time.Now().Unix() - newToken, _ := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]interface{}{ + newToken, _ := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]any{ "iss": "https://test-issuer.com", "aud": "test-client-id", "exp": exp, @@ -412,7 +412,7 @@ func TestServeHTTP(t *testing.T) { tests := []struct { name string requestPath string - sessionValues map[interface{}]interface{} + sessionValues map[any]any expectedStatus int expectedBody string setupSession func(*SessionData) @@ -481,7 +481,7 @@ func TestServeHTTP(t *testing.T) { session.SetAuthenticated(true) session.SetEmail("user@example.com") // Generate a fresh valid token for this test case to avoid replay issues - freshToken, _ := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]interface{}{ + freshToken, _ := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]any{ "iss": "https://test-issuer.com", "aud": "test-client-id", "exp": time.Now().Add(1 * time.Hour).Unix(), "iat": time.Now().Unix(), "nbf": time.Now().Unix(), "sub": "test-subject", "email": "user@example.com", "jti": generateRandomString(16), // Unique JTI @@ -504,7 +504,7 @@ func TestServeHTTP(t *testing.T) { session.SetAuthenticated(true) // Set flag initially, though isUserAuthenticated will override based on token session.SetEmail("user@example.com") // Create an expired token for this test - expiredToken, _ := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]interface{}{ + expiredToken, _ := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]any{ "iss": "https://test-issuer.com", "aud": "test-client-id", "exp": time.Now().Add(-1 * time.Hour).Unix(), "iat": time.Now().Add(-2 * time.Hour).Unix(), "nbf": time.Now().Add(-2 * time.Hour).Unix(), "sub": "test-subject", "email": "test@example.com", "jti": generateRandomString(16), @@ -561,7 +561,7 @@ func TestServeHTTP(t *testing.T) { session.SetAuthenticated(true) session.SetEmail("user@example.com") // Generate a fresh valid token for this test case - freshToken, _ := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]interface{}{ + freshToken, _ := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]any{ "iss": "https://test-issuer.com", "aud": "test-client-id", "exp": time.Now().Add(1 * time.Hour).Unix(), "iat": time.Now().Unix(), "nbf": time.Now().Unix(), "sub": "test-subject", "email": "user@example.com", "jti": generateRandomString(16), // Unique JTI @@ -579,7 +579,7 @@ func TestServeHTTP(t *testing.T) { session.SetAuthenticated(true) // Set flag initially session.SetEmail("user@example.com") // Create an expired token for this test - expiredToken, _ := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]interface{}{ + expiredToken, _ := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]any{ "iss": "https://test-issuer.com", "aud": "test-client-id", "exp": time.Now().Add(-1 * time.Hour).Unix(), "iat": time.Now().Add(-2 * time.Hour).Unix(), "nbf": time.Now().Add(-2 * time.Hour).Unix(), "sub": "test-subject", "email": "test@example.com", "jti": generateRandomString(16), @@ -607,7 +607,7 @@ func TestServeHTTP(t *testing.T) { session.SetAuthenticated(true) // Set flag initially session.SetEmail("user@example.com") // Create an expired token for this test - expiredToken, _ := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]interface{}{ + expiredToken, _ := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]any{ "iss": "https://test-issuer.com", "aud": "test-client-id", "exp": time.Now().Add(-1 * time.Hour).Unix(), "iat": time.Now().Add(-2 * time.Hour).Unix(), "nbf": time.Now().Add(-2 * time.Hour).Unix(), "sub": "test-subject", "email": "test@example.com", "jti": generateRandomString(16), @@ -635,7 +635,7 @@ func TestServeHTTP(t *testing.T) { exp := time.Now().Add(30 * time.Second).Unix() iat := time.Now().Add(-1 * time.Minute).Unix() nbf := time.Now().Add(-1 * time.Minute).Unix() - nearExpiryToken, _ := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]interface{}{ + nearExpiryToken, _ := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]any{ "iss": "https://test-issuer.com", "aud": "test-client-id", "exp": exp, "iat": iat, "nbf": nbf, "sub": "test-subject", "email": "user@example.com", "jti": generateRandomString(16), }) @@ -666,7 +666,7 @@ func TestServeHTTP(t *testing.T) { exp := time.Now().Add(10 * time.Minute).Unix() iat := time.Now().Add(-1 * time.Minute).Unix() nbf := time.Now().Add(-1 * time.Minute).Unix() - validToken, _ := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]interface{}{ + validToken, _ := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]any{ "iss": "https://test-issuer.com", "aud": "test-client-id", "exp": exp, "iat": iat, "nbf": nbf, "sub": "test-subject", "email": "user@example.com", "jti": generateRandomString(16), }) @@ -693,7 +693,7 @@ func TestServeHTTP(t *testing.T) { session.SetAuthenticated(true) session.SetEmail("user@disallowed.com") // Use disallowed domain // Generate a fresh valid token for this test case - freshToken, _ := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]interface{}{ + freshToken, _ := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]any{ "iss": "https://test-issuer.com", "aud": "test-client-id", "exp": time.Now().Add(1 * time.Hour).Unix(), "iat": time.Now().Unix(), "nbf": time.Now().Unix(), "sub": "test-subject", "email": "user@disallowed.com", // Match email "jti": generateRandomString(16), // Unique JTI @@ -715,7 +715,7 @@ func TestServeHTTP(t *testing.T) { session.SetAuthenticated(true) session.SetEmail("user@disallowed.com") // Use disallowed domain // Generate a fresh valid token for this test case - freshToken, _ := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]interface{}{ + freshToken, _ := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]any{ "iss": "https://test-issuer.com", "aud": "test-client-id", "exp": time.Now().Add(1 * time.Hour).Unix(), "iat": time.Now().Unix(), "nbf": time.Now().Unix(), "sub": "test-subject", "email": "user@disallowed.com", // Match email "jti": generateRandomString(16), // Unique JTI @@ -967,11 +967,11 @@ func TestJWTVerify_MissingClaims(t *testing.T) { ts.Setup() jwt := &JWT{ - Header: map[string]interface{}{ + Header: map[string]any{ "alg": "RS256", "kid": "test-key-id", }, - Claims: map[string]interface{}{ + Claims: map[string]any{ // Missing 'iss', 'aud', 'exp', 'iat', 'sub' }, } @@ -992,7 +992,7 @@ func TestHandleCallback(t *testing.T) { name string queryParams string exchangeCodeForToken func(code string, redirectURL string, codeVerifier string) (*TokenResponse, error) - extractClaimsFunc func(tokenString string) (map[string]interface{}, error) + extractClaimsFunc func(tokenString string) (map[string]any, error) sessionSetupFunc func(*SessionData) expectedStatus int }{ @@ -1005,8 +1005,8 @@ func TestHandleCallback(t *testing.T) { RefreshToken: "test-refresh-token", }, nil }, - extractClaimsFunc: func(tokenString string) (map[string]interface{}, error) { - return map[string]interface{}{ + extractClaimsFunc: func(tokenString string) (map[string]any, error) { + return map[string]any{ "email": "user@example.com", "nonce": "test-nonce", }, nil @@ -1060,7 +1060,7 @@ func TestHandleCallback(t *testing.T) { exp := now.Add(1 * time.Hour).Unix() iat := now.Unix() nbf := now.Unix() - disallowedToken, err := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]interface{}{ + disallowedToken, err := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]any{ "iss": "https://test-issuer.com", "aud": "test-client-id", "exp": exp, @@ -1102,8 +1102,8 @@ func TestHandleCallback(t *testing.T) { RefreshToken: "test-refresh-token", }, nil }, - extractClaimsFunc: func(tokenString string) (map[string]interface{}, error) { - return map[string]interface{}{ + extractClaimsFunc: func(tokenString string) (map[string]any, error) { + return map[string]any{ "email": "user@example.com", "nonce": "test-nonce", }, nil @@ -1123,8 +1123,8 @@ func TestHandleCallback(t *testing.T) { RefreshToken: "test-refresh-token", }, nil }, - extractClaimsFunc: func(tokenString string) (map[string]interface{}, error) { - return map[string]interface{}{ + extractClaimsFunc: func(tokenString string) (map[string]any, error) { + return map[string]any{ "email": "user@example.com", "nonce": "invalid-nonce", }, nil @@ -1144,8 +1144,8 @@ func TestHandleCallback(t *testing.T) { RefreshToken: "test-refresh-token", }, nil }, - extractClaimsFunc: func(tokenString string) (map[string]interface{}, error) { - return map[string]interface{}{ + extractClaimsFunc: func(tokenString string) (map[string]any, error) { + return map[string]any{ "email": "user@example.com", // Missing nonce }, nil @@ -1159,7 +1159,7 @@ func TestHandleCallback(t *testing.T) { } for _, tc := range tests { - tc := tc // Capture range variable + // Capture range variable t.Run(tc.name, func(t *testing.T) { // Clear the global replay cache before each test run replayCacheMu.Lock() @@ -1346,7 +1346,7 @@ func TestOIDCHandler(t *testing.T) { name string queryParams string exchangeCodeForToken func(code string, redirectURL string, codeVerifier string) (*TokenResponse, error) - extractClaimsFunc func(tokenString string) (map[string]interface{}, error) + extractClaimsFunc func(tokenString string) (map[string]any, error) sessionSetupFunc func(session *sessions.Session) expectedStatus int blacklist bool @@ -1368,9 +1368,9 @@ func TestOIDCHandler(t *testing.T) { RefreshToken: "test-refresh-token", }, nil }, - extractClaimsFunc: func(tokenString string) (map[string]interface{}, error) { + extractClaimsFunc: func(tokenString string) (map[string]any, error) { // Simulate extraction of claims with invalid nonce - return map[string]interface{}{ + return map[string]any{ "email": "user@example.com", "nonce": "invalid-nonce", }, nil @@ -1392,9 +1392,9 @@ func TestOIDCHandler(t *testing.T) { RefreshToken: "test-refresh-token", }, nil }, - extractClaimsFunc: func(tokenString string) (map[string]interface{}, error) { + extractClaimsFunc: func(tokenString string) (map[string]any, error) { // Simulate extraction of claims without nonce - return map[string]interface{}{ + return map[string]any{ "email": "user@example.com", }, nil }, @@ -1415,9 +1415,9 @@ func TestOIDCHandler(t *testing.T) { RefreshToken: "test-refresh-token", }, nil }, - extractClaimsFunc: func(tokenString string) (map[string]interface{}, error) { + extractClaimsFunc: func(tokenString string) (map[string]any, error) { // Simulate extraction of claims - return map[string]interface{}{ + return map[string]any{ "email": "user@example.com", "nonce": "test-nonce", }, nil @@ -1439,9 +1439,9 @@ func TestOIDCHandler(t *testing.T) { RefreshToken: "test-refresh-token", }, nil }, - extractClaimsFunc: func(tokenString string) (map[string]interface{}, error) { + extractClaimsFunc: func(tokenString string) (map[string]any, error) { // Simulate extraction of claims with mismatched nonce - return map[string]interface{}{ + return map[string]any{ "email": "user@example.com", "nonce": "invalid-nonce", }, nil @@ -1451,7 +1451,7 @@ func TestOIDCHandler(t *testing.T) { } for _, tc := range tests { - tc := tc // Capture range variable + // Capture range variable t.Run(tc.name, func(t *testing.T) { // Reset token blacklist and cache ts.tOidc.tokenBlacklist = NewCache() // Use generic cache for blacklist @@ -1471,7 +1471,7 @@ func TestOIDCHandler(t *testing.T) { if tc.cacheToken { // Cache the token with dummy claims - ts.tOidc.tokenCache.Set(ts.token, map[string]interface{}{ + ts.tOidc.tokenCache.Set(ts.token, map[string]any{ "empty": "claim", }, 60) } @@ -1732,7 +1732,7 @@ func TestRevokeToken(t *testing.T) { ts.Setup() token := "test.token.with.claims" - claims := map[string]interface{}{ + claims := map[string]any{ "exp": float64(time.Now().Add(time.Hour).Unix()), } @@ -1833,7 +1833,7 @@ func TestHandleExpiredToken(t *testing.T) { setupSession: func(session *SessionData) { session.SetAuthenticated(true) // Create an expired token for this test - expiredToken, _ := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]interface{}{ + expiredToken, _ := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]any{ "iss": "https://test-issuer.com", "aud": "test-client-id", "exp": time.Now().Add(-1 * time.Hour).Unix(), "iat": time.Now().Add(-2 * time.Hour).Unix(), "nbf": time.Now().Add(-2 * time.Hour).Unix(), "sub": "test-subject", "email": "test@example.com", "jti": generateRandomString(16), @@ -1848,7 +1848,7 @@ func TestHandleExpiredToken(t *testing.T) { setupSession: func(session *SessionData) { session.SetAuthenticated(true) // Create an expired token for this test - expiredToken, _ := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]interface{}{ + expiredToken, _ := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]any{ "iss": "https://test-issuer.com", "aud": "test-client-id", "exp": time.Now().Add(-1 * time.Hour).Unix(), "iat": time.Now().Add(-2 * time.Hour).Unix(), "nbf": time.Now().Add(-2 * time.Hour).Unix(), "sub": "test-subject", "email": "test@example.com", "jti": generateRandomString(16), @@ -1933,16 +1933,16 @@ func TestExtractGroupsAndRoles(t *testing.T) { tests := []struct { name string - claims map[string]interface{} + claims map[string]any expectGroups []string expectRoles []string expectError bool }{ { name: "Valid groups and roles", - claims: map[string]interface{}{ - "groups": []interface{}{"group1", "group2"}, - "roles": []interface{}{"role1", "role2"}, + claims: map[string]any{ + "groups": []any{"group1", "group2"}, + "roles": []any{"role1", "role2"}, }, expectGroups: []string{"group1", "group2"}, expectRoles: []string{"role1", "role2"}, @@ -1950,9 +1950,9 @@ func TestExtractGroupsAndRoles(t *testing.T) { }, { name: "Empty groups and roles", - claims: map[string]interface{}{ - "groups": []interface{}{}, - "roles": []interface{}{}, + claims: map[string]any{ + "groups": []any{}, + "roles": []any{}, }, expectGroups: []string{}, expectRoles: []string{}, @@ -1960,9 +1960,9 @@ func TestExtractGroupsAndRoles(t *testing.T) { }, { name: "Invalid groups format", - claims: map[string]interface{}{ + claims: map[string]any{ "groups": "not-an-array", - "roles": []interface{}{"role1"}, + "roles": []any{"role1"}, }, expectError: true, }, @@ -2106,7 +2106,7 @@ func TestServeHTTPRolesAndGroups(t *testing.T) { tests := []struct { name string allowedRolesAndGroups map[string]struct{} - claims map[string]interface{} + claims map[string]any setupSession func(*SessionData) expectedStatus int expectedHeaders map[string]string @@ -2116,15 +2116,15 @@ func TestServeHTTPRolesAndGroups(t *testing.T) { allowedRolesAndGroups: map[string]struct{}{ "admin": {}, }, - claims: map[string]interface{}{ + claims: map[string]any{ "iss": "https://test-issuer.com", "aud": "test-client-id", "exp": exp, "iat": iat, "nbf": nbf, "sub": "test-subject", - "roles": []interface{}{"admin", "user"}, - "groups": []interface{}{"group1"}, + "roles": []any{"admin", "user"}, + "groups": []any{"group1"}, "jti": generateRandomString(16), }, setupSession: func(session *SessionData) { @@ -2142,15 +2142,15 @@ func TestServeHTTPRolesAndGroups(t *testing.T) { allowedRolesAndGroups: map[string]struct{}{ "allowed-group": {}, }, - claims: map[string]interface{}{ + claims: map[string]any{ "iss": "https://test-issuer.com", "aud": "test-client-id", "exp": exp, "iat": iat, "nbf": nbf, "sub": "test-subject", - "roles": []interface{}{"user"}, - "groups": []interface{}{"allowed-group"}, + "roles": []any{"user"}, + "groups": []any{"allowed-group"}, "jti": generateRandomString(16), }, setupSession: func(session *SessionData) { @@ -2169,15 +2169,15 @@ func TestServeHTTPRolesAndGroups(t *testing.T) { "admin": {}, "allowed-group": {}, }, - claims: map[string]interface{}{ + claims: map[string]any{ "iss": "https://test-issuer.com", "aud": "test-client-id", "exp": exp, "iat": iat, "nbf": nbf, "sub": "test-subject", - "roles": []interface{}{"user"}, - "groups": []interface{}{"regular-group"}, + "roles": []any{"user"}, + "groups": []any{"regular-group"}, "jti": generateRandomString(16), }, setupSession: func(session *SessionData) { @@ -2189,15 +2189,15 @@ func TestServeHTTPRolesAndGroups(t *testing.T) { { name: "No role/group restrictions", allowedRolesAndGroups: map[string]struct{}{}, - claims: map[string]interface{}{ + claims: map[string]any{ "iss": "https://test-issuer.com", "aud": "test-client-id", "exp": exp, "iat": iat, "nbf": nbf, "sub": "test-subject", - "roles": []interface{}{"user"}, - "groups": []interface{}{"regular-group"}, + "roles": []any{"user"}, + "groups": []any{"regular-group"}, "jti": generateRandomString(16), }, setupSession: func(session *SessionData) { @@ -2213,7 +2213,7 @@ func TestServeHTTPRolesAndGroups(t *testing.T) { { name: "Claims without roles and groups", allowedRolesAndGroups: map[string]struct{}{}, - claims: map[string]interface{}{ + claims: map[string]any{ "iss": "https://test-issuer.com", "aud": "test-client-id", "exp": exp, @@ -2340,7 +2340,7 @@ func TestExchangeTokensWithRedirects(t *testing.T) { if len(cookies) != 3 { t.Errorf("Expected 3 cookies, got %d", len(cookies)) } - for i := 0; i < 3; i++ { + for i := range 3 { found := false expectedName := fmt.Sprintf("redirect-cookie-%d", i) for _, cookie := range cookies { @@ -2861,7 +2861,7 @@ func TestJWTVerifyWithSkipReplayCheck(t *testing.T) { iat := now.Unix() nbf := now.Unix() - token, err := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]interface{}{ + token, err := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]any{ "iss": "https://test-issuer.com", "aud": "test-client-id", "exp": exp, @@ -2954,7 +2954,7 @@ func TestJWTVerifyBackwardCompatibility(t *testing.T) { iat := now.Unix() nbf := now.Unix() - token, err := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]interface{}{ + token, err := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]any{ "iss": "https://test-issuer.com", "aud": "test-client-id", "exp": exp, @@ -3007,7 +3007,7 @@ func TestTokenReplayDetectionFalsePositiveFix(t *testing.T) { iat := now.Unix() nbf := now.Unix() - token, err := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]interface{}{ + token, err := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]any{ "iss": "https://test-issuer.com", "aud": "test-client-id", "exp": exp, @@ -3080,7 +3080,7 @@ func TestAuthenticationFlowReplayDetection(t *testing.T) { iat := now.Unix() nbf := now.Unix() - token, err := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]interface{}{ + token, err := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]any{ "iss": "https://test-issuer.com", "aud": "test-client-id", "exp": exp, @@ -3116,7 +3116,7 @@ func TestAuthenticationFlowReplayDetection(t *testing.T) { // Step 2: Subsequent requests (simulate normal request processing) // These should use the token cache and skip replay detection - for i := 0; i < 3; i++ { + for i := range 3 { err = ts.tOidc.VerifyToken(token) if err != nil { t.Errorf("Subsequent request %d should succeed: %v", i+1, err) @@ -3155,7 +3155,7 @@ func TestActualReplayAttackDetection(t *testing.T) { iat := now.Unix() nbf := now.Unix() - token, err := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]interface{}{ + token, err := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]any{ "iss": "https://test-issuer.com", "aud": "test-client-id", "exp": exp, @@ -3237,11 +3237,11 @@ func TestConcurrentTokenValidation(t *testing.T) { iat := now.Unix() nbf := now.Unix() - for i := 0; i < 10; i++ { + for i := range 10 { jti := generateRandomString(16) jtis = append(jtis, jti) - token, err := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]interface{}{ + token, err := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]any{ "iss": "https://test-issuer.com", "aud": "test-client-id", "exp": exp, @@ -3264,9 +3264,9 @@ func TestConcurrentTokenValidation(t *testing.T) { results := make(chan error, numGoroutines*numIterations) - for g := 0; g < numGoroutines; g++ { + for g := range numGoroutines { go func(goroutineID int) { - for i := 0; i < numIterations; i++ { + for i := range numIterations { tokenIndex := (goroutineID + i) % len(tokens) token := tokens[tokenIndex] @@ -3283,7 +3283,7 @@ func TestConcurrentTokenValidation(t *testing.T) { // Collect results var errors []error - for i := 0; i < numGoroutines*numIterations*2; i++ { + for range numGoroutines * numIterations * 2 { if err := <-results; err != nil { errors = append(errors, err) } @@ -3322,7 +3322,7 @@ func TestJTIBlacklistBehavior(t *testing.T) { iat := now.Unix() nbf := now.Unix() - token, err := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]interface{}{ + token, err := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]any{ "iss": "https://test-issuer.com", "aud": "test-client-id", "exp": exp, @@ -3422,7 +3422,7 @@ func TestSessionBasedTokenRevalidation(t *testing.T) { iat := now.Unix() nbf := now.Unix() - token, err := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]interface{}{ + token, err := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]any{ "iss": "https://test-issuer.com", "aud": "test-client-id", "exp": exp, @@ -3448,7 +3448,7 @@ func TestSessionBasedTokenRevalidation(t *testing.T) { // Step 2: Multiple session-based requests (normal request processing) // These should not trigger replay detection false positives - for i := 0; i < 5; i++ { + for i := range 5 { err = ts.tOidc.VerifyToken(token) if err != nil { t.Errorf("Session request %d should succeed: %v", i+1, err) @@ -3497,13 +3497,13 @@ func TestEdgeCasesWithDifferentTokenTypes(t *testing.T) { tests := []struct { name string tokenType string - claims map[string]interface{} + claims map[string]any expectError bool }{ { name: "ID Token with JTI", tokenType: "id_token", - claims: map[string]interface{}{ + claims: map[string]any{ "iss": "https://test-issuer.com", "aud": "test-client-id", "exp": exp, @@ -3520,7 +3520,7 @@ func TestEdgeCasesWithDifferentTokenTypes(t *testing.T) { { name: "Access Token with JTI", tokenType: "access_token", - claims: map[string]interface{}{ + claims: map[string]any{ "iss": "https://test-issuer.com", "aud": "test-client-id", "exp": exp, @@ -3536,7 +3536,7 @@ func TestEdgeCasesWithDifferentTokenTypes(t *testing.T) { { name: "Token without JTI", tokenType: "no_jti", - claims: map[string]interface{}{ + claims: map[string]any{ "iss": "https://test-issuer.com", "aud": "test-client-id", "exp": exp, @@ -3793,7 +3793,7 @@ func TestScopeMergingEdgeCases(t *testing.T) { // generateLargeUserScopes creates a large list of user scopes for performance testing func generateLargeUserScopes() []string { scopes := make([]string, 100) - for i := 0; i < 100; i++ { + for i := range 100 { scopes[i] = fmt.Sprintf("scope_%d", i) } // Add some duplicates to test deduplication performance @@ -3808,7 +3808,7 @@ func TestScopeMergingPerformance(t *testing.T) { // Create 1000 user scopes with some duplicates userScopes := make([]string, 1000) - for i := 0; i < 1000; i++ { + for i := range 1000 { if i%10 == 0 { // Add some duplicates of defaults userScopes[i] = defaultScopes[i%len(defaultScopes)] diff --git a/performance_monitoring.go b/performance_monitoring.go index 8037c9d..555e764 100644 --- a/performance_monitoring.go +++ b/performance_monitoring.go @@ -1,6 +1,7 @@ package traefikoidc import ( + "maps" "runtime" "sync" "sync/atomic" @@ -288,7 +289,7 @@ func (pm *PerformanceMetrics) collectSystemMetrics() { } // GetMetrics returns all current performance metrics -func (pm *PerformanceMetrics) GetMetrics() map[string]interface{} { +func (pm *PerformanceMetrics) GetMetrics() map[string]any { pm.timingMutex.RLock() defer pm.timingMutex.RUnlock() @@ -317,7 +318,7 @@ func (pm *PerformanceMetrics) GetMetrics() map[string]interface{} { refreshErrorRate = float64(atomic.LoadInt64(&pm.refreshErrors)) / float64(refreshes) } - return map[string]interface{}{ + return map[string]any{ // Cache metrics "cache_hits": hits, "cache_misses": misses, @@ -370,11 +371,11 @@ func (pm *PerformanceMetrics) GetMetrics() map[string]interface{} { } // GetDetailedTimingMetrics returns detailed timing statistics -func (pm *PerformanceMetrics) GetDetailedTimingMetrics() map[string]interface{} { +func (pm *PerformanceMetrics) GetDetailedTimingMetrics() map[string]any { pm.timingMutex.RLock() defer pm.timingMutex.RUnlock() - return map[string]interface{}{ + return map[string]any{ "verification_stats": pm.calculateTimingStats(pm.verificationTimes), "verification_timing": pm.calculateTimingStats(pm.verificationTimes), "validation_stats": pm.calculateTimingStats(pm.validationTimes), @@ -385,9 +386,9 @@ func (pm *PerformanceMetrics) GetDetailedTimingMetrics() map[string]interface{} } // calculateTimingStats calculates statistical metrics for timing data -func (pm *PerformanceMetrics) calculateTimingStats(times []time.Duration) map[string]interface{} { +func (pm *PerformanceMetrics) calculateTimingStats(times []time.Duration) map[string]any { if len(times) == 0 { - return map[string]interface{}{ + return map[string]any{ "count": 0, "min_ms": float64(0), "max_ms": float64(0), @@ -404,7 +405,7 @@ func (pm *PerformanceMetrics) calculateTimingStats(times []time.Duration) map[st copy(sortedTimes, times) // Simple bubble sort for small arrays - for i := 0; i < len(sortedTimes); i++ { + for i := range sortedTimes { for j := i + 1; j < len(sortedTimes); j++ { if sortedTimes[i] > sortedTimes[j] { sortedTimes[i], sortedTimes[j] = sortedTimes[j], sortedTimes[i] @@ -426,7 +427,7 @@ func (pm *PerformanceMetrics) calculateTimingStats(times []time.Duration) map[st p95 := sortedTimes[int(float64(len(sortedTimes))*0.95)] p99 := sortedTimes[int(float64(len(sortedTimes))*0.99)] - return map[string]interface{}{ + return map[string]any{ "count": len(sortedTimes), "min_ms": float64(min.Nanoseconds()) / 1e6, "max_ms": float64(max.Nanoseconds()) / 1e6, @@ -527,9 +528,7 @@ func (rm *ResourceMonitor) GetCacheSizes() map[string]int64 { defer rm.cacheMutex.RUnlock() sizes := make(map[string]int64) - for name, size := range rm.cacheSizes { - sizes[name] = size - } + maps.Copy(sizes, rm.cacheSizes) return sizes } @@ -665,12 +664,12 @@ func (rm *ResourceMonitor) GetAlerts() []ResourceAlert { } // GetResourceStatus returns current resource status -func (rm *ResourceMonitor) GetResourceStatus() map[string]interface{} { +func (rm *ResourceMonitor) GetResourceStatus() map[string]any { metrics := rm.perfMetrics.GetMetrics() cacheSizes := rm.GetCacheSizes() - status := map[string]interface{}{ - "limits": map[string]interface{}{ + status := map[string]any{ + "limits": map[string]any{ "max_memory_bytes": rm.maxMemoryBytes, "max_cache_size": rm.maxCacheSize, "max_sessions": rm.maxSessions, diff --git a/performance_monitoring_test.go b/performance_monitoring_test.go index 7c61ed3..05ab4f3 100644 --- a/performance_monitoring_test.go +++ b/performance_monitoring_test.go @@ -83,7 +83,7 @@ func TestPerformanceMetrics(t *testing.T) { t.Run("Get detailed timing metrics", func(t *testing.T) { // Add more timing data - for i := 0; i < 5; i++ { + for i := range 5 { metrics.RecordTokenVerification(time.Duration(i+1)*time.Millisecond, true) } @@ -93,7 +93,7 @@ func TestPerformanceMetrics(t *testing.T) { t.Error("Expected verification stats to be present") } - verificationStats := detailed["verification_stats"].(map[string]interface{}) + verificationStats := detailed["verification_stats"].(map[string]any) if verificationStats["count"].(int) != 6 { // 1 from previous test + 5 new t.Errorf("Expected 6 verifications, got %v", verificationStats["count"]) } @@ -154,7 +154,7 @@ func TestPerformanceMetricsCalculations(t *testing.T) { } detailed := metrics.GetDetailedTimingMetrics() - verificationStats := detailed["verification_stats"].(map[string]interface{}) + verificationStats := detailed["verification_stats"].(map[string]any) // Average should be 20ms avgMs := verificationStats["average_ms"].(float64) @@ -178,7 +178,7 @@ func TestPerformanceMetricsCalculations(t *testing.T) { } detailed := metrics.GetDetailedTimingMetrics() - verificationStats := detailed["verification_stats"].(map[string]interface{}) + verificationStats := detailed["verification_stats"].(map[string]any) minMs := verificationStats["min_ms"].(float64) maxMs := verificationStats["max_ms"].(float64) @@ -222,11 +222,11 @@ func TestPerformanceMetricsConcurrency(t *testing.T) { // Test concurrent access done := make(chan bool, 10) - for i := 0; i < 10; i++ { + for range 10 { go func() { defer func() { done <- true }() - for j := 0; j < 100; j++ { + for range 100 { metrics.RecordCacheHit() metrics.RecordTokenVerification(time.Millisecond, true) } @@ -234,7 +234,7 @@ func TestPerformanceMetricsConcurrency(t *testing.T) { } // Wait for all goroutines to complete - for i := 0; i < 10; i++ { + for range 10 { <-done } @@ -303,7 +303,7 @@ func TestPerformanceMetricsEdgeCases(t *testing.T) { metrics.RecordTokenVerification(largeDuration, true) detailed := metrics.GetDetailedTimingMetrics() - verificationStats := detailed["verification_stats"].(map[string]interface{}) + verificationStats := detailed["verification_stats"].(map[string]any) // Should handle large durations without overflow if verificationStats["max_ms"].