Problem

We are still callingValidateGroup() directly withinsso_proxy, but using the options/validator package elsewhere in the same logic path (originally partially due to circular imports). This makes it increasingly difficult to make sure we were running the right validations at the right time, and certain methods were growing in complexity and responsibility.

Solution

Attempt to reunite some of the most problematic portions of code in related to the above.

High level overview of included changes:

• MovesextendDeadline andwithinGracePeriod to be part of the sessions package, instead of the providers package. (In fact, a version ofextendDeadline already exists in the session package. We now use that instead)
• Changes direct calls toValidateGroup withininternal/proxy/providers/sso.go to options/validator package calls withininternal/proxy/providers/oauthproxy.go.
  • Introduces therunValidatorsWithGracePeriod helper method here to help handle cases where we want to check if the auth provider is unavailable instead of explicitly denying authentication.
• Renames theValidateSessionState method toValidateSessionToken, which seemed to better fit its responsibility.
• Modify tests to explicitly test new logic
• Some formatting simplification/changes of the validator errors, and other general refactoring

Notes

The perhaps less obvious change is that within theAuthenticate() methodwe'll now only run validators when the refresh or validation period has expired.
This is instead of running group validations when the refresh or validation period has expired, and domain/email validations on all proxied requests.

---------- EDIT -----------

Additional changes

• This also now includes some logic to prevent the copying + use of a cookie authorised with upstream 'foo' with upstream 'bar'. A newAuthorisedUpstream value has been added to the session which is checked against the request host.
  For the time being, when caught this check will re-trigger the start of the oauth flow, primarily to help introduce this additional check in a graceful manner.

• options package now renamed tovalidators to better represent its responsibility.