authenticate: hide impersonation form from non-admin users (#979)

Fixes #881

authenticate/authenticate_test.go

@@ -3,6 +3,9 @@ package authenticate
 import (
 	"testing"
 
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
 	"github.com/pomerium/pomerium/config"
 )
 
@@ -133,3 +136,28 @@ func TestNew(t *testing.T) {
 		})
 	}
 }
+
+func TestIsAdmin(t *testing.T) {
+	tests := []struct {
+		name    string
+		user    string
+		admins  []string
+		isAdmin bool
+	}{
+		{"Is admin", "foo@bar.com", []string{"foo@bar.com"}, true},
+		{"Is not admin", "foo@bar.com", []string{"baz@bar.com"}, false},
+		{"Empty admin groups", "foo@bar.com", []string{}, false},
+		{"Empty user", "", []string{"foo@bar.com"}, false},
+	}
+	for _, tc := range tests {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+			opts := newTestOptions(t)
+			opts.Administrators = tc.admins
+			a, err := New(*opts)
+			require.NoError(t, err)
+			assert.True(t, a.isAdmin(tc.user) == tc.isAdmin)
+		})
+	}
+}