(float64) <= 0 { diff --git a/robustness_test.go b/robustness_test.go index fb029e1..15c3410 100644 --- a/robustness_test.go +++ b/robustness_test.go @@ -22,8 +22,8 @@ func TestConcurrentTokenVerification(t *testing.T) { // Create multiple valid tokens to avoid replay detection tokens := make([]string, 10) - for i := 0; i < 10; i++ { - token, err := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]interface{}{ + for i := range 10 { + token, err := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]any{ "iss": "https://test-issuer.com", "aud": "test-client-id", "exp": float64(time.Now().Add(1 * time.Hour).Unix()), @@ -71,11 +71,11 @@ func TestConcurrentTokenVerification(t *testing.T) { var errorCount int64 errors := make(chan error, numGoroutines*verificationsPerGoroutine) - for i := 0; i < numGoroutines; i++ { + for i := range numGoroutines { wg.Add(1) go func(goroutineID int) { defer wg.Done() - for j := 0; j < verificationsPerGoroutine; j++ { + for j := range verificationsPerGoroutine { tokenIndex := (goroutineID*verificationsPerGoroutine + j) % len(tokens) err := tOidc.VerifyToken(tokens[tokenIndex]) if err != nil { @@ -144,8 +144,8 @@ func TestCacheMemoryExhaustion(t *testing.T) { const numTokens = 500 tokens := make([]string, numTokens) - for i := 0; i < numTokens; i++ { - token, err := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]interface{}{ + for i := range numTokens { + token, err := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]any{ "iss": "https://test-issuer.com", "aud": "test-client-id", "exp": float64(time.Now().Add(1 * time.Hour).Unix()), @@ -161,7 +161,7 @@ func TestCacheMemoryExhaustion(t *testing.T) { tokens[i] = token // Add to cache - claims := map[string]interface{}{ + claims := map[string]any{ "iss": "https://test-issuer.com", "aud": "test-client-id", "exp": float64(time.Now().Add(1 * time.Hour).Unix()), @@ -210,7 +210,7 @@ func TestSessionConcurrencyProtection(t *testing.T) { var successCount int64 var errorCount int64 - for i := 0; i < numGoroutines; i++ { + for i := range numGoroutines { wg.Add(1) go func(goroutineID int) { defer wg.Done() @@ -218,7 +218,7 @@ func TestSessionConcurrencyProtection(t *testing.T) { // Each goroutine gets its own request and session req := httptest.NewRequest("GET", "/test", nil) - for j := 0; j < operationsPerGoroutine; j++ { + for j := range operationsPerGoroutine { // Get a fresh session for each operation s, err := sessionManager.GetSession(req) if err != nil { @@ -276,11 +276,11 @@ func TestParallelCacheOperations(t *testing.T) { var deleteCount int64 // Start multiple goroutines performing cache operations - for i := 0; i < numGoroutines; i++ { + for i := range numGoroutines { wg.Add(1) go func(goroutineID int) { defer wg.Done() - for j := 0; j < operationsPerGoroutine; j++ { + for j := range operationsPerGoroutine { key := fmt.Sprintf("key-%d-%d", goroutineID, j) value := fmt.Sprintf("value-%d-%d", goroutineID, j) @@ -377,7 +377,7 @@ func TestOversizedTokenHandling(t *testing.T) { // Create an oversized token with large claims largeClaim := strings.Repeat("x", 10000) // 10KB claim - oversizedClaims := map[string]interface{}{ + oversizedClaims := map[string]any{ "iss": "https://test-issuer.com", "aud": "test-client-id", "exp": float64(time.Now().Add(1 * time.Hour).Unix()), @@ -411,7 +411,7 @@ func TestOversizedTokenHandling(t *testing.T) { // Test extremely long token (beyond reasonable limits) extremelyLongClaim := strings.Repeat("y", 100000) // 100KB claim - extremeClaims := map[string]interface{}{ + extremeClaims := map[string]any{ "iss": "https://test-issuer.com", "aud": "test-client-id", "exp": float64(time.Now().Add(1 * time.Hour).Unix()), @@ -528,7 +528,7 @@ func TestMaliciousInputValidation(t *testing.T) { } // Verify the system is still functional after malicious input - validToken, createErr := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]interface{}{ + validToken, createErr := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]any{ "iss": "https://test-issuer.com", "aud": "test-client-id", "exp": float64(time.Now().Add(1 * time.Hour).Unix()), @@ -609,7 +609,7 @@ func TestResourceLimits(t *testing.T) { defer cache.Close() // Try to overwhelm the cache - for i := 0; i < 1000; i++ { + for i := range 1000 { key := fmt.Sprintf("key-%d", i) value := fmt.Sprintf("value-%d", i) cache.Set(key, value, time.Minute) @@ -627,7 +627,7 @@ func TestResourceLimits(t *testing.T) { denied := 0 // Make many requests quickly - for i := 0; i < 100; i++ { + for range 100 { if limiter.Allow() { allowed++ } else { @@ -658,7 +658,7 @@ func TestErrorRecoveryPatterns(t *testing.T) { } // System should handle corrupted cache gracefully - validToken, err := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]interface{}{ + validToken, err := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]any{ "iss": "https://test-issuer.com", "aud": "test-client-id", "exp": float64(time.Now().Add(1 * time.Hour).Unix()), @@ -684,7 +684,7 @@ func TestErrorRecoveryPatterns(t *testing.T) { ts.tOidc.tokenBlacklist.Set("corrupted-entry", "invalid-data", time.Hour) // System should still function - validToken, err := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]interface{}{ + validToken, err := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]any{ "iss": "https://test-issuer.com", "aud": "test-client-id", "exp": float64(time.Now().Add(1 * time.Hour).Unix()), @@ -716,8 +716,8 @@ func TestPerformanceUnderLoad(t *testing.T) { // Create multiple valid tokens const numTokens = 100 tokens := make([]string, numTokens) - for i := 0; i < numTokens; i++ { - token, err := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]interface{}{ + for i := range numTokens { + token, err := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]any{ "iss": "https://test-issuer.com", "aud": "test-client-id", "exp": float64(time.Now().Add(1 * time.Hour).Unix()), @@ -760,7 +760,7 @@ func TestPerformanceUnderLoad(t *testing.T) { const iterations = 1000 start := time.Now() - for i := 0; i < iterations; i++ { + for i := range iterations { tokenIndex := i % numTokens err := tOidc.VerifyToken(tokens[tokenIndex]) if err != nil { diff --git a/security_edge_cases_test.go b/security_edge_cases_test.go index 58ed0cd..0ebbf64 100644 --- a/security_edge_cases_test.go +++ b/security_edge_cases_test.go @@ -11,6 +11,7 @@ import ( "fmt" "net/http" "net/http/httptest" + "slices" "strings" "testing" "time" @@ -25,7 +26,7 @@ func TestJWTAlgorithmConfusionAttack(t *testing.T) { ts.Setup() // Create a standard JWT with RS256 algorithm - validRS256JWT, err := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]interface{}{ + validRS256JWT, err := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]any{ "iss": "https://test-issuer.com", "aud": "test-client-id", "exp": float64(time.Now().Add(1 * time.Hour).Unix()), @@ -51,7 +52,7 @@ func TestJWTAlgorithmConfusionAttack(t *testing.T) { } // Parse header - var header map[string]interface{} + var header map[string]any if err := json.Unmarshal(headerBytes, &header); err != nil { t.Fatalf("Failed to unmarshal header: %v", err) } @@ -90,7 +91,7 @@ func TestJWTNoneAlgorithmAttack(t *testing.T) { ts.Setup() // Create a standard JWT - validJWT, err := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]interface{}{ + validJWT, err := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]any{ "iss": "https://test-issuer.com", "aud": "test-client-id", "exp": float64(time.Now().Add(1 * time.Hour).Unix()), @@ -116,7 +117,7 @@ func TestJWTNoneAlgorithmAttack(t *testing.T) { } // Parse header - var header map[string]interface{} + var header map[string]any if err := json.Unmarshal(headerBytes, &header); err != nil { t.Fatalf("Failed to unmarshal header: %v", err) } @@ -154,7 +155,7 @@ func TestJWTTokenTampering(t *testing.T) { ts.Setup() // Create a standard JWT - validJWT, err := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]interface{}{ + validJWT, err := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]any{ "iss": "https://test-issuer.com", "aud": "test-client-id", "exp": float64(time.Now().Add(1 * time.Hour).Unix()), @@ -180,7 +181,7 @@ func TestJWTTokenTampering(t *testing.T) { } // Parse claims - var claims map[string]interface{} + var claims map[string]any if err := json.Unmarshal(claimsBytes, &claims); err != nil { t.Fatalf("Failed to unmarshal claims: %v", err) } @@ -219,7 +220,7 @@ func TestJWTExpiredToken(t *testing.T) { ts.Setup() // Create a JWT that is already expired - expiredJWT, err := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]interface{}{ + expiredJWT, err := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]any{ "iss": "https://test-issuer.com", "aud": "test-client-id", "exp": float64(time.Now().Add(-1 * time.Hour).Unix()), // Expired 1 hour ago @@ -252,7 +253,7 @@ func TestJWTFutureToken(t *testing.T) { ts.Setup() // Create a JWT with a future issuance time - futureJWT, err := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]interface{}{ + futureJWT, err := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]any{ "iss": "https://test-issuer.com", "aud": "test-client-id", "exp": float64(time.Now().Add(2 * time.Hour).Unix()), @@ -315,7 +316,7 @@ func TestJWTReplayAttack(t *testing.T) { fixedJTI := "fixed-test-jti-for-replay-" + generateRandomString(8) // Create a JWT with the fixed JTI - replayJWT, err := createTestJWT(rsaPrivateKey, "RS256", "test-key-id", map[string]interface{}{ + replayJWT, err := createTestJWT(rsaPrivateKey, "RS256", "test-key-id", map[string]any{ "iss": "https://test-issuer.com", "aud": "test-client-id", "exp": float64(time.Now().Add(1 * time.Hour).Unix()), @@ -422,7 +423,7 @@ func TestMissingClaims(t *testing.T) { for _, tc := range testCases { t.Run(tc.name, func(t *testing.T) { // Create standard claims - claims := map[string]interface{}{ + claims := map[string]any{ "iss": "https://test-issuer.com", "aud": "test-client-id", "exp": float64(time.Now().Add(1 * time.Hour).Unix()), @@ -598,13 +599,7 @@ func