all: refactor handler logic

- all: prefer `FormValues` to `ParseForm` with subsequent `Form.Get`s
- all: refactor authentication stack to be checked by middleware, and accessible via request context.
- all: replace http.ServeMux with gorilla/mux’s router
- all: replace custom CSRF checks with gorilla/csrf middleware
- authenticate: extract callback path as constant.
- internal/config: implement stringer interface for policy
- internal/cryptutil: add helper func `NewBase64Key`
- internal/cryptutil: rename `GenerateKey` to `NewKey`
- internal/cryptutil: rename `GenerateRandomString` to `NewRandomStringN`
- internal/middleware: removed alice in favor of gorilla/mux
- internal/sessions: remove unused `ValidateRedirectURI` and `ValidateClientSecret`
- internal/sessions: replace custom CSRF with gorilla/csrf fork that supports custom handler protection
- internal/urlutil: add `SignedRedirectURL` to create hmac'd URLs
- internal/urlutil: add `ValidateURL` helper to parse URL options
- internal/urlutil: add `GetAbsoluteURL` which takes a request and returns its absolute URL.
- proxy: remove holdover state verification checks; we no longer are setting sessions in any proxy routes so we don’t need them.
- proxy: replace un-named http.ServeMux with named domain routes.

Signed-off-by: Bobby DeSimone <bobbydesimone@gmail.com>

internal/urlutil/url_test.go

@@ -1,6 +1,7 @@
 package urlutil
 
 import (
+	"net/http"
 	"net/url"
 	"reflect"
 	"testing"
@@ -35,7 +36,7 @@ func Test_StripPort(t *testing.T) {
 }
 
 func TestParseAndValidateURL(t *testing.T) {
-
+	t.Parallel()
 	tests := []struct {
 		name    string
 		rawurl  string
@@ -63,7 +64,7 @@ func TestParseAndValidateURL(t *testing.T) {
 }
 
 func TestDeepCopy(t *testing.T) {
-
+	t.Parallel()
 	tests := []struct {
 		name    string
 		u       *url.URL
@@ -87,3 +88,90 @@ func TestDeepCopy(t *testing.T) {
 		})
 	}
 }
+
+func TestValidateURL(t *testing.T) {
+	t.Parallel()
+	tests := []struct {
+		name    string
+		u       *url.URL
+		wantErr bool
+	}{
+		{"good", &url.URL{Scheme: "https", Host: "some.example"}, false},
+		{"nil", nil, true},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if err := ValidateURL(tt.u); (err != nil) != tt.wantErr {
+				t.Errorf("ValidateURL() error = %v, wantErr %v", err, tt.wantErr)
+			}
+		})
+	}
+}
+
+func TestSignedRedirectURL(t *testing.T) {
+	t.Parallel()
+	tests := []struct {
+		name        string
+		mockedTime  int64
+		key         string
+		destination *url.URL
+		urlToSign   *url.URL
+		want        *url.URL
+	}{
+		{"good", 2, "hunter42", &url.URL{Host: "pomerium.io", Scheme: "https://"}, &url.URL{Host: "pomerium.io", Scheme: "https://", Path: "/ok"}, &url.URL{Host: "pomerium.io", Scheme: "https://", RawQuery: "redirect_uri=https%3A%2F%2F%3A%2F%2Fpomerium.io%2Fok&sig=7jdo1XFcmuhjBHnpfVhll5cXflYByeMnbp5kRz87CVQ%3D&ts=2"}},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			testTimeNow = tt.mockedTime
+			got := SignedRedirectURL(tt.key, tt.destination, tt.urlToSign)
+			if diff := cmp.Diff(got, tt.want); diff != "" {
+				t.Errorf("SignedRedirectURL() = diff %v", diff)
+			}
+		})
+	}
+}
+
+func Test_timestamp(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name     string
+		dontWant int64
+	}{
+		{"if unset should never return", 0},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			testTimeNow = tt.dontWant
+			if got := timestamp(); got == tt.dontWant {
+				t.Errorf("timestamp() = %v, dontWant %v", got, tt.dontWant)
+			}
+		})
+	}
+}
+
+func parseURLHelper(s string) *url.URL {
+	u, _ := url.Parse(s)
+	return u
+}
+
+func TestGetAbsoluteURL(t *testing.T) {
+	t.Parallel()
+	tests := []struct {
+		name string
+		u    *url.URL
+		want *url.URL
+	}{
+		{"add https", parseURLHelper("http://pomerium.io"), parseURLHelper("https://pomerium.io")},
+		{"missing scheme", parseURLHelper("https://pomerium.io"), parseURLHelper("https://pomerium.io")},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			r := http.Request{URL: tt.u, Host: tt.u.Host}
+			got := GetAbsoluteURL(&r)
+			if diff := cmp.Diff(got, tt.want); diff != "" {
+				t.Errorf("GetAbsoluteURL() = %v", diff)
+			}
+		})
+	}
+}