TestSessionFixationAttack(t *testing.T) { // - The response is unauthorized (401), OR // - The token verification failed expectedCodes := []int{http.StatusFound, http.StatusUnauthorized, http.StatusForbidden} - codeFound := false - for _, code := range expectedCodes { - if victimResp.Code == code { - codeFound = true - break - } - } + codeFound := slices.Contains(expectedCodes, victimResp.Code) if !codeFound { t.Errorf("Expected status code to be one of %v, but got %d", expectedCodes, victimResp.Code) @@ -829,7 +824,7 @@ func TestTokenBlacklisting(t *testing.T) { } // Create a valid JWT - validJWT, err := createTestJWT(rsaPrivateKey, "RS256", "test-key-id", map[string]interface{}{ + validJWT, err := createTestJWT(rsaPrivateKey, "RS256", "test-key-id", map[string]any{ "iss": "https://test-issuer.com", "aud": "test-client-id", "exp": float64(time.Now().Add(1 * time.Hour).Unix()), @@ -919,7 +914,7 @@ func TestDifferentSigningAlgorithms(t *testing.T) { for _, tc := range testCases { t.Run(tc.name, func(t *testing.T) { // Define standard claims with unique JTI for each test - standardClaims := map[string]interface{}{ + standardClaims := map[string]any{ "iss": "https://test-issuer.com", "aud": "test-client-id", "exp": float64(time.Now().Add(1 * time.Hour).Unix()), @@ -1022,9 +1017,9 @@ func TestDifferentSigningAlgorithms(t *testing.T) { } // createTestJWTWithECKey creates a JWT signed with an EC private key -func createTestJWTWithECKey(privateKey *ecdsa.PrivateKey, alg, kid string, claims map[string]interface{}) (string, error) { +func createTestJWTWithECKey(privateKey *ecdsa.PrivateKey, alg, kid string, claims map[string]any) (string, error) { // Create the header - header := map[string]interface{}{ + header := map[string]any{ "alg": alg, "typ": "JWT", "kid": kid, @@ -1281,7 +1276,7 @@ func TestRateLimiting(t *testing.T) { tOidc.tokenVerifier = tOidc // Create a valid JWT token - validJWT, err := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]interface{}{ + validJWT, err := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]any{ "iss": "https://test-issuer.com", "aud": "test-client-id", "exp": float64(time.Now().Add(1 * time.Hour).Unix()), @@ -1301,7 +1296,7 @@ func TestRateLimiting(t *testing.T) { } // Second request should succeed - validJWT2, err := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]interface{}{ + validJWT2, err := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]any{ "iss": "https://test-issuer.com", "aud": "test-client-id", "exp": float64(time.Now().Add(1 * time.Hour).Unix()), @@ -1320,7 +1315,7 @@ func TestRateLimiting(t *testing.T) { } // Third request should be rate limited - validJWT3, err := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]interface{}{ + validJWT3, err := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]any{ "iss": "https://test-issuer.com", "aud": "test-client-id", "exp": float64(time.Now().Add(1 * time.Hour).Unix()), @@ -1404,13 +1399,7 @@ func TestAuthorizationHeaderBypass(t *testing.T) { // Verify that the response is a redirect to authentication (302) or unauthorized (401) expectedCodes := []int{http.StatusFound, http.StatusUnauthorized} - codeFound := false - for _, code := range expectedCodes { - if resp.Code == code { - codeFound = true - break - } - } + codeFound := slices.Contains(expectedCodes, resp.Code) if !codeFound { t.Errorf("Expected status code to be one of %v, but got %d", expectedCodes, resp.Code) @@ -1423,7 +1412,7 @@ func TestEmptyAudience(t *testing.T) { ts.Setup() // Create a JWT with empty audience - emptyAudJWT, err := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]interface{}{ + emptyAudJWT, err := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]any{ "iss": "https://test-issuer.com", "aud": "", // Empty audience "exp": float64(time.Now().Add(1 * time.Hour).Unix()), @@ -1456,7 +1445,7 @@ func TestEmptyIssuer(t *testing.T) { ts.Setup() // Create a JWT with empty issuer - emptyIssJWT, err := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]interface{}{ + emptyIssJWT, err := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]any{ "iss": "", // Empty issuer "aud": "test-client-id", "exp": float64(time.Now().Add(1 * time.Hour).Unix()), diff --git a/security_monitoring.go b/security_monitoring.go index e9d103d..5c7821e 100644 --- a/security_monitoring.go +++ b/security_monitoring.go @@ -2,6 +2,7 @@ package traefikoidc import ( "fmt" + "maps" "net" "net/http" "strings" @@ -12,14 +13,14 @@ import ( // SecurityEvent represents a security-related event that should be logged and monitored type SecurityEvent struct { - Type string `json:"type"` - Severity string `json:"severity"` - Timestamp time.Time `json:"timestamp"` - ClientIP string `json:"client_ip"` - UserAgent string `json:"user_agent"` - RequestPath string `json:"request_path"` - Message string `json:"message"` - Details map[string]interface{} `json:"details,omitempty"` + Type string `json:"type"` + Severity string `json:"severity"` + Timestamp time.Time `json:"timestamp"` + ClientIP string `json:"client_ip"` + UserAgent string `json:"user_agent"` + RequestPath string `json:"request_path"` + Message string `json:"message"` + Details map[string]any `json:"details,omitempty"` } // SecurityMonitor tracks security events and suspicious activity patterns @@ -145,7 +146,7 @@ func NewSuspiciousPatternDetector() *SuspiciousPatternDetector { } // RecordAuthenticationFailure records an authentication failure event -func (sm *SecurityMonitor) RecordAuthenticationFailure(clientIP, userAgent, requestPath, reason string, details map[string]interface{}) { +func (sm *SecurityMonitor) RecordAuthenticationFailure(clientIP, userAgent, requestPath, reason string, details map[string]any) { atomic.AddInt64(&sm.authFailures, 1) event := SecurityEvent{ @@ -167,7 +168,7 @@ func (sm *SecurityMonitor) RecordAuthenticationFailure(clientIP, userAgent, requ func (sm *SecurityMonitor) RecordTokenValidationFailure(clientIP, userAgent, requestPath, reason string, tokenPrefix string) { atomic.AddInt64(&sm.tokenValidationFails, 1) - details := map[string]interface{}{ + details := map[string]any{ "reason": reason, } if tokenPrefix != "" { @@ -201,7 +202,7 @@ func (sm *SecurityMonitor) RecordRateLimitHit(clientIP, userAgent, requestPath s UserAgent: userAgent, RequestPath: requestPath, Message: "Rate limit exceeded", - Details: map[string]interface{}{ + Details: map[string]any{ "limit_type": "token_verification", }, } @@ -211,7 +212,7 @@ func (sm *SecurityMonitor) RecordRateLimitHit(clientIP, userAgent, requestPath s } // RecordSuspiciousActivity records suspicious activity that doesn't fit other categories -func (sm *SecurityMonitor) RecordSuspiciousActivity(clientIP, userAgent, requestPath, activityType, description string, details map[string]interface{}) { +func (sm *SecurityMonitor) RecordSuspiciousActivity(clientIP, userAgent, requestPath, activityType, description string, details map[string]any) { atomic.AddInt64(&sm.suspiciousRequests, 1) event := SecurityEvent{ @@ -266,7 +267,7 @@ func (sm *SecurityMonitor) recordIPFailure(clientIP, failureType string) { Timestamp: time.Now(), ClientIP: clientIP, Message: fmt.Sprintf("IP blocked due to %d failures in %d minutes", tracker.FailureCount, sm.config.FailureWindowMinutes), - Details: map[string]interface{}{ + Details: map[string]any{ "failure_count": tracker.FailureCount, "failure_types": tracker.FailureTypes, "blocked_until": tracker.BlockedUntil, @@ -319,7 +320,7 @@ func (sm *SecurityMonitor) processSecurityEvent(event SecurityEvent) { Severity: "high", Timestamp: time.Now(), Message: fmt.Sprintf("Suspicious pattern detected: %s", pattern), - Details: map[string]interface{}{ + Details: map[string]any{ "pattern_type": pattern, "trigger_event": event, }, @@ -352,7 +353,7 @@ func (sm *SecurityMonitor) AddEventHandler(handler SecurityEventHandler) { } // GetSecurityMetrics returns current security metrics -func (sm *SecurityMonitor) GetSecurityMetrics() map[string]interface{} { +func (sm *SecurityMonitor) GetSecurityMetrics() map[string]any { sm.ipMutex.RLock() defer sm.ipMutex.RUnlock() @@ -367,7 +368,7 @@ func (sm *SecurityMonitor) GetSecurityMetrics() map[string]interface{} { tracker.mutex.RUnlock() } - return map[string]interface{}{ + return map[string]any{ "auth_failures": atomic.LoadInt64(&sm.authFailures), "token_validation_fails": atomic.LoadInt64(&sm.tokenValidationFails), "rate_limit_hits": atomic.LoadInt64(&sm.rateLimitHits), @@ -565,8 +566,6 @@ func (h *MetricsSecurityEventHandler) GetMetrics() map[string]int64 { defer h.mutex.RUnlock() metrics := make(map[string]int64) - for k, v := range h.eventCounts { - metrics[k] = v - } + maps.Copy(metrics, h.eventCounts) return metrics } diff --git a/security_monitoring_test.go b/security_monitoring_test.go index 1c0c6c2..e3af06a 100644 --- a/security_monitoring_test.go +++ b/security_monitoring_test.go @@ -2,6 +2,7 @@ package traefikoidc import ( "net/http/httptest" + "slices" "strconv" "testing" "time" @@ -60,7 +61,7 @@ func TestSecurityMonitor(t *testing.T) { }) t.Run("Suspicious activity", func(t *testing.T) { - details := map[string]interface{}{"pattern": "unusual"} + details := map[string]any{"pattern": "unusual"} monitor.RecordSuspiciousActivity("192.168.1.5", "test-agent", "/admin", "unusual pattern", "high frequency requests", details) metrics := monitor.GetSecurityMetrics() @@ -86,7 +87,7 @@ func TestSuspiciousPatternDetector(t *testing.T) { t.Run("Add events and detect patterns", func(t *testing.T) { // Add multiple events from same IP - for i := 0; i < 10; i++ { + for range 10 { event := SecurityEvent{ Type: "authentication_failure", ClientIP: "192.168.1.100", @@ -97,13 +98,7 @@ func TestSuspiciousPatternDetector(t *testing.T) { patterns := detector.DetectSuspiciousPatterns() - found := false - for _, pattern := range patterns { - if pattern == "rapid_failures_from_ip_192.168.1.100" { - found = true - break - } - } + found := slices.Contains(patterns, "rapid_failures_from_ip_192.168.1.100") if !found { t.Error("Expected to detect rapid failure pattern") } @@ -111,7 +106,7 @@ func TestSuspiciousPatternDetector(t *testing.T) { t.Run("Detect distributed attack pattern", func(t *testing.T) { // Add failures from many different IPs - for i := 0; i < 25; i++ { + for i := range 25 { event := SecurityEvent{ Type: "authentication_failure", ClientIP: "192.168.1." + strconv.Itoa(100+i), @@ -122,13 +117,7 @@ func TestSuspiciousPatternDetector(t *testing.T) { patterns := detector.DetectSuspiciousPatterns() - found := false - for _, pattern := range patterns { - if pattern == "distributed_attack_pattern" { - found = true - break - } - } + found := slices.Contains(patterns, "distributed_attack_pattern") if !found { t.Error("Expected to detect distributed attack pattern") } @@ -317,7 +306,7 @@ func TestSecurityEventTypes(t *testing.T) { monitor.RecordTokenValidationFailure("192.168.1.200", "test-agent", "/api", "expired token", "abc123") monitor.RecordRateLimitHit("192.168.1.200", "test-agent", "/api") - details := map[string]interface{}{"pattern": "test"} + details := map[string]any{"pattern": "test"} monitor.RecordSuspiciousActivity("192.168.1.200", "test-agent", "/admin", "unusual pattern", "multiple failed logins", details) metrics := monitor.GetSecurityMetrics() diff --git a/session.go b/session.go index 54a0986..4c24942 100644 --- a/session.go +++ b/session.go @@ -245,7 +245,7 @@ func NewSessionManager(encryptionKey string, forceHTTPS bool, logger *Logger) (* logger: logger, } - sm.sessionPool.New = func() interface{} { + sm.sessionPool.New = func() any { sd := &SessionData{ manager: sm, accessTokenChunks: make(map[int]*sessions.Session), @@ -683,7 +683,7 @@ func (sd *SessionData) SetAuthenticated(value bool) error { } maxRetries := 5 - for retry := 0; retry < maxRetries; retry++ { + for retry := range maxRetries { if sd.mainSession.ID != id { break } @@ -870,7 +870,7 @@ func (sd *SessionData) getAccessTokenUnsafe() string { totalSize := 0 // Sequential chunk validation with gap detection - for i := 0; i < expectedChunkCount; i++ { + for i := range expectedChunkCount { session, ok := sd.accessTokenChunks[i] if !ok { sd.manager.logger.Errorf("CRITICAL: Access token chunk %d missing - gap in sequence detected", i) @@ -1206,7 +1206,7 @@ func (sd *SessionData) GetRefreshToken() string { totalSize := 0 // Sequential chunk validation with gap detection - for i := 0; i < expectedChunkCount; i++ { + for i := range expectedChunkCount { session, ok := sd.refreshTokenChunks[i] if !ok { sd.manager.logger.Errorf("CRITICAL: Refresh token chunk %d missing - gap in sequence detected", i) @@ -1461,7 +1461,7 @@ func (sd *SessionData) expireAccessTokenChunksEnhanced(w http.ResponseWriter) { const maxChunkSearchLimit = 50 // Limit search to prevent infinite loops from corrupted state orphanedChunks := 0 - for i := 0; i < maxChunkSearchLimit; i++ { + for i := range maxChunkSearchLimit { sessionName := fmt.Sprintf("%s_%d", accessTokenCookie, i) session, err := sd.manager.store.Get(sd.request, sessionName) if err != nil { @@ -1491,7 +1491,7 @@ func (sd *SessionData) expireAccessTokenChunksEnhanced(w http.ResponseWriter) { // Expire the chunk regardless of orphan status session.Options.MaxAge = -1 - session.Values = make(map[interface{}]interface{}) + session.Values = make(map[any]any) if w != nil { if err := session.Save(sd.request, w); err != nil { sd.manager.logger.Errorf("failed to save expired access token chunk %d: %v", i, err) @@ -1514,7 +1514,7 @@ func (sd *SessionData) expireRefreshTokenChunksEnhanced(w http.ResponseWriter) { const maxChunkSearchLimit = 50 // Limit search to prevent infinite loops from corrupted state orphanedChunks := 0 - for i := 0; i < maxChunkSearchLimit; i++ { + for i := range maxChunkSearchLimit { sessionName := fmt.Sprintf("%s_%d", refreshTokenCookie, i) session, err := sd.manager.store.Get(sd.request, sessionName) if err != nil { @@ -1544,7 +1544,7 @@ func (sd *SessionData) expireRefreshTokenChunksEnhanced(w http.ResponseWriter) { // Expire the chunk regardless of orphan status session.Options.MaxAge = -1 - session.Values = make(map[interface{}]interface{}) + session.Values = make(map[any]any) if w != nil { if err := session.Save(sd.request, w); err != nil { sd.manager.logger.Errorf("failed to save expired refresh token chunk %d: %v", i, err) @@ -1567,7 +1567,7 @@ func (sd *SessionData) expireIDTokenChunksEnhanced(w http.ResponseWriter) { const maxChunkSearchLimit = 50 // Limit search to prevent infinite loops from corrupted state orphanedChunks := 0 - for i := 0; i < maxChunkSearchLimit; i++ { + for i := range maxChunkSearchLimit { sessionName := fmt.Sprintf("%s_%d", idTokenCookie, i) session, err := sd.manager.store.Get(sd.request, sessionName) if err != nil { @@ -1597,7 +1597,7 @@ func (sd *SessionData) expireIDTokenChunksEnhanced(w http.ResponseWriter) { // Expire the chunk regardless of orphan status session.Options.MaxAge = -1 - session.Values = make(map[interface{}]interface{}) + session.Values = make(map[any]any) if w != nil { if err := session.Save(sd.request, w); err != nil { sd.manager.logger.Errorf("failed to save expired ID token chunk %d: %v", i, err) @@ -1897,7 +1897,7 @@ func (sd *SessionData) getIDTokenUnsafe() string { totalSize := 0 // Sequential chunk validation with gap detection - for i := 0; i < expectedChunkCount; i++ { + for i := range expectedChunkCount { session, ok := sd.idTokenChunks[i] if !ok { sd.manager.logger.Errorf("CRITICAL: ID token chunk %d missing - gap in sequence detected", i) diff --git a/session_test.go b/session_test.go index ee34808..eeede7a 100644 --- a/session_test.go +++ b/session_test.go @@ -148,7 +148,7 @@ func getPooledObjects(sm *SessionManager) int { var objects []*SessionData maxAttempts := 100 // Safety limit to prevent infinite loops - for i := 0; i < maxAttempts; i++ { + for range maxAttempts { obj := sm.sessionPool.Get() if obj == nil { break @@ -195,7 +195,7 @@ func TestSessionObjectTracking(t *testing.T) { } // Create and discard 5 sessions - for i := 0; i < 5; i++ { + for range 5 { session, err := sm.GetSession(req) if err != nil { t.Fatalf("GetSession failed: %v", err) @@ -425,7 +425,7 @@ func TestTokenChunkingCorruptionResistance(t *testing.T) { // Create a large token that will be chunked largeToken := "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9." + - base64.RawURLEncoding.EncodeToString([]byte(fmt.Sprintf(`{"sub":"test","data":"%s"}`, strings.Repeat("A", 5000)))) + + base64.RawURLEncoding.EncodeToString(fmt.Appendf(nil, `{"sub":"test","data":"%s"}`, strings.Repeat("A", 5000))) + ".signature" req := httptest.NewRequest("GET", "http://example.com/foo", nil) @@ -609,11 +609,11 @@ func TestConcurrentTokenOperations(t *testing.T) { // Test concurrent access and refresh token operations done := make(chan bool, numGoroutines) - for i := 0; i < numGoroutines; i++ { + for i := range numGoroutines { go func(id int) { defer func() { done <- true }() - for j := 0; j < numOperations; j++ { + for j := range numOperations { // Create unique tokens for each goroutine/operation accessToken := ValidAccessToken refreshToken := fmt.Sprintf("refresh_token_%d_%d", id, j) @@ -637,7 +637,7 @@ func TestConcurrentTokenOperations(t *testing.T) { } // Wait for all goroutines to complete - for i := 0; i < numGoroutines; i++ { + for range numGoroutines { <-done } } diff --git a/settings.go b/settings.go index d2d6af3..d6a7cfe 100644 --- a/settings.go +++ b/settings.go @@ -481,7 +481,7 @@ func NewLogger(logLevel string) *Logger { // Parameters: // - format: The format string (as in fmt.Printf). // - args: The arguments for the format string. -func (l *Logger) Info(format string, args ...interface{}) { +func (l *Logger) Info(format string, args ...any) { l.logInfo.Printf(format, args...) } @@ -491,7 +491,7 @@ func (l *Logger) Info(format string, args ...interface{}) { // Parameters: // - format: The format string (as in fmt.Printf). // - args: The arguments for the format string. -func (l *Logger) Debug(format string, args ...interface{}) { +func (l *Logger) Debug(format string, args ...any) { l.logDebug.Printf(format, args...) } @@ -501,7 +501,7 @@ func (l *Logger) Debug(format string, args ...interface{}) { // Parameters: // - format: The format string (as in fmt.Printf). // - args: The arguments for the format string. -func (l *Logger) Error(format string, args ...interface{}) { +func (l *Logger) Error(format string, args ...any) { l.logError.Printf(format, args...) } @@ -512,7 +512,7 @@ func (l *Logger) Error(format string, args ...interface{}) { // Parameters: // - format: The format string (as in fmt.Printf). // - args: The arguments for the format string. -func (l *Logger) Infof(format string, args ...interface{}) { +func (l *Logger) Infof(format string, args ...any) { l.logInfo.Printf(format, args...) } @@ -523,7 +523,7 @@ func (l *Logger) Infof(format string, args ...interface{}) { // Parameters: // - format: The format string (as in fmt.Printf). // - args: The arguments for the format string. -func (l *Logger) Debugf(format string, args ...interface{}) { +func (l *Logger) Debugf(format string, args ...any) { l.logDebug.Printf(format, args...) } @@ -534,7 +534,7 @@ func (l *Logger) Debugf(format string, args ...interface{}) { // Parameters: // - format: The format string (as in fmt.Printf). // - args: The arguments for the format string. -func (l *Logger) Errorf(format string, args ...interface{}) { +func (l *Logger) Errorf(format string, args ...any) { l.logError.Printf(format, args...) } diff --git a/templated_header_execution_test.go b/templated_header_execution_test.go index 9a0bb79..37c5f46 100644 --- a/templated_header_execution_test.go +++ b/templated_header_execution_test.go @@ -11,15 +11,15 @@ func TestTemplateExecution(t *testing.T) { tests := []struct { name string templateText string - data map[string]interface{} + data map[string]any expectedValue string expectError bool }{ { name: "String Claim", templateText: "{{.Claims.email}}", - data: map[string]interface{}{ - "Claims": map[string]interface{}{ + data: map[string]any{ + "Claims": map[string]any{ "email": "user@example.com", }, }, @@ -29,8 +29,8 @@ func TestTemplateExecution(t *testing.T) { { name: "Number Claim", templateText: "{{.Claims.age}}", - data: map[string]interface{}{ - "Claims": map[string]interface{}{ + data: map[string]any{ + "Claims": map[string]any{ "age": 30, }, }, @@ -40,8 +40,8 @@ func TestTemplateExecution(t *testing.T) { { name: "Boolean Claim", templateText: "{{.Claims.admin}}", - data: map[string]interface{}{ - "Claims": map[string]interface{}{ + data: map[string]any{ + "Claims": map[string]any{ "admin": true, }, }, @@ -51,8 +51,8 @@ func TestTemplateExecution(t *testing.T) { { name: "Array Claim", templateText: "{{index .Claims.roles 0}}", - data: map[string]interface{}{ - "Claims": map[string]interface{}{ + data: map[string]any{ + "Claims": map[string]any{ "roles": []string{"admin", "user"}, }, }, @@ -62,9 +62,9 @@ func TestTemplateExecution(t *testing.T) { { name: "Nested Object Claim", templateText: "{{.Claims.user.name}}", - data: map[string]interface{}{ - "Claims": map[string]interface{}{ - "user": map[string]interface{}{ + data: map[string]any{ + "Claims": map[string]any{ + "user": map[string]any{ "name": "John Doe", }, }, @@ -75,7 +75,7 @@ func TestTemplateExecution(t *testing.T) { { name: "Access Token", templateText: "Bearer {{.AccessToken}}", - data: map[string]interface{}{ + data: map[string]any{ "AccessToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.e30.Et9HFtf9R3GEMA0IICOfFMVXY7kkTX1wr4qCyhIf58U", }, expectedValue: "Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.e30.Et9HFtf9R3GEMA0IICOfFMVXY7kkTX1wr4qCyhIf58U", @@ -84,7 +84,7 @@ func TestTemplateExecution(t *testing.T) { { name: "ID Token", templateText: "{{.IdToken}}", - data: map[string]interface{}{ + data: map[string]any{ "IdToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.e30.Et9HFtf9R3GEMA0IICOfFMVXY7kkTX1wr4qCyhIf58U", }, expectedValue: "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.e30.Et9HFtf9R3GEMA0IICOfFMVXY7kkTX1wr4qCyhIf58U", @@ -93,7 +93,7 @@ func TestTemplateExecution(t *testing.T) { { name: "Refresh Token", templateText: "{{.RefreshToken}}", - data: map[string]interface{}{ + data: map[string]any{ "RefreshToken": "refresh-token-value", }, expectedValue: "refresh-token-value", @@ -102,8 +102,8 @@ func TestTemplateExecution(t *testing.T) { { name: "Conditional Template", templateText: "{{if .Claims.admin}}Admin User{{else}}Regular User{{end}}", - data: map[string]interface{}{ - "Claims": map[string]interface{}{ + data: map[string]any{ + "Claims": map[string]any{ "admin": true, }, }, @@ -113,8 +113,8 @@ func TestTemplateExecution(t *testing.T) { { name: "Multiple Claims", templateText: "{{.Claims.firstName}} {{.Claims.lastName}} <{{.Claims.email}}>", - data: map[string]interface{}{ - "Claims": map[string]interface{}{ + data: map[string]any{ + "Claims": map[string]any{ "firstName": "John", "lastName": "Doe", "email": "john.doe@example.com", @@ -126,8 +126,8 @@ func TestTemplateExecution(t *testing.T) { { name: "Missing Claim", templateText: "{{.Claims.missing}}", - data: map[string]interface{}{ - "Claims": map[string]interface{}{}, + data: map[string]any{ + "Claims": map[string]any{}, }, expectedValue: "", expectError: false, // Go templates don't error on missing values @@ -135,8 +135,8 @@ func TestTemplateExecution(t *testing.T) { { name: "Invalid Template Syntax", templateText: "{{.Claims.email", - data: map[string]interface{}{ - "Claims": map[string]interface{}{ + data: map[string]any{ + "Claims": map[string]any{ "email": "user@example.com", }, }, @@ -181,7 +181,7 @@ func TestTemplateExecutionContext(t *testing.T) { AccessToken string IdToken string RefreshToken string - Claims map[string]interface{} + Claims map[string]any } // Test cases @@ -197,7 +197,7 @@ func TestTemplateExecutionContext(t *testing.T) { data: templateData{ AccessToken: "access-token-value", IdToken: "id-token-value", // Now these should be distinct values - Claims: map[string]interface{}{}, + Claims: map[string]any{}, }, expectedValue: "Access: access-token-value ID: id-token-value", }, @@ -207,7 +207,7 @@ func TestTemplateExecutionContext(t *testing.T) { data: templateData{ AccessToken: "access-token", IdToken: "access-token", - Claims: map[string]interface{}{ + Claims: map[string]any{ "sub": "user123", }, }, diff --git a/templated_header_integration_test.go b/templated_header_integration_test.go index a561213..3de9c41 100644 --- a/templated_header_integration_test.go +++ b/templated_header_integration_test.go @@ -2,6 +2,7 @@ package traefikoidc import ( "errors" + "maps" "net/http" "net/http/httptest" "testing" @@ -22,7 +23,7 @@ func TestTemplatedHeadersIntegration(t *testing.T) { name string headers []TemplatedHeader sessionSetup func(*SessionData) - claims map[string]interface{} + claims map[string]any expectedHeaders map[string]string interceptedHeaders map[string]string }{ @@ -31,7 +32,7 @@ func TestTemplatedHeadersIntegration(t *testing.T) { headers: []TemplatedHeader{ {Name: "X-User-Email", Value: "{{.Claims.email}}"}, }, - claims: map[string]interface{}{ + claims: map[string]any{ "email": "user@example.com", }, expectedHeaders: map[string]string{ @@ -45,7 +46,7 @@ func TestTemplatedHeadersIntegration(t *testing.T) { {Name: "X-User-ID", Value: "{{.Claims.sub}}"}, {Name: "X-User-Name", Value: "{{.Claims.given_name}} {{.Claims.family_name}}"}, }, - claims: map[string]interface{}{ + claims: map[string]any{ "email": "user@example.com", "sub": "user123", "given_name": "John", @@ -94,7 +95,7 @@ func TestTemplatedHeadersIntegration(t *testing.T) { headers: []TemplatedHeader{ {Name: "X-User-Role", Value: "{{.Claims.role}}"}, }, - claims: map[string]interface{}{ + claims: map[string]any{ "email": "user@example.com", // role claim is missing }, @@ -107,7 +108,7 @@ func TestTemplatedHeadersIntegration(t *testing.T) { headers: []TemplatedHeader{ {Name: "X-User-Admin", Value: "{{if .Claims.is_admin}}true{{else}}false{{end}}"}, }, - claims: map[string]interface{}{ + claims: map[string]any{ "email": "admin@example.com", "is_admin": true, }, @@ -120,7 +121,7 @@ func TestTemplatedHeadersIntegration(t *testing.T) { headers: []TemplatedHeader{ {Name: "X-Auth-Info", Value: "User={{.Claims.email}}, Token={{.AccessToken}}"}, }, - claims: map[string]interface{}{ + claims: map[string]any{ "email": "user@example.com", }, expectedHeaders: map[string]string{ @@ -133,7 +134,7 @@ func TestTemplatedHeadersIntegration(t *testing.T) { headers: []TemplatedHeader{ {Name: "X-User-AccessToken", Value: "{{.AccessToken}}"}, }, - claims: map[string]interface{}{ // For ID Token + claims: map[string]any{ // For ID Token "email": "opaque_user@example.com", "sub": "opaque_sub_for_id_token", }, @@ -149,7 +150,7 @@ func TestTemplatedHeadersIntegration(t *testing.T) { token := ts.token if len(tc.claims) > 0 { var err error - baseClaims := map[string]interface{}{ + baseClaims := map[string]any{ "iss": "https://test-issuer.com", "aud": "test-client-id", "exp": float64(3000000000), // Far future timestamp @@ -161,9 +162,7 @@ func TestTemplatedHeadersIntegration(t *testing.T) { } // Add the test-specific claims - for k, v := range tc.claims { - baseClaims[k] = v - } + maps.Copy(baseClaims, tc.claims) token, err = createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", baseClaims) if err != nil { @@ -267,7 +266,7 @@ func TestTemplatedHeadersIntegration(t *testing.T) { session.SetRefreshToken("test-refresh-token") if tc.name == "ID Token Header" || tc.name == "Both Token Types" { - idTokenClaims := map[string]interface{}{ + idTokenClaims := map[string]any{ "iss": "https://test-issuer.com", "aud": "test-client-id", "exp": float64(3000000000), "iat": float64(1000000000), "nbf": float64(1000000000), "sub": "test-subject", "nonce": "test-nonce", "jti": generateRandomString(16), "type": "id_token", @@ -285,7 +284,7 @@ func TestTemplatedHeadersIntegration(t *testing.T) { t.Fatalf("Failed to create test ID JWT: %v", idErr) } - accessTokenClaims := map[string]interface{}{ + accessTokenClaims := map[string]any{ "iss": "https://test-issuer.com", "aud": "test-client-id", "exp": float64(3000000000), "iat": float64(1000000000), "nbf": float64(1000000000), "sub": "test-subject", "jti": generateRandomString(16), "type": "access_token", "scope": "openid email profile", @@ -316,15 +315,13 @@ func TestTemplatedHeadersIntegration(t *testing.T) { tc.expectedHeaders["X-Access-Token"] = accessTokenForSession } } else if tc.name == "Opaque Access Token with AccessTokenField" { - idTokenClaims := map[string]interface{}{ + idTokenClaims := map[string]any{ "iss": "https://test-issuer.com", "aud": "test-client-id", "exp": float64(3000000000), "iat": float64(1000000000), "nbf": float64(1000000000), "sub": "test-subject", // Default sub "nonce": "test-nonce", "jti": generateRandomString(16), "type": "id_token", } // Populate ID token claims from tc.claims - for k, v := range tc.claims { - idTokenClaims[k] = v - } + maps.Copy(idTokenClaims, tc.claims) // Ensure email from tc.claims is used for the ID token session.SetEmail(tc.claims["email"].(string)) // Also set it directly for initial session state @@ -428,7 +425,7 @@ func TestEdgeCaseTemplatedHeaders(t *testing.T) { tests := []struct { name string headers []TemplatedHeader - claims map[string]interface{} + claims map[string]any shouldExecuteCheck bool }{ { @@ -447,8 +444,8 @@ func TestEdgeCaseTemplatedHeaders(t *testing.T) { headers: []TemplatedHeader{ {Name: "X-Roles", Value: "{{range $i, $e := .Claims.roles}}{{if $i}},{{end}}{{$e}}{{end}}"}, }, - claims: map[string]interface{}{ - "roles": []interface{}{"admin", "user", "manager"}, + claims: map[string]any{ + "roles": []any{"admin", "user", "manager"}, }, shouldExecuteCheck: true, }, @@ -457,7 +454,7 @@ func TestEdgeCaseTemplatedHeaders(t *testing.T) { for _, tc := range tests { t.Run(tc.name, func(t *testing.T) { // Create token with the test claims - claims := map[string]interface{}{ + claims := map[string]any{ "iss": "https://test-issuer.com", "aud": "test-client-id", "exp": float64(3000000000), // Far future timestamp @@ -469,9 +466,7 @@ func TestEdgeCaseTemplatedHeaders(t *testing.T) { } // Add the test-specific claims - for k, v := range tc.claims { - claims[k] = v - } + maps.Copy(claims, tc.claims) token, err := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", claims) if err != nil { @@ -576,7 +571,7 @@ func TestEdgeCaseTemplatedHeaders(t *testing.T) { // createLargeTemplate creates a template with many variable references func createLargeTemplate(size int) string { template := "{{with .Claims}}" - for i := 0; i < size; i++ { + for i := range size { if i > 0 { template += "," } @@ -587,9 +582,9 @@ func createLargeTemplate(size int) string { } // createLargeClaims creates a map with many claims for testing large templates -func createLargeClaims(size int) map[string]interface{} { - claims := make(map[string]interface{}) - for i := 0; i < size; i++ { +func createLargeClaims(size int) map[string]any { + claims := make(map[string]any) + for i := range size { claims["email"] = "largeclaimsuser@example.com" // Add email claim key := "field" + string(rune('a'+i%26)) + string(rune('0'+i%10)) claims[key] = "value" + string(rune('a'+i%26)) + string(rune('0'+i%10)) diff --git a/test_tokens.go b/test_tokens.go index 7d8f1d0..b43ff3d 100644 --- a/test_tokens.go +++ b/test_tokens.go @@ -61,13 +61,10 @@ func (tt *TestTokens) CreateLargeValidJWT(targetSize int) string { // Calculate required payload size usedSize := len(header) + len(signature) + 2 // account for dots - payloadSize := targetSize - usedSize - if payloadSize < 50 { - payloadSize = 50 - } + payloadSize := max(targetSize-usedSize, 50) // Create a payload with realistic JWT claims - claims := map[string]interface{}{ + claims := map[string]any{ "sub": "user123", "iss": "https://example.com", "aud": "client123", @@ -76,10 +73,11 @@ func (tt *TestTokens) CreateLargeValidJWT(targetSize int) string { } // FIXED: Calculate data size safely - dataSize := payloadSize - 100 // Account for other claims and base64 encoding - if dataSize < 10 { - dataSize = 10 // Minimum data size - } + dataSize := max( + // Account for other claims and base64 encoding + payloadSize-100, + // Minimum data size + 10) claims["data"] = tt.generateRandomString(dataSize) @@ -101,7 +99,7 @@ func (tt *TestTokens) CreateExpiredJWT() string { header := "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9" // Create claims with expired timestamp - claims := map[string]interface{}{ + claims := map[string]any{ "sub": "user123", "iss": "https://example.com", "aud": "client123", @@ -120,7 +118,7 @@ func (tt *TestTokens) CreateExpiredJWT() string { func (tt *TestTokens) CreateUniqueValidJWT(id string) string { header := "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9" - claims := map[string]interface{}{ + claims := map[string]any{ "sub": "user_" + id, "iss": "https://example.com", "aud": "client123", @@ -144,13 +142,10 @@ func (tt *TestTokens) CreateIncompressibleToken(targetSize int) string { // Calculate required payload size usedSize := len(header) + len(signature) + 2 // account for dots - payloadSize := targetSize - usedSize - if payloadSize < 100 { - payloadSize = 100 - } + payloadSize := max(targetSize-usedSize, 100) // Generate multiple random fields to prevent compression - randomFields := make(map[string]interface{}) + randomFields := make(map[string]any) randomFields["sub"] = "user123" randomFields["iss"] = "https://example.com" randomFields["aud"] = "client123" @@ -159,10 +154,9 @@ func (tt *TestTokens) CreateIncompressibleToken(targetSize int) string { // Add many random fields with random data to prevent compression remainingSize := payloadSize - 200 // Account for base64 encoding and other fields - fieldCount := remainingSize / 100 // ~100 bytes per field - if fieldCount < 1 { - fieldCount = 1 - } + fieldCount := max( + // ~100 bytes per field + remainingSize/100, 1) for i := 0; i < fieldCount; i++ { // Generate truly random data for each field @@ -302,7 +296,7 @@ func (ts *TestScenarios) CorruptionTest() CorruptionTestSet { // ConcurrentTest returns unique tokens for concurrent testing func (ts *TestScenarios) ConcurrentTest(count int) []TokenSet { sets := make([]TokenSet, count) - for i := 0; i < count; i++ { + for i := range count { sets[i] = TokenSet{ AccessToken: ts.tokens.CreateUniqueValidJWT(fmt.Sprintf("concurrent_%d", i)), IDToken: ts.tokens.CreateUniqueValidJWT(fmt.Sprintf("id_%d", i)), @@ -393,5 +387,5 @@ func AssertInvalidTokenRejection(t TestingInterface, session *SessionData, token // TestingInterface provides the minimal interface needed for testing type TestingInterface interface { - Errorf(format string, args ...interface{}) + Errorf(format string, args ...any) } diff --git a/token_corruption_test.go b/token_corruption_test.go index 2287ac0..bc30c6f 100644 --- a/token_corruption_test.go +++ b/token_corruption_test.go @@ -7,6 +7,7 @@ import ( "encoding/base64" "fmt" "net/http/httptest" + "slices" "strings" "sync" "testing" @@ -250,8 +251,8 @@ func TestChunkReassemblyEdgeCases(t *testing.T) { corruption: func(chunks map[int]*sessions.Session) { // This test simulates having too many chunks (>50 limit) // We'll create a scenario by adding many fake chunks - for i := 0; i < 60; i++ { - fakeSession := &sessions.Session{Values: make(map[interface{}]interface{})} + for i := range 60 { + fakeSession := &sessions.Session{Values: make(map[any]any)} fakeSession.Values["token_chunk"] = "fake_chunk_data" chunks[i] = fakeSession } @@ -320,12 +321,12 @@ func TestRaceConditionProtection(t *testing.T) { var wg sync.WaitGroup errChan := make(chan error, numGoroutines*numOperations) - for i := 0; i < numGoroutines; i++ { + for i := range numGoroutines { wg.Add(1) go func(goroutineID int) { defer wg.Done() - for j := 0; j < numOperations; j++ { + for j := range numOperations { tokenIndex := (goroutineID + j) % len(tokens) expectedToken := tokens[tokenIndex] @@ -344,13 +345,7 @@ func TestRaceConditionProtection(t *testing.T) { // The retrieved token should be one of the valid tokens we set // (due to concurrent access, it might not be the exact one we just set) - isValidToken := false - for _, validToken := range tokens { - if retrieved == validToken { - isValidToken = true - break - } - } + isValidToken := slices.Contains(tokens, retrieved) if retrieved != "" && !isValidToken { errChan <- fmt.Errorf("goroutine %d, op %d: retrieved unknown token: %q", diff --git a/token_handling_test.go b/token_handling_test.go index 6806c05..4f97c9a 100644 --- a/token_handling_test.go +++ b/token_handling_test.go @@ -22,14 +22,14 @@ func TestTokenTypeDistinction(t *testing.T) { AccessToken string IdToken string RefreshToken string - Claims map[string]interface{} + Claims map[string]any } testData := templateData{ AccessToken: "test-access-token-abc123", IdToken: "test-id-token-xyz789", RefreshToken: "test-refresh-token", - Claims: map[string]interface{}{ + Claims: map[string]any{ "sub": "test-subject", "email": "user@example.com", }, @@ -91,7 +91,7 @@ func TestTokenTypeIntegration(t *testing.T) { ts.Setup() // Create different tokens for ID and access tokens - idToken, err := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]interface{}{ + idToken, err := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]any{ "iss": "https://test-issuer.com", "aud": "test-client-id", "exp": float64(3000000000), @@ -107,7 +107,7 @@ func TestTokenTypeIntegration(t *testing.T) { t.Fatalf("Failed to create test ID JWT: %v", err) } - accessToken, err := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]interface{}{ + accessToken, err := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]any{ "iss": "https://test-issuer.com", "aud": "test-client-id", "exp": float64(3000000000), @@ -518,11 +518,11 @@ func TestConcurrentTokenOperationsWithCorruption(t *testing.T) { errorChan := make(chan error, numGoroutines*numOperations) // Start concurrent operations - for i := 0; i < numGoroutines; i++ { + for i := range numGoroutines { go func(goroutineID int) { defer func() { done <- true }() - for j := 0; j < numOperations; j++ { + for j := range numOperations { // Create a unique valid token for each operation token := fmt.Sprintf("eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwib3AiOiIxMjMifQ.sig_%d_%d", goroutineID, j) @@ -563,7 +563,7 @@ func TestConcurrentTokenOperationsWithCorruption(t *testing.T) { } // Wait for all goroutines to complete - for i := 0; i < numGoroutines; i++ { + for range numGoroutines { <-done } close(errorChan) @@ -645,13 +645,10 @@ func createLargeValidJWT(targetSize int) string { // Calculate required payload size usedSize := len(header) + len(signature) + 2 // account for dots - payloadSize := targetSize - usedSize - if payloadSize < 50 { - payloadSize = 50 - } + payloadSize := max(targetSize-usedSize, 50) // Create a payload with realistic JWT claims - claims := map[string]interface{}{ + claims := map[string]any{ "sub": "user123", "iss": "https://example.com", "aud": "client